From dc58f6fa8748fe947f6a039d5dc332e4cc48cadf Mon Sep 17 00:00:00 2001
From: dilanbhalla <dbhalla21@berkeley.edu>
Date: Thu, 25 Jun 2020 11:39:09 -0700
Subject: [PATCH 001/433] function/class synatax

---
 .../Classes/NamingConventionsClasses.qhelp    | 30 +++++++++++++++++++
 .../src/Classes/NamingConventionsClasses.ql   | 17 +++++++++++
 .../NamingConventionsFunctions.qhelp          | 30 +++++++++++++++++++
 .../Functions/NamingConventionsFunctions.ql   | 17 +++++++++++
 .../Naming/NamingConventionsClasses.expected  |  1 +
 .../Naming/NamingConventionsClasses.py        | 11 +++++++
 .../Naming/NamingConventionsClasses.qlref     |  1 +
 .../NamingConventionsFunctions.expected       |  1 +
 .../general/NamingConventionsFunctions.py     |  9 ++++++
 .../general/NamingConventionsFunctions.qlref  |  1 +
 10 files changed, 118 insertions(+)
 create mode 100644 python/ql/src/Classes/NamingConventionsClasses.qhelp
 create mode 100644 python/ql/src/Classes/NamingConventionsClasses.ql
 create mode 100644 python/ql/src/Functions/NamingConventionsFunctions.qhelp
 create mode 100644 python/ql/src/Functions/NamingConventionsFunctions.ql
 create mode 100644 python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected
 create mode 100644 python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py
 create mode 100644 python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
 create mode 100644 python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected
 create mode 100644 python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py
 create mode 100644 python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref

diff --git a/python/ql/src/Classes/NamingConventionsClasses.qhelp b/python/ql/src/Classes/NamingConventionsClasses.qhelp
new file mode 100644
index 000000000000..7a6c0ca13dd8
--- /dev/null
+++ b/python/ql/src/Classes/NamingConventionsClasses.qhelp
@@ -0,0 +1,30 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>A class name that begins with a lowercase letter does not follow standard
+naming conventions. This decreases code readability. For example, <code>class background</code>.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Write the class name beginning with an uppercase letter. For example, <code>class Background</code>.
+</p>
+
+</recommendation>
+
+<references>
+
+<li>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
+  <a href="https://www.python.org/dev/peps/pep-0008/#class-names"</a>
+</li>
+
+</references>
+
+</qhelp>
diff --git a/python/ql/src/Classes/NamingConventionsClasses.ql b/python/ql/src/Classes/NamingConventionsClasses.ql
new file mode 100644
index 000000000000..a1744f5d3e6e
--- /dev/null
+++ b/python/ql/src/Classes/NamingConventionsClasses.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Misnamed class
+ * @description A class name that begins with a lowercase letter decreases readability.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id python/misnamed-type
+ * @tags maintainability
+ */
+
+import python
+
+from Class c
+where
+  c.inSource() and
+  not c.getName().substring(0, 1).toUpperCase() = c.getName().substring(0, 1)
+select c, "Class names should start in uppercase."
diff --git a/python/ql/src/Functions/NamingConventionsFunctions.qhelp b/python/ql/src/Functions/NamingConventionsFunctions.qhelp
new file mode 100644
index 000000000000..15014045542c
--- /dev/null
+++ b/python/ql/src/Functions/NamingConventionsFunctions.qhelp
@@ -0,0 +1,30 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>A function name that begins with an uppercase letter does not follow standard
+naming conventions. This decreases code readability. For example, <code>Jump</code>.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Write the function name beginning with an lowercase letter. For example, <code>jump</code>.
+</p>
+
+</recommendation>
+
+<references>
+
+<li>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
+  <a href="https://www.python.org/dev/peps/pep-0008/#function-and-variable-names"</a>
+</li>
+
+</references>
+
+</qhelp>
diff --git a/python/ql/src/Functions/NamingConventionsFunctions.ql b/python/ql/src/Functions/NamingConventionsFunctions.ql
new file mode 100644
index 000000000000..3ed619bc084e
--- /dev/null
+++ b/python/ql/src/Functions/NamingConventionsFunctions.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Misnamed function
+ * @description A function name that begins with an uppercase letter decreases readability.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id python/misnamed-function
+ * @tags maintainability
+ */
+
+import python
+
+from Function f
+where
+  f.inSource() and
+  not f.getName().substring(0, 1).toLowerCase() = f.getName().substring(0, 1)
+select f, "Function names should start in lowercase."
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected
new file mode 100644
index 000000000000..8e6dea7fce4a
--- /dev/null
+++ b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected
@@ -0,0 +1 @@
+| NamingConventionsClasses.py:2:1:2:14 | Class badName | Class names should start in uppercase. |
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py
new file mode 100644
index 000000000000..c07bdb57234a
--- /dev/null
+++ b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py
@@ -0,0 +1,11 @@
+# BAD, do not start class or interface name with lowercase letter
+class badName:
+
+    def hello(self):
+        print("hello")
+
+# Good, class name starts with capital letter
+class GoodName:
+
+    def hello(self):
+        print("hello")
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
new file mode 100644
index 000000000000..01ad29859da2
--- /dev/null
+++ b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
@@ -0,0 +1 @@
+Classes/NamingConventionsClasses.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected
new file mode 100644
index 000000000000..d87fe6c16f3e
--- /dev/null
+++ b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected
@@ -0,0 +1 @@
+| NamingConventionsFunctions.py:4:5:4:25 | Function HelloWorld | Function names should start in lowercase. |
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py
new file mode 100644
index 000000000000..fb3e89ab8e92
--- /dev/null
+++ b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py
@@ -0,0 +1,9 @@
+class Test:
+
+    # BAD, do not start function name with uppercase letter
+    def HelloWorld(self):
+        print("hello world")
+
+    # GOOD, function name starts with lowercase letter
+    def hello_world(self):
+        print("hello world")
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref
new file mode 100644
index 000000000000..da4780ecbe9d
--- /dev/null
+++ b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref
@@ -0,0 +1 @@
+Functions/NamingConventionsFunctions.ql
\ No newline at end of file

From dc73fcc4e856cbfc3ea5967013dcf858679563f8 Mon Sep 17 00:00:00 2001
From: dilanbhalla <dbhalla21@berkeley.edu>
Date: Wed, 1 Jul 2020 09:54:58 -0700
Subject: [PATCH 002/433] moved to experimental

---
 .../{ => experimental}/Classes/NamingConventionsClasses.qhelp    | 0
 .../src/{ => experimental}/Classes/NamingConventionsClasses.ql   | 0
 .../Functions/NamingConventionsFunctions.qhelp                   | 0
 .../{ => experimental}/Functions/NamingConventionsFunctions.ql   | 0
 .../query-tests/Classes/Naming/NamingConventionsClasses.expected | 0
 .../query-tests/Classes/Naming/NamingConventionsClasses.py       | 0
 .../query-tests/Classes/Naming/NamingConventionsClasses.qlref    | 1 +
 .../Functions/general/NamingConventionsFunctions.expected        | 0
 .../query-tests/Functions/general/NamingConventionsFunctions.py  | 0
 .../Functions/general/NamingConventionsFunctions.qlref           | 1 +
 .../query-tests/Classes/Naming/NamingConventionsClasses.qlref    | 1 -
 .../Functions/general/NamingConventionsFunctions.qlref           | 1 -
 12 files changed, 2 insertions(+), 2 deletions(-)
 rename python/ql/src/{ => experimental}/Classes/NamingConventionsClasses.qhelp (100%)
 rename python/ql/src/{ => experimental}/Classes/NamingConventionsClasses.ql (100%)
 rename python/ql/src/{ => experimental}/Functions/NamingConventionsFunctions.qhelp (100%)
 rename python/ql/src/{ => experimental}/Functions/NamingConventionsFunctions.ql (100%)
 rename python/ql/test/{ => experimental}/query-tests/Classes/Naming/NamingConventionsClasses.expected (100%)
 rename python/ql/test/{ => experimental}/query-tests/Classes/Naming/NamingConventionsClasses.py (100%)
 create mode 100644 python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref
 rename python/ql/test/{ => experimental}/query-tests/Functions/general/NamingConventionsFunctions.expected (100%)
 rename python/ql/test/{ => experimental}/query-tests/Functions/general/NamingConventionsFunctions.py (100%)
 create mode 100644 python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref
 delete mode 100644 python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
 delete mode 100644 python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref

diff --git a/python/ql/src/Classes/NamingConventionsClasses.qhelp b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
similarity index 100%
rename from python/ql/src/Classes/NamingConventionsClasses.qhelp
rename to python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
diff --git a/python/ql/src/Classes/NamingConventionsClasses.ql b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
similarity index 100%
rename from python/ql/src/Classes/NamingConventionsClasses.ql
rename to python/ql/src/experimental/Classes/NamingConventionsClasses.ql
diff --git a/python/ql/src/Functions/NamingConventionsFunctions.qhelp b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
similarity index 100%
rename from python/ql/src/Functions/NamingConventionsFunctions.qhelp
rename to python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
diff --git a/python/ql/src/Functions/NamingConventionsFunctions.ql b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
similarity index 100%
rename from python/ql/src/Functions/NamingConventionsFunctions.ql
rename to python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.expected
similarity index 100%
rename from python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.expected
rename to python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.expected
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.py
similarity index 100%
rename from python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.py
rename to python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.py
diff --git a/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref
new file mode 100644
index 000000000000..7ed945d782c4
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref
@@ -0,0 +1 @@
+experimental/Classes/NamingConventionsClasses.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.expected
similarity index 100%
rename from python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.expected
rename to python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.expected
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.py
similarity index 100%
rename from python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.py
rename to python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.py
diff --git a/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref
new file mode 100644
index 000000000000..0204694de0a3
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref
@@ -0,0 +1 @@
+experimental/Functions/NamingConventionsFunctions.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref b/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
deleted file mode 100644
index 01ad29859da2..000000000000
--- a/python/ql/test/query-tests/Classes/Naming/NamingConventionsClasses.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Classes/NamingConventionsClasses.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref b/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref
deleted file mode 100644
index da4780ecbe9d..000000000000
--- a/python/ql/test/query-tests/Functions/general/NamingConventionsFunctions.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Functions/NamingConventionsFunctions.ql
\ No newline at end of file

From 26b030f8ccaf1b1922623a035e15cef239ec7314 Mon Sep 17 00:00:00 2001
From: dilanbhalla <dbhalla21@berkeley.edu>
Date: Tue, 7 Jul 2020 10:52:26 -0700
Subject: [PATCH 003/433] fixed pr suggestions

---
 .../Classes/NamingConventionsClasses.qhelp         |  2 +-
 .../Classes/NamingConventionsClasses.ql            | 14 ++++++++++----
 .../Functions/NamingConventionsFunctions.qhelp     |  2 +-
 .../Functions/NamingConventionsFunctions.ql        | 14 ++++++++++----
 4 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
index 7a6c0ca13dd8..1a7f4bc45a4f 100644
--- a/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
@@ -22,7 +22,7 @@ Write the class name beginning with an uppercase letter. For example, <code>clas
 
 <li>
   Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
-  <a href="https://www.python.org/dev/peps/pep-0008/#class-names"</a>
+  <a href="https://www.python.org/dev/peps/pep-0008/#class-names">Python Class Names</a>
 </li>
 
 </references>
diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
index a1744f5d3e6e..d4919c3ece8d 100644
--- a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
@@ -3,15 +3,21 @@
  * @description A class name that begins with a lowercase letter decreases readability.
  * @kind problem
  * @problem.severity recommendation
- * @precision medium
- * @id python/misnamed-type
+ * @id py/misnamed-class
  * @tags maintainability
  */
 
 import python
 
-from Class c
+from Class c, string first_char
 where
   c.inSource() and
-  not c.getName().substring(0, 1).toUpperCase() = c.getName().substring(0, 1)
+  first_char = c.getName().prefix(1) and
+  not first_char = first_char.toUpperCase() and
+  not exists(Class c1, string first_char1 |
+    c1 != c and
+    c1.getLocation().getFile() = c.getLocation().getFile() and
+    first_char1 = c1.getName().prefix(1) and
+    not first_char1 = first_char1.toUpperCase()
+  )
 select c, "Class names should start in uppercase."
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
index 15014045542c..46d948592ff2 100644
--- a/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
@@ -22,7 +22,7 @@ Write the function name beginning with an lowercase letter. For example, <code>j
 
 <li>
   Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
-  <a href="https://www.python.org/dev/peps/pep-0008/#function-and-variable-names"</a>
+  <a href="https://www.python.org/dev/peps/pep-0008/#function-and-variable-names">Python Function and Variable Names</a>
 </li>
 
 </references>
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
index 3ed619bc084e..80dc0e99cd8e 100644
--- a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
@@ -3,15 +3,21 @@
  * @description A function name that begins with an uppercase letter decreases readability.
  * @kind problem
  * @problem.severity recommendation
- * @precision medium
- * @id python/misnamed-function
+ * @id py/misnamed-function
  * @tags maintainability
  */
 
 import python
 
-from Function f
+from Function f, string first_char
 where
   f.inSource() and
-  not f.getName().substring(0, 1).toLowerCase() = f.getName().substring(0, 1)
+  first_char = f.getName().prefix(1) and
+  not first_char = first_char.toLowerCase() and
+  not exists(Function f1, string first_char1 |
+    f1 != f and
+    f1.getLocation().getFile() = f.getLocation().getFile() and
+    first_char1 = f1.getName().prefix(1) and
+    not first_char1 = first_char1.toLowerCase()
+  )
 select f, "Function names should start in lowercase."

From 8119fd2ad1e2d009991f9a12969ccd55054163c4 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 18 Feb 2021 18:11:10 +0800
Subject: [PATCH 004/433] *)add JsonHijacking ql query

---
 .../Security/CWE/CWE-352/JsonHijacking.java   | 119 ++++++++++++++++++
 .../Security/CWE/CWE-352/JsonHijacking.qhelp  |  35 ++++++
 .../src/Security/CWE/CWE-352/JsonHijacking.ql |  32 +++++
 .../Security/CWE/CWE-352/JsonHijackingLib.qll |  92 ++++++++++++++
 .../Security/CWE/CWE-352/JsonStringLib.qll    |  42 +++++++
 .../security/CWE-352/JsonHijacking.expected   |  48 +++++++
 .../security/CWE-352/JsonHijacking.java       | 119 ++++++++++++++++++
 .../security/CWE-352/JsonHijacking.qlref      |   1 +
 .../query-tests/security/CWE-352/options      |   1 +
 .../com/alibaba/fastjson/JSON.java            |   4 +
 .../stereotype/Controller.java                |  14 +++
 .../core/annotation/AliasFor.class            | Bin 0 -> 385 bytes
 .../core/annotation/AliasFor.java             |  10 ++
 .../web/bind/annotation/GetMapping.class      | Bin 0 -> 504 bytes
 .../web/bind/annotation/GetMapping.java       |  19 +++
 .../web/bind/annotation/RequestMapping.java   |  13 ++
 .../web/bind/annotation/ResponseBody.class    | Bin 0 -> 184 bytes
 .../web/bind/annotation/ResponseBody.java     |   4 +
 18 files changed, 553 insertions(+)
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/options
 create mode 100644 java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java

diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
new file mode 100644
index 000000000000..d08d436fa07b
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
@@ -0,0 +1,119 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import java.util.Random;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class JsonHijacking {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp7")
+    @ResponseBody
+    public String good(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String val = "";
+        Random random = new Random();
+        for (int i = 0; i < 10; i++) {
+            val += String.valueOf(random.nextInt(10));
+        }
+        // good
+        jsonpCallback = jsonpCallback + "_" + val;
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
new file mode 100644
index 000000000000..38e1845f9929
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
@@ -0,0 +1,35 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The software uses external input as the function name to wrap JSON data and return it to the client as a request response. When there is a cross-domain problem, 
+there is a problem of sensitive information leakage.</p>
+
+</overview>
+<recommendation>
+
+<p>The function name verification processing for external input can effectively prevent the leakage of sensitive information.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows the case of no verification processing and verification processing for the external input function name.</p>
+
+<sample src="JsonHijacking.java" />
+
+</example>
+<references>
+
+<li>
+OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes: 
+<a href="https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf">JSON hijacking</a>.
+</li>
+<li>
+Practical JSONP Injection:
+<a href="https://securitycafe.ro/2017/01/18/practical-jsonp-injection">
+  Completely controllable from the URL (GET variable)
+</a>.
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
new file mode 100644
index 000000000000..a6a6d2475f09
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
@@ -0,0 +1,32 @@
+/**
+ * @name JSON Hijacking
+ * @description User-controlled callback function names that are not verified are vulnerable
+ *              to json hijacking attacks.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/Json-hijacking
+ * @tags security
+ *       external/cwe/cwe-352
+ */
+
+import java
+import JsonHijackingLib
+import semmle.code.java.dataflow.FlowSources
+import DataFlow::PathGraph
+
+/** Taint-tracking configuration tracing flow from remote sources to output jsonp data. */
+class JsonHijackingConfig extends TaintTracking::Configuration {
+  JsonHijackingConfig() { this = "JsonHijackingConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonHijackingSink }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, JsonHijackingConfig conf
+where
+  conf.hasFlowPath(source, sink) and
+  exists(JsonHijackingFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
+select sink.getNode(), source, sink, "Json Hijacking query might include code from $@.",
+  source.getNode(), "this user input"
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
new file mode 100644
index 000000000000..ba91a6670bfd
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
@@ -0,0 +1,92 @@
+import java
+import DataFlow
+import JsonStringLib
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.spring.SpringController
+
+/** A data flow sink for unvalidated user input that is used to jsonp. */
+abstract class JsonHijackingSink extends DataFlow::Node { }
+
+/** Use ```print```, ```println```, ```write``` to output result. */
+private class WriterPrintln extends JsonHijackingSink {
+  WriterPrintln() {
+    exists(MethodAccess ma |
+      ma.getMethod().getName().regexpMatch("print|println|write") and
+      ma.getMethod()
+          .getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("java.io", "PrintWriter") and
+      ma.getArgument(0) = this.asExpr()
+    )
+  }
+}
+
+/** Spring Request Method return result. */
+private class SpringReturn extends JsonHijackingSink {
+  SpringReturn() {
+    exists(ReturnStmt rs, Method m | m = rs.getEnclosingCallable() |
+      m instanceof SpringRequestMappingMethod and
+      rs.getResult() = this.asExpr()
+    )
+  }
+}
+
+/** A concatenate expression using `(` and `)` or `);`. */
+class JsonHijackingExpr extends AddExpr {
+  JsonHijackingExpr() {
+    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
+    getLeftOperand()
+        .(AddExpr)
+        .getLeftOperand()
+        .(AddExpr)
+        .getRightOperand()
+        .toString()
+        .regexpMatch("\"\\(\"")
+  }
+
+  /** Get the jsonp function name of this expression */
+  Expr getFunctionName() {
+    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
+  }
+
+  /** Get the json data of this expression */
+  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
+}
+
+/** A data flow configuration tracing flow from remote sources to jsonp function name. */
+class RemoteFlowConfig extends DataFlow2::Configuration {
+  RemoteFlowConfig() { this = "RemoteFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonHijackingExpr jhe | jhe.getFunctionName() = sink.asExpr())
+  }
+}
+
+/** A data flow configuration tracing flow from json data to splicing jsonp data. */
+class JsonDataFlowConfig extends DataFlow2::Configuration {
+  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonHijackingExpr jhe | jhe.getJsonExpr() = sink.asExpr())
+  }
+}
+
+/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+class JsonHijackingFlowConfig extends TaintTracking::Configuration {
+  JsonHijackingFlowConfig() { this = "JsonHijackingFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(JsonHijackingExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
+      jhe = src.asExpr() and
+      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
+      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonHijackingSink }
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll
new file mode 100644
index 000000000000..0da8bc860d11
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll
@@ -0,0 +1,42 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import DataFlow::PathGraph
+
+/** Json string type data */
+abstract class JsonpStringSource extends DataFlow::Node { }
+
+/** Convert to String using Gson library. */
+private class GsonString extends JsonpStringSource {
+  GsonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("toJson") and
+      m.getDeclaringType().getASupertype*().hasQualifiedName("com.google.gson", "Gson") and
+      this.asExpr() = ma
+    )
+  }
+}
+
+/** Convert to String using Fastjson library. */
+private class FastjsonString extends JsonpStringSource {
+  FastjsonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("toJSONString") and
+      m.getDeclaringType().getASupertype*().hasQualifiedName("com.alibaba.fastjson", "JSON") and
+      this.asExpr() = ma
+    )
+  }
+}
+
+/** Convert to String using Jackson library. */
+private class JacksonString extends JsonpStringSource {
+  JacksonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("writeValueAsString") and
+      m.getDeclaringType()
+          .getASupertype*()
+          .hasQualifiedName("com.fasterxml.jackson.databind", "ObjectMapper") and
+      this.asExpr() = ma
+    )
+  }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
new file mode 100644
index 000000000000..8efc3be1673b
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
@@ -0,0 +1,48 @@
+edges
+| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr |
+| JsonHijacking.java:32:21:32:54 | ... + ... : String | JsonHijacking.java:33:16:33:24 | resultStr |
+| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr |
+| JsonHijacking.java:42:21:42:80 | ... + ... : String | JsonHijacking.java:44:16:44:24 | resultStr |
+| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr |
+| JsonHijacking.java:53:21:53:55 | ... + ... : String | JsonHijacking.java:54:16:54:24 | resultStr |
+| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr |
+| JsonHijacking.java:63:21:63:54 | ... + ... : String | JsonHijacking.java:64:16:64:24 | resultStr |
+| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr |
+| JsonHijacking.java:79:21:79:54 | ... + ... : String | JsonHijacking.java:80:20:80:28 | resultStr |
+| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr |
+| JsonHijacking.java:94:21:94:54 | ... + ... : String | JsonHijacking.java:95:20:95:28 | resultStr |
+| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | JsonHijacking.java:113:16:113:24 | resultStr |
+nodes
+| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:32:21:32:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:42:21:42:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:53:21:53:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:63:21:63:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:94:21:94:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
+| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonHijacking.java:113:16:113:24 | resultStr | semmle.label | resultStr |
+#select
+| JsonHijacking.java:33:16:33:24 | resultStr | JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:28:32:28:68 | getParameter(...) | this user input |
+| JsonHijacking.java:44:16:44:24 | resultStr | JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:40:32:40:68 | getParameter(...) | this user input |
+| JsonHijacking.java:54:16:54:24 | resultStr | JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:51:32:51:68 | getParameter(...) | this user input |
+| JsonHijacking.java:64:16:64:24 | resultStr | JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:61:32:61:68 | getParameter(...) | this user input |
+| JsonHijacking.java:80:20:80:28 | resultStr | JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:72:32:72:68 | getParameter(...) | this user input |
+| JsonHijacking.java:95:20:95:28 | resultStr | JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:88:32:88:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
new file mode 100644
index 000000000000..9b473e0610ca
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
@@ -0,0 +1,119 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import java.util.Random;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class JsonHijacking {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp7")
+    @ResponseBody
+    public String good(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String val = "";
+        Random random = new Random();
+        for (int i = 0; i < 10; i++) {
+            val += String.valueOf(random.nextInt(10));
+        }
+        // good
+        jsonpCallback = jsonpCallback + "_" + val;
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref
new file mode 100644
index 000000000000..e79471b3c1ed
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-352/JsonHijacking.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/options b/java/ql/test/experimental/query-tests/security/CWE-352/options
new file mode 100644
index 000000000000..3676b8e38b69
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../stubs/gson-2.8.6/:${testdir}/../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../stubs/springframework-5.2.3/:${testdir}/../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../stubs/spring-core-5.3.2/
diff --git a/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java b/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
index b71e890e9b79..99e2873d3750 100644
--- a/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
+++ b/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
@@ -26,6 +26,10 @@
 import com.alibaba.fastjson.parser.deserializer.ParseProcess;
 
 public abstract class JSON {
+    public static String toJSONString(Object object) {
+        return null;
+    }
+
     public static Object parse(String text) {
         return null;
     }
diff --git a/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java b/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
new file mode 100644
index 000000000000..9b1751fa2ae3
--- /dev/null
+++ b/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
@@ -0,0 +1,14 @@
+package org.springframework.stereotype;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface Controller {
+    String value() default "";
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class
new file mode 100644
index 0000000000000000000000000000000000000000..438065489278b92503abc2ad8d75716c5e56ac08
GIT binary patch
literal 385
zcmb7=!Ab)$5QhJ0x31k<t>DdrH&Kx0=)qG#3PM4!PcXZrOKO@(l3m};gAd?CiL-}x
zJqaEL=Fj~6^G&|KKRyB6W0qr@<21(^Vbrp1G~wdrcD3b}m1S3}bqdDS4}|lDb3So0
z-aYCKH#QMKxO{0`GCTd`S`$rab#IG=`O1e{#kVeF6L_cJeRx%s4_fgdPA#nAxb#7`
zj5*1|vPl9`tbG$Iy);(DbZ?q>Y=pc21QTZcMbG6{R|0?4KmBGoU|o}(H;@|2R}C^k
ghLPwaQNxHF$I?t>JeJBL3UL&FIx;a%x-6Xh0OC_*bpQYW

literal 0
HcmV?d00001

diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
new file mode 100644
index 000000000000..3a823fade5b0
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
@@ -0,0 +1,10 @@
+package org.springframework.core.annotation;
+
+public @interface AliasFor {
+    @AliasFor("attribute")
+    String value() default "";
+
+    @AliasFor("value")
+    String attribute() default "";
+
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class
new file mode 100644
index 0000000000000000000000000000000000000000..5392ca0ebc1593d6bfa2f7d765ee4ca169fb260f
GIT binary patch
literal 504
zcma)&y-ve06orr5G%4k$Ewlp@8)_FUu~3N#3Bgi?)JiO!oYW02i5(KVeK!UkfQLfd
z3?&dTFj%_xlg>TI=i~G39l#Za0geNl1Q;-QTBMR;Fd9$SVk3AWbj;^AS316C=-+5<
ztgy=HTe%W0u?%2nZA9WoH5`o>f62T|*k=Ym6S+tWhIV9h;Zj+SS#FjtD#y;;xIB_~
zDxp)|dubm;mXYs88HC|<=CoC*d{Tu96Imr8>11m1m={?Yb44C<Yw{Pql_3w6UUKoB
zn$P5`lf~{ded+SQ$|?{;uj=M8T+4`RIIGYPyDH^5qoNx0n$)@PQPXJA=F`?J5D;i%
gZwD3tfleLl*TF#@9R332cSQFa=%QD;()m8{1xN6E{{R30

literal 0
HcmV?d00001

diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
new file mode 100644
index 000000000000..1190be7b879b
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
@@ -0,0 +1,19 @@
+package org.springframework.web.bind.annotation;
+
+import org.springframework.core.annotation.AliasFor;
+
+@RequestMapping
+public @interface GetMapping {
+   
+    String name() default "";
+
+    String[] value() default {};
+
+    String[] path() default {};
+
+    String[] params() default {};
+
+    String[] consumes() default {};
+
+    String[] produces() default {};
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
new file mode 100644
index 000000000000..3415800b927d
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
@@ -0,0 +1,13 @@
+package org.springframework.web.bind.annotation;
+
+import org.springframework.core.annotation.AliasFor;
+
+public @interface RequestMapping {
+    String name() default "";
+
+    @AliasFor("path")
+    String[] value() default {};
+
+    @AliasFor("value")
+    String[] path() default {};
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class
new file mode 100644
index 0000000000000000000000000000000000000000..5e08f3e6a0acd663e6130e304a4d1251a31188fb
GIT binary patch
literal 184
zcmX^0Z`VEs1_pBmPId-1b_RBK1`b9BuHgLAqU2P!%$!t42Em}z;)49V;#8;nluEs<
z#Ii(229x}vbp7IjqRhPXw4%h^)bjkIZ2j`oB>kk!ycGS!yuAF9#FEVXJbh%nj0^%G
u-TFC+dFlH8Nm;4MC5#O62q7eGj&Kvy7#SEDn1GlW=t>44%>pEu7+3+XjWw+R

literal 0
HcmV?d00001

diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
new file mode 100644
index 000000000000..b2134009968b
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
@@ -0,0 +1,4 @@
+package org.springframework.web.bind.annotation;
+
+public @interface ResponseBody {
+}

From 872a000a33e1b0d6fb2efeb926c7ed9e18725bd5 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 24 Feb 2021 20:36:12 +0800
Subject: [PATCH 005/433] *)update to JSONP injection

---
 .../Security/CWE/CWE-352/JsonpInjection.java  | 170 +++++++++++++++++
 .../Security/CWE/CWE-352/JsonpInjection.qhelp |  35 ++++
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  55 ++++++
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  92 ++++++++++
 .../security/CWE-352/JsonpInjection.expected  |  60 ++++++
 .../security/CWE-352/JsonpInjection.java      | 171 ++++++++++++++++++
 .../security/CWE-352/JsonpInjection.qlref     |   1 +
 7 files changed, 584 insertions(+)
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjection.java
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref

diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.java
new file mode 100644
index 000000000000..8b4e7cc005ef
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.java
@@ -0,0 +1,170 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import java.util.Random;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class JsonpInjection {
+private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp7")
+    @ResponseBody
+    public String good(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String val = "";
+        Random random = new Random();
+        for (int i = 0; i < 10; i++) {
+            val += String.valueOf(random.nextInt(10));
+        }
+        // good
+        jsonpCallback = jsonpCallback + "_" + val;
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp8")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String token = request.getParameter("token");
+
+        // good
+        if (verifToken(token)){
+            System.out.println(token);
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+
+        return "error";
+    }
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String referer = request.getHeader("Referer");
+
+        boolean result = verifReferer(referer);
+        // good
+        if (result){
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+
+        return "error";
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+
+    public static boolean verifToken(String token){
+        if (token != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+
+    public static boolean verifReferer(String referer){
+        if (!referer.startsWith("http://test.com/")){
+            return false;
+        }
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp
new file mode 100644
index 000000000000..b063b409d3a5
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -0,0 +1,35 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The software uses external input as the function name to wrap JSON data and return it to the client as a request response. When there is a cross-domain problem, 
+there is a problem of sensitive information leakage.</p>
+
+</overview>
+<recommendation>
+
+<p>Adding `Referer` or random `token` verification processing can effectively prevent the leakage of sensitive information.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows the case of no verification processing and verification processing for the external input function name.</p>
+
+<sample src="JsonHijacking.java" />
+
+</example>
+<references>
+
+<li>
+OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes: 
+<a href="https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf">JSON hijacking</a>.
+</li>
+<li>
+Practical JSONP Injection:
+<a href="https://securitycafe.ro/2017/01/18/practical-jsonp-injection">
+  Completely controllable from the URL (GET variable)
+</a>.
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
new file mode 100644
index 000000000000..e7ca2d41e343
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
@@ -0,0 +1,55 @@
+/**
+ * @name JSON Hijacking
+ * @description User-controlled callback function names that are not verified are vulnerable
+ *              to json hijacking attacks.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/Json-hijacking
+ * @tags security
+ *       external/cwe/cwe-352
+ */
+
+import java
+import JsonpInjectionLib
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.deadcode.WebEntryPoints
+import DataFlow::PathGraph
+
+class VerifAuth extends DataFlow::BarrierGuard {
+  VerifAuth() {
+    exists(MethodAccess ma, Node prod, Node succ |
+      this = ma and
+      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer).*") and
+      prod instanceof RemoteFlowSource and
+      succ.asExpr() = ma.getAnArgument() and
+      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer).*") and
+      localFlowStep*(prod, succ)
+    )
+  }
+
+  override predicate checks(Expr e, boolean branch) {
+    exists(ReturnStmt rs |
+      e = rs.getResult() and
+      branch = true
+    )
+  }
+}
+
+/** Taint-tracking configuration tracing flow from remote sources to output jsonp data. */
+class JsonpInjectionConfig extends TaintTracking::Configuration {
+  JsonpInjectionConfig() { this = "JsonpInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonpInjectionSink }
+
+  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { guard instanceof VerifAuth }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, JsonpInjectionConfig conf
+where
+  conf.hasFlowPath(source, sink) and
+  exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
+select sink.getNode(), source, sink, "Json Hijacking query might include code from $@.",
+  source.getNode(), "this user input"
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
new file mode 100644
index 000000000000..4294a5e8c8f2
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -0,0 +1,92 @@
+import java
+import DataFlow
+import JsonStringLib
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.spring.SpringController
+
+/** A data flow sink for unvalidated user input that is used to jsonp. */
+abstract class JsonpInjectionSink extends DataFlow::Node { }
+
+/** Use ```print```, ```println```, ```write``` to output result. */
+private class WriterPrintln extends JsonpInjectionSink {
+  WriterPrintln() {
+    exists(MethodAccess ma |
+      ma.getMethod().getName().regexpMatch("print|println|write") and
+      ma.getMethod()
+          .getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("java.io", "PrintWriter") and
+      ma.getArgument(0) = this.asExpr()
+    )
+  }
+}
+
+/** Spring Request Method return result. */
+private class SpringReturn extends JsonpInjectionSink {
+  SpringReturn() {
+    exists(ReturnStmt rs, Method m | m = rs.getEnclosingCallable() |
+      m instanceof SpringRequestMappingMethod and
+      rs.getResult() = this.asExpr()
+    )
+  }
+}
+
+/** A concatenate expression using `(` and `)` or `);`. */
+class JsonpInjectionExpr extends AddExpr {
+  JsonpInjectionExpr() {
+    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
+    getLeftOperand()
+        .(AddExpr)
+        .getLeftOperand()
+        .(AddExpr)
+        .getRightOperand()
+        .toString()
+        .regexpMatch("\"\\(\"")
+  }
+
+  /** Get the jsonp function name of this expression */
+  Expr getFunctionName() {
+    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
+  }
+
+  /** Get the json data of this expression */
+  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
+}
+
+/** A data flow configuration tracing flow from remote sources to jsonp function name. */
+class RemoteFlowConfig extends DataFlow2::Configuration {
+  RemoteFlowConfig() { this = "RemoteFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpInjectionExpr jhe | jhe.getFunctionName() = sink.asExpr())
+  }
+}
+
+/** A data flow configuration tracing flow from json data to splicing jsonp data. */
+class JsonDataFlowConfig extends DataFlow2::Configuration {
+  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpInjectionExpr jhe | jhe.getJsonExpr() = sink.asExpr())
+  }
+}
+
+/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+class JsonpInjectionFlowConfig extends DataFlow::Configuration {
+  JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(JsonpInjectionExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
+      jhe = src.asExpr() and
+      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
+      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonpInjectionSink }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
new file mode 100644
index 000000000000..019af8f5c055
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
@@ -0,0 +1,60 @@
+edges
+| JsonpInjection.java:28:32:28:68 | getParameter(...) : String | JsonpInjection.java:33:16:33:24 | resultStr |
+| JsonpInjection.java:32:21:32:54 | ... + ... : String | JsonpInjection.java:33:16:33:24 | resultStr |
+| JsonpInjection.java:40:32:40:68 | getParameter(...) : String | JsonpInjection.java:44:16:44:24 | resultStr |
+| JsonpInjection.java:42:21:42:80 | ... + ... : String | JsonpInjection.java:44:16:44:24 | resultStr |
+| JsonpInjection.java:51:32:51:68 | getParameter(...) : String | JsonpInjection.java:54:16:54:24 | resultStr |
+| JsonpInjection.java:53:21:53:55 | ... + ... : String | JsonpInjection.java:54:16:54:24 | resultStr |
+| JsonpInjection.java:61:32:61:68 | getParameter(...) : String | JsonpInjection.java:64:16:64:24 | resultStr |
+| JsonpInjection.java:63:21:63:54 | ... + ... : String | JsonpInjection.java:64:16:64:24 | resultStr |
+| JsonpInjection.java:72:32:72:68 | getParameter(...) : String | JsonpInjection.java:80:20:80:28 | resultStr |
+| JsonpInjection.java:79:21:79:54 | ... + ... : String | JsonpInjection.java:80:20:80:28 | resultStr |
+| JsonpInjection.java:88:32:88:68 | getParameter(...) : String | JsonpInjection.java:95:20:95:28 | resultStr |
+| JsonpInjection.java:94:21:94:54 | ... + ... : String | JsonpInjection.java:95:20:95:28 | resultStr |
+| JsonpInjection.java:102:32:102:68 | getParameter(...) : String | JsonpInjection.java:113:16:113:24 | resultStr |
+| JsonpInjection.java:128:25:128:59 | ... + ... : String | JsonpInjection.java:129:20:129:28 | resultStr |
+| JsonpInjection.java:147:25:147:59 | ... + ... : String | JsonpInjection.java:148:20:148:28 | resultStr |
+nodes
+| JsonpInjection.java:28:32:28:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:32:21:32:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:33:16:33:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:33:16:33:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:40:32:40:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:42:21:42:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:44:16:44:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:44:16:44:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:51:32:51:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:53:21:53:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:54:16:54:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:54:16:54:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:61:32:61:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:63:21:63:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:64:16:64:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:64:16:64:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:72:32:72:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:88:32:88:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:94:21:94:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:95:20:95:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:95:20:95:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:102:32:102:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:113:16:113:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:128:25:128:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:129:20:129:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:147:25:147:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:148:20:148:28 | resultStr | semmle.label | resultStr |
+#select
+| JsonpInjection.java:33:16:33:24 | resultStr | JsonpInjection.java:28:32:28:68 | getParameter(...) : String | JsonpInjection.java:33:16:33:24 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:28:32:28:68 | getParameter(...) | this user input |
+| JsonpInjection.java:44:16:44:24 | resultStr | JsonpInjection.java:40:32:40:68 | getParameter(...) : String | JsonpInjection.java:44:16:44:24 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:40:32:40:68 | getParameter(...) | this user input |
+| JsonpInjection.java:54:16:54:24 | resultStr | JsonpInjection.java:51:32:51:68 | getParameter(...) : String | JsonpInjection.java:54:16:54:24 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:51:32:51:68 | getParameter(...) | this user input |
+| JsonpInjection.java:64:16:64:24 | resultStr | JsonpInjection.java:61:32:61:68 | getParameter(...) : String | JsonpInjection.java:64:16:64:24 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:61:32:61:68 | getParameter(...) | this user input |
+| JsonpInjection.java:80:20:80:28 | resultStr | JsonpInjection.java:72:32:72:68 | getParameter(...) : String | JsonpInjection.java:80:20:80:28 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:72:32:72:68 | getParameter(...) | this user input |
+| JsonpInjection.java:95:20:95:28 | resultStr | JsonpInjection.java:88:32:88:68 | getParameter(...) : String | JsonpInjection.java:95:20:95:28 | resultStr | Json Hijacking query 
+might include code from $@. | JsonpInjection.java:88:32:88:68 | getParameter(...) | this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
new file mode 100644
index 000000000000..df3aa2c02fe9
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
@@ -0,0 +1,171 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import java.util.Random;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class JsonpInjection {
+    
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        response.setContentType("application/json");
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp7")
+    @ResponseBody
+    public String good(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String val = "";
+        Random random = new Random();
+        for (int i = 0; i < 10; i++) {
+            val += String.valueOf(random.nextInt(10));
+        }
+        // good
+        jsonpCallback = jsonpCallback + "_" + val;
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp8")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String token = request.getParameter("token");
+
+        // good
+        if (verifToken(token)){
+            System.out.println(token);
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+
+        return "error";
+    }
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        String referer = request.getHeader("Referer");
+
+        boolean result = verifReferer(referer);
+        // good
+        if (result){
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+
+        return "error";
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+
+    public static boolean verifToken(String token){
+        if (token != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+
+    public static boolean verifReferer(String referer){
+        if (!referer.startsWith("http://test.com/")){
+            return false;
+        }
+        return true;
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
new file mode 100644
index 000000000000..6ad4b8acda76
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-352/JsonpInjection.ql

From 6fe8bafc7d35f77d5db38d0802b192b6abb45dd1 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 24 Feb 2021 20:59:51 +0800
Subject: [PATCH 006/433] *)update

---
 .../Security/CWE/CWE-352/JsonHijacking.java   | 119 ------------------
 .../Security/CWE/CWE-352/JsonHijacking.qhelp  |  35 ------
 .../src/Security/CWE/CWE-352/JsonHijacking.ql |  32 -----
 .../Security/CWE/CWE-352/JsonHijackingLib.qll |  92 --------------
 .../security/CWE-352/JsonHijacking.expected   |  48 -------
 .../security/CWE-352/JsonHijacking.java       | 119 ------------------
 .../security/CWE-352/JsonHijacking.qlref      |   1 -
 7 files changed, 446 deletions(-)
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref

diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
deleted file mode 100644
index d08d436fa07b..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.java
+++ /dev/null
@@ -1,119 +0,0 @@
-import com.alibaba.fastjson.JSONObject;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.google.gson.Gson;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import java.util.Random;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-@Controller
-public class JsonHijacking {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-
-    @GetMapping(value = "jsonp1")
-    @ResponseBody
-    public String bad1(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp2")
-    @ResponseBody
-    public String bad2(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp3")
-    @ResponseBody
-    public String bad3(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp4")
-    @ResponseBody
-    public String bad4(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp5")
-    @ResponseBody
-    public void bad5(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp6")
-    @ResponseBody
-    public void bad6(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        ObjectMapper mapper = new ObjectMapper();
-        String result = mapper.writeValueAsString(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp7")
-    @ResponseBody
-    public String good(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        String val = "";
-        Random random = new Random();
-        for (int i = 0; i < 10; i++) {
-            val += String.valueOf(random.nextInt(10));
-        }
-        // good
-        jsonpCallback = jsonpCallback + "_" + val;
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    public static String getJsonStr(Object result) {
-        return JSONObject.toJSONString(result);
-    }
-}
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
deleted file mode 100644
index 38e1845f9929..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.qhelp
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>The software uses external input as the function name to wrap JSON data and return it to the client as a request response. When there is a cross-domain problem, 
-there is a problem of sensitive information leakage.</p>
-
-</overview>
-<recommendation>
-
-<p>The function name verification processing for external input can effectively prevent the leakage of sensitive information.</p>
-
-</recommendation>
-<example>
-
-<p>The following example shows the case of no verification processing and verification processing for the external input function name.</p>
-
-<sample src="JsonHijacking.java" />
-
-</example>
-<references>
-
-<li>
-OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes: 
-<a href="https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf">JSON hijacking</a>.
-</li>
-<li>
-Practical JSONP Injection:
-<a href="https://securitycafe.ro/2017/01/18/practical-jsonp-injection">
-  Completely controllable from the URL (GET variable)
-</a>.
-</li>
-</references>
-</qhelp>
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql b/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
deleted file mode 100644
index a6a6d2475f09..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonHijacking.ql
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * @name JSON Hijacking
- * @description User-controlled callback function names that are not verified are vulnerable
- *              to json hijacking attacks.
- * @kind path-problem
- * @problem.severity error
- * @precision high
- * @id java/Json-hijacking
- * @tags security
- *       external/cwe/cwe-352
- */
-
-import java
-import JsonHijackingLib
-import semmle.code.java.dataflow.FlowSources
-import DataFlow::PathGraph
-
-/** Taint-tracking configuration tracing flow from remote sources to output jsonp data. */
-class JsonHijackingConfig extends TaintTracking::Configuration {
-  JsonHijackingConfig() { this = "JsonHijackingConfig" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonHijackingSink }
-}
-
-from DataFlow::PathNode source, DataFlow::PathNode sink, JsonHijackingConfig conf
-where
-  conf.hasFlowPath(source, sink) and
-  exists(JsonHijackingFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
-select sink.getNode(), source, sink, "Json Hijacking query might include code from $@.",
-  source.getNode(), "this user input"
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
deleted file mode 100644
index ba91a6670bfd..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonHijackingLib.qll
+++ /dev/null
@@ -1,92 +0,0 @@
-import java
-import DataFlow
-import JsonStringLib
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.frameworks.spring.SpringController
-
-/** A data flow sink for unvalidated user input that is used to jsonp. */
-abstract class JsonHijackingSink extends DataFlow::Node { }
-
-/** Use ```print```, ```println```, ```write``` to output result. */
-private class WriterPrintln extends JsonHijackingSink {
-  WriterPrintln() {
-    exists(MethodAccess ma |
-      ma.getMethod().getName().regexpMatch("print|println|write") and
-      ma.getMethod()
-          .getDeclaringType()
-          .getASourceSupertype*()
-          .hasQualifiedName("java.io", "PrintWriter") and
-      ma.getArgument(0) = this.asExpr()
-    )
-  }
-}
-
-/** Spring Request Method return result. */
-private class SpringReturn extends JsonHijackingSink {
-  SpringReturn() {
-    exists(ReturnStmt rs, Method m | m = rs.getEnclosingCallable() |
-      m instanceof SpringRequestMappingMethod and
-      rs.getResult() = this.asExpr()
-    )
-  }
-}
-
-/** A concatenate expression using `(` and `)` or `);`. */
-class JsonHijackingExpr extends AddExpr {
-  JsonHijackingExpr() {
-    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
-    getLeftOperand()
-        .(AddExpr)
-        .getLeftOperand()
-        .(AddExpr)
-        .getRightOperand()
-        .toString()
-        .regexpMatch("\"\\(\"")
-  }
-
-  /** Get the jsonp function name of this expression */
-  Expr getFunctionName() {
-    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
-  }
-
-  /** Get the json data of this expression */
-  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
-}
-
-/** A data flow configuration tracing flow from remote sources to jsonp function name. */
-class RemoteFlowConfig extends DataFlow2::Configuration {
-  RemoteFlowConfig() { this = "RemoteFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(JsonHijackingExpr jhe | jhe.getFunctionName() = sink.asExpr())
-  }
-}
-
-/** A data flow configuration tracing flow from json data to splicing jsonp data. */
-class JsonDataFlowConfig extends DataFlow2::Configuration {
-  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(JsonHijackingExpr jhe | jhe.getJsonExpr() = sink.asExpr())
-  }
-}
-
-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
-class JsonHijackingFlowConfig extends TaintTracking::Configuration {
-  JsonHijackingFlowConfig() { this = "JsonHijackingFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) {
-    exists(JsonHijackingExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
-      jhe = src.asExpr() and
-      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
-      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonHijackingSink }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
deleted file mode 100644
index 8efc3be1673b..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected
+++ /dev/null
@@ -1,48 +0,0 @@
-edges
-| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr |
-| JsonHijacking.java:32:21:32:54 | ... + ... : String | JsonHijacking.java:33:16:33:24 | resultStr |
-| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr |
-| JsonHijacking.java:42:21:42:80 | ... + ... : String | JsonHijacking.java:44:16:44:24 | resultStr |
-| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr |
-| JsonHijacking.java:53:21:53:55 | ... + ... : String | JsonHijacking.java:54:16:54:24 | resultStr |
-| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr |
-| JsonHijacking.java:63:21:63:54 | ... + ... : String | JsonHijacking.java:64:16:64:24 | resultStr |
-| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr |
-| JsonHijacking.java:79:21:79:54 | ... + ... : String | JsonHijacking.java:80:20:80:28 | resultStr |
-| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr |
-| JsonHijacking.java:94:21:94:54 | ... + ... : String | JsonHijacking.java:95:20:95:28 | resultStr |
-| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | JsonHijacking.java:113:16:113:24 | resultStr |
-nodes
-| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:32:21:32:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:42:21:42:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:53:21:53:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:63:21:63:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:94:21:94:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
-| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonHijacking.java:113:16:113:24 | resultStr | semmle.label | resultStr |
-#select
-| JsonHijacking.java:33:16:33:24 | resultStr | JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:28:32:28:68 | getParameter(...) | this user input |
-| JsonHijacking.java:44:16:44:24 | resultStr | JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:40:32:40:68 | getParameter(...) | this user input |
-| JsonHijacking.java:54:16:54:24 | resultStr | JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:51:32:51:68 | getParameter(...) | this user input |
-| JsonHijacking.java:64:16:64:24 | resultStr | JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:61:32:61:68 | getParameter(...) | this user input |
-| JsonHijacking.java:80:20:80:28 | resultStr | JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:72:32:72:68 | getParameter(...) | this user input |
-| JsonHijacking.java:95:20:95:28 | resultStr | JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:88:32:88:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
deleted file mode 100644
index 9b473e0610ca..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java
+++ /dev/null
@@ -1,119 +0,0 @@
-import com.alibaba.fastjson.JSONObject;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.google.gson.Gson;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import java.util.Random;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-@Controller
-public class JsonHijacking {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-
-    @GetMapping(value = "jsonp1")
-    @ResponseBody
-    public String bad1(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp2")
-    @ResponseBody
-    public String bad2(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp3")
-    @ResponseBody
-    public String bad3(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp4")
-    @ResponseBody
-    public String bad4(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp5")
-    @ResponseBody
-    public void bad5(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp6")
-    @ResponseBody
-    public void bad6(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        ObjectMapper mapper = new ObjectMapper();
-        String result = mapper.writeValueAsString(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp7")
-    @ResponseBody
-    public String good(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        String val = "";
-        Random random = new Random();
-        for (int i = 0; i < 10; i++) {
-            val += String.valueOf(random.nextInt(10));
-        }
-        // good
-        jsonpCallback = jsonpCallback + "_" + val;
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    public static String getJsonStr(Object result) {
-        return JSONObject.toJSONString(result);
-    }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref
deleted file mode 100644
index e79471b3c1ed..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security/CWE/CWE-352/JsonHijacking.ql

From f795d5e0d3b4f1a7fc5446755020786c3faecae1 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Sat, 27 Feb 2021 16:25:17 +0800
Subject: [PATCH 007/433] update JSONP Injection ql

---
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  45 +++++---
 .../CWE/CWE-352/JsonpInjectionFilterLib.qll   |  77 +++++++++++++
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  65 ++++++++++-
 .../CWE/CWE-352/JsonpInjectionServlet.java    |  60 ++++++++++
 .../CWE/CWE-352/JsonpInjectionServlet1.java   |  64 +++++++++++
 .../CWE/CWE-352/JsonpInjectionServlet2.java   |  50 +++++++++
 .../semmle/code/java/frameworks/Servlets.qll  |  27 +++++
 .../security/CWE-352/JsonpInjection.expected  | 106 +++++++++---------
 .../security/CWE-352/JsonpInjection.java      |  13 ++-
 .../core/annotation/AliasFor.class            | Bin 385 -> 0 bytes
 .../web/bind/annotation/GetMapping.class      | Bin 504 -> 0 bytes
 .../web/bind/annotation/RequestMapping.java   |   2 +
 .../web/bind/annotation/RequestMethod.java    |  15 +++
 .../web/bind/annotation/ResponseBody.class    | Bin 184 -> 0 bytes
 14 files changed, 448 insertions(+), 76 deletions(-)
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java
 create mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class

diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
index e7ca2d41e343..53ee6182511b 100644
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
@@ -1,55 +1,68 @@
 /**
- * @name JSON Hijacking
+ * @name JSONP Injection
  * @description User-controlled callback function names that are not verified are vulnerable
- *              to json hijacking attacks.
+ *              to jsonp injection attacks.
  * @kind path-problem
  * @problem.severity error
  * @precision high
- * @id java/Json-hijacking
+ * @id java/JSONP-Injection
  * @tags security
  *       external/cwe/cwe-352
  */
 
 import java
 import JsonpInjectionLib
+import JsonpInjectionFilterLib
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.deadcode.WebEntryPoints
 import DataFlow::PathGraph
 
-class VerifAuth extends DataFlow::BarrierGuard {
-  VerifAuth() {
+
+/** If there is a method to verify `token`, `auth`, `referer`, and `origin`, it will not pass. */
+class ServletVerifAuth extends DataFlow::BarrierGuard {
+  ServletVerifAuth() {
     exists(MethodAccess ma, Node prod, Node succ |
-      this = ma and
-      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer).*") and
+      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
       prod instanceof RemoteFlowSource and
       succ.asExpr() = ma.getAnArgument() and
-      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer).*") and
-      localFlowStep*(prod, succ)
+      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
+      localFlowStep*(prod, succ) and
+      this = ma
     )
   }
 
   override predicate checks(Expr e, boolean branch) {
-    exists(ReturnStmt rs |
-      e = rs.getResult() and
+    exists(Node node |
+      node instanceof JsonpInjectionSink and
+      e = node.asExpr() and
       branch = true
     )
   }
 }
 
-/** Taint-tracking configuration tracing flow from remote sources to output jsonp data. */
+/** Taint-tracking configuration tracing flow from get method request sources to output jsonp data. */
 class JsonpInjectionConfig extends TaintTracking::Configuration {
   JsonpInjectionConfig() { this = "JsonpInjectionConfig" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  override predicate isSource(DataFlow::Node source) { source instanceof GetHttpRequestSource }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof JsonpInjectionSink }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { guard instanceof VerifAuth }
+  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+    guard instanceof ServletVerifAuth
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(MethodAccess ma |
+      isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
+    )
+  }
 }
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, JsonpInjectionConfig conf
 where
+  not checks() = false and
   conf.hasFlowPath(source, sink) and
   exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
-select sink.getNode(), source, sink, "Json Hijacking query might include code from $@.",
-  source.getNode(), "this user input"
\ No newline at end of file
+select sink.getNode(), source, sink, "Jsonp Injection query might include code from $@.",
+  source.getNode(), "this user input"
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
new file mode 100644
index 000000000000..b349bed26414
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
@@ -0,0 +1,77 @@
+/**
+ * @name JSONP Injection
+ * @description User-controlled callback function names that are not verified are vulnerable
+ *              to json hijacking attacks.
+ * @kind path-problem
+ */
+
+import java
+import DataFlow
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking2
+import DataFlow::PathGraph
+
+class FilterVerifAuth extends DataFlow::BarrierGuard {
+  FilterVerifAuth() {
+    exists(MethodAccess ma, Node prod, Node succ |
+      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
+      prod instanceof RemoteFlowSource and
+      succ.asExpr() = ma.getAnArgument() and
+      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
+      localFlowStep*(prod, succ) and
+      this = ma
+    )
+  }
+
+  override predicate checks(Expr e, boolean branch) {
+    exists(Node node |
+      node instanceof DoFilterMethodSink and
+      e = node.asExpr() and
+      branch = true
+    )
+  }
+}
+
+/** A data flow source for `Filter.doFilter` method paramters. */
+private class DoFilterMethodSource extends DataFlow::Node {
+  DoFilterMethodSource() {
+    exists(Method m |
+      isDoFilterMethod(m) and
+      m.getAParameter().getAnAccess() = this.asExpr()
+    )
+  }
+}
+
+/** A data flow sink for `FilterChain.doFilter` method qualifying expression. */
+private class DoFilterMethodSink extends DataFlow::Node {
+  DoFilterMethodSink() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("doFilter") and
+      m.getDeclaringType*().hasQualifiedName("javax.servlet", "FilterChain") and
+      ma.getQualifier() = this.asExpr()
+    )
+  }
+}
+
+/** Taint-tracking configuration tracing flow from `doFilter` method paramter source to output 
+ * `FilterChain.doFilter` method qualifying expression. 
+ * */
+class DoFilterMethodConfig extends TaintTracking::Configuration {
+  DoFilterMethodConfig() { this = "DoFilterMethodConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof DoFilterMethodSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof DoFilterMethodSink }
+
+  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+    guard instanceof FilterVerifAuth
+  }
+}
+
+/** Implement class modeling verification for `Filter.doFilter`, return false if it fails. */
+boolean checks() {
+  exists(DataFlow::PathNode source, DataFlow::PathNode sink, DoFilterMethodConfig conf |
+    conf.hasFlowPath(source, sink) and
+    result = false
+  )
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 4294a5e8c8f2..3f7304258232 100644
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -5,6 +5,69 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private predicate isGetServletMethod(Method m) {
+  isServletRequestMethod(m) and m.getName() = "doGet"
+}
+
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private predicate isGetSpringControllerMethod(Method m) {
+  exists(Annotation a |
+    a = m.getAnAnnotation() and
+    a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
+  )
+  or
+  exists(Annotation a |
+    a = m.getAnAnnotation() and
+    a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
+    a.getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}")
+  )
+}
+
+/** Method parameters use the annotation `@RequestParam` or the parameter type is `ServletRequest`, `String`, `Object` */
+predicate checkSpringMethodParameterType(Method m, int i) {
+  m.getParameter(i).getType() instanceof ServletRequest
+  or
+  exists(Parameter p |
+    p = m.getParameter(i) and
+    p.hasAnnotation() and
+    p.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation", "RequestParam") and
+    p.getType().getName().regexpMatch("String|Object")
+  )
+  or
+  exists(Parameter p |
+    p = m.getParameter(i) and
+    not p.hasAnnotation() and
+    p.getType().getName().regexpMatch("String|Object")
+  )
+}
+
+/** A data flow source for get method request parameters. */
+abstract class GetHttpRequestSource extends DataFlow::Node { }
+
+/** A data flow source for servlet get method request parameters. */
+private class ServletGetHttpRequestSource extends GetHttpRequestSource {
+  ServletGetHttpRequestSource() {
+    exists(Method m |
+      isGetServletMethod(m) and
+      m.getParameter(0).getAnAccess() = this.asExpr()
+    )
+  }
+}
+
+/** A data flow source for spring controller get method request parameters. */
+private class SpringGetHttpRequestSource extends GetHttpRequestSource {
+  SpringGetHttpRequestSource() {
+    exists(SpringControllerMethod scm, int i |
+      isGetSpringControllerMethod(scm) and
+      checkSpringMethodParameterType(scm, i) and
+      scm.getParameter(i).getAnAccess() = this.asExpr()
+    )
+  }
+}
+
 /** A data flow sink for unvalidated user input that is used to jsonp. */
 abstract class JsonpInjectionSink extends DataFlow::Node { }
 
@@ -26,7 +89,7 @@ private class WriterPrintln extends JsonpInjectionSink {
 private class SpringReturn extends JsonpInjectionSink {
   SpringReturn() {
     exists(ReturnStmt rs, Method m | m = rs.getEnclosingCallable() |
-      m instanceof SpringRequestMappingMethod and
+      isGetSpringControllerMethod(m) and
       rs.getResult() = this.asExpr()
     )
   }
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java
new file mode 100644
index 000000000000..916cd9bf676e
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java
@@ -0,0 +1,60 @@
+import com.google.gson.Gson;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class JsonpInjectionServlet  extends HttpServlet {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    private static final long serialVersionUID = 1L;
+
+    private String key = "test";
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String jsonpCallback = req.getParameter("jsonpCallback");
+
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = resp.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+        pw.flush();
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String jsonpCallback = req.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = resp.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+        pw.flush();
+    }
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+        this.key = config.getInitParameter("key");
+        System.out.println("初始化" + this.key);
+        super.init(config);
+    }
+
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java
new file mode 100644
index 000000000000..14ef76275b1d
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java
@@ -0,0 +1,64 @@
+import com.google.gson.Gson;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class JsonpInjectionServlet1 extends HttpServlet {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    private static final long serialVersionUID = 1L;
+
+    private String key = "test";
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        doPost(req, resp);
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        resp.setContentType("application/json");
+        String jsonpCallback = req.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String jsonResult = gson.toJson(hashMap);
+
+        String referer = req.getHeader("Referer");
+
+        boolean result = verifReferer(referer);
+
+        // good
+        if (result){
+            String resultStr = null;
+            pw = resp.getWriter();
+            resultStr = jsonpCallback + "(" + jsonResult + ")";
+            pw.println(resultStr);
+            pw.flush();
+        }
+    }
+
+    public static boolean verifReferer(String referer){
+        if (!referer.startsWith("http://test.com/")){
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+        this.key = config.getInitParameter("key");
+        System.out.println("初始化" + this.key);
+        super.init(config);
+    }
+
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java
new file mode 100644
index 000000000000..bbfbc2dc4360
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java
@@ -0,0 +1,50 @@
+import com.google.gson.Gson;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class JsonpInjectionServlet2  extends HttpServlet {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    private static final long serialVersionUID = 1L;
+
+    private String key = "test";
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        doPost(req, resp);
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        resp.setContentType("application/json");
+        String jsonpCallback = req.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = resp.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+        pw.flush();
+    }
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+        this.key = config.getInitParameter("key");
+        System.out.println("初始化" + this.key);
+        super.init(config);
+    }
+
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index 3fad8c4e18b3..b2054dc30cb7 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -337,3 +337,30 @@ predicate isRequestGetParamMethod(MethodAccess ma) {
   ma.getMethod() instanceof ServletRequestGetParameterMapMethod or
   ma.getMethod() instanceof HttpServletRequestGetQueryStringMethod
 }
+
+
+/**
+ * A class that has `javax.servlet.Filter` as an ancestor.
+ */
+class FilterClass extends Class {
+  FilterClass() { getAnAncestor().hasQualifiedName("javax.servlet", "Filter") }
+}
+
+
+/**
+ * The interface `javax.servlet.FilterChain`
+ */
+class FilterChain extends RefType {
+  FilterChain() {
+    hasQualifiedName("javax.servlet", "FilterChain")
+  }
+}
+
+/** Holds if `m` is a request handler method (for example `doGet` or `doPost`). */
+predicate isDoFilterMethod(Method m) {
+  m.getDeclaringType() instanceof FilterClass and
+  m.getNumberOfParameters() = 3 and
+  m.getParameter(0).getType() instanceof ServletRequest and
+  m.getParameter(1).getType() instanceof ServletResponse and
+  m.getParameter(2).getType() instanceof FilterChain
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
index 019af8f5c055..7e3069cf1d93 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
@@ -1,60 +1,60 @@
 edges
-| JsonpInjection.java:28:32:28:68 | getParameter(...) : String | JsonpInjection.java:33:16:33:24 | resultStr |
-| JsonpInjection.java:32:21:32:54 | ... + ... : String | JsonpInjection.java:33:16:33:24 | resultStr |
-| JsonpInjection.java:40:32:40:68 | getParameter(...) : String | JsonpInjection.java:44:16:44:24 | resultStr |
-| JsonpInjection.java:42:21:42:80 | ... + ... : String | JsonpInjection.java:44:16:44:24 | resultStr |
-| JsonpInjection.java:51:32:51:68 | getParameter(...) : String | JsonpInjection.java:54:16:54:24 | resultStr |
-| JsonpInjection.java:53:21:53:55 | ... + ... : String | JsonpInjection.java:54:16:54:24 | resultStr |
-| JsonpInjection.java:61:32:61:68 | getParameter(...) : String | JsonpInjection.java:64:16:64:24 | resultStr |
-| JsonpInjection.java:63:21:63:54 | ... + ... : String | JsonpInjection.java:64:16:64:24 | resultStr |
-| JsonpInjection.java:72:32:72:68 | getParameter(...) : String | JsonpInjection.java:80:20:80:28 | resultStr |
+| JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | JsonpInjection.java:34:16:34:24 | resultStr |
+| JsonpInjection.java:33:21:33:54 | ... + ... : String | JsonpInjection.java:34:16:34:24 | resultStr |
+| JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | JsonpInjection.java:45:16:45:24 | resultStr |
+| JsonpInjection.java:43:21:43:80 | ... + ... : String | JsonpInjection.java:45:16:45:24 | resultStr |
+| JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | JsonpInjection.java:55:16:55:24 | resultStr |
+| JsonpInjection.java:54:21:54:55 | ... + ... : String | JsonpInjection.java:55:16:55:24 | resultStr |
+| JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | JsonpInjection.java:65:16:65:24 | resultStr |
+| JsonpInjection.java:64:21:64:54 | ... + ... : String | JsonpInjection.java:65:16:65:24 | resultStr |
+| JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | JsonpInjection.java:80:20:80:28 | resultStr |
 | JsonpInjection.java:79:21:79:54 | ... + ... : String | JsonpInjection.java:80:20:80:28 | resultStr |
-| JsonpInjection.java:88:32:88:68 | getParameter(...) : String | JsonpInjection.java:95:20:95:28 | resultStr |
-| JsonpInjection.java:94:21:94:54 | ... + ... : String | JsonpInjection.java:95:20:95:28 | resultStr |
-| JsonpInjection.java:102:32:102:68 | getParameter(...) : String | JsonpInjection.java:113:16:113:24 | resultStr |
-| JsonpInjection.java:128:25:128:59 | ... + ... : String | JsonpInjection.java:129:20:129:28 | resultStr |
-| JsonpInjection.java:147:25:147:59 | ... + ... : String | JsonpInjection.java:148:20:148:28 | resultStr |
+| JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | JsonpInjection.java:94:20:94:28 | resultStr |
+| JsonpInjection.java:93:21:93:54 | ... + ... : String | JsonpInjection.java:94:20:94:28 | resultStr |
+| JsonpInjection.java:101:32:101:38 | request : HttpServletRequest | JsonpInjection.java:112:16:112:24 | resultStr |
+| JsonpInjection.java:127:25:127:59 | ... + ... : String | JsonpInjection.java:128:20:128:28 | resultStr |
+| JsonpInjection.java:148:25:148:59 | ... + ... : String | JsonpInjection.java:149:20:149:28 | resultStr |
 nodes
-| JsonpInjection.java:28:32:28:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:32:21:32:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:33:16:33:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:33:16:33:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:40:32:40:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:42:21:42:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:44:16:44:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:44:16:44:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:51:32:51:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:53:21:53:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:54:16:54:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:54:16:54:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:61:32:61:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:63:21:63:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:64:16:64:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:64:16:64:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:72:32:72:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:33:21:33:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:34:16:34:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:34:16:34:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:43:21:43:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:45:16:45:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:45:16:45:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:54:21:54:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:55:16:55:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:55:16:55:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:64:21:64:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:65:16:65:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:65:16:65:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
 | JsonpInjection.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
 | JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:88:32:88:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:94:21:94:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:95:20:95:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:95:20:95:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:102:32:102:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjection.java:113:16:113:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:128:25:128:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:129:20:129:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:147:25:147:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:148:20:148:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:101:32:101:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
+| JsonpInjection.java:112:16:112:24 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:127:25:127:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:128:20:128:28 | resultStr | semmle.label | resultStr |
+| JsonpInjection.java:148:25:148:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjection.java:149:20:149:28 | resultStr | semmle.label | resultStr |
 #select
-| JsonpInjection.java:33:16:33:24 | resultStr | JsonpInjection.java:28:32:28:68 | getParameter(...) : String | JsonpInjection.java:33:16:33:24 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:28:32:28:68 | getParameter(...) | this user input |
-| JsonpInjection.java:44:16:44:24 | resultStr | JsonpInjection.java:40:32:40:68 | getParameter(...) : String | JsonpInjection.java:44:16:44:24 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:40:32:40:68 | getParameter(...) | this user input |
-| JsonpInjection.java:54:16:54:24 | resultStr | JsonpInjection.java:51:32:51:68 | getParameter(...) : String | JsonpInjection.java:54:16:54:24 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:51:32:51:68 | getParameter(...) | this user input |
-| JsonpInjection.java:64:16:64:24 | resultStr | JsonpInjection.java:61:32:61:68 | getParameter(...) : String | JsonpInjection.java:64:16:64:24 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:61:32:61:68 | getParameter(...) | this user input |
-| JsonpInjection.java:80:20:80:28 | resultStr | JsonpInjection.java:72:32:72:68 | getParameter(...) : String | JsonpInjection.java:80:20:80:28 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:72:32:72:68 | getParameter(...) | this user input |
-| JsonpInjection.java:95:20:95:28 | resultStr | JsonpInjection.java:88:32:88:68 | getParameter(...) : String | JsonpInjection.java:95:20:95:28 | resultStr | Json Hijacking query 
-might include code from $@. | JsonpInjection.java:88:32:88:68 | getParameter(...) | this user input |
\ No newline at end of file
+| JsonpInjection.java:34:16:34:24 | resultStr | JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | JsonpInjection.java:34:16:34:24 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:29:32:29:38 | request | this user input |
+| JsonpInjection.java:45:16:45:24 | resultStr | JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | JsonpInjection.java:45:16:45:24 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:41:32:41:38 | request | this user input |
+| JsonpInjection.java:55:16:55:24 | resultStr | JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | JsonpInjection.java:55:16:55:24 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:52:32:52:38 | request | this user input |
+| JsonpInjection.java:65:16:65:24 | resultStr | JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | JsonpInjection.java:65:16:65:24 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:62:32:62:38 | request | this user input |
+| JsonpInjection.java:80:20:80:28 | resultStr | JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | JsonpInjection.java:80:20:80:28 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:72:32:72:38 | request | this user input |
+| JsonpInjection.java:94:20:94:28 | resultStr | JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | JsonpInjection.java:94:20:94:28 | 
+resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:87:32:87:38 | request | this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
index df3aa2c02fe9..9f079513a8b9 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
@@ -8,11 +8,12 @@
 import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 @Controller
 public class JsonpInjection {
-    
     private static HashMap hashMap = new HashMap();
 
     static {
@@ -21,7 +22,7 @@ public class JsonpInjection {
     }
 
 
-    @GetMapping(value = "jsonp1")
+    @GetMapping(value = "jsonp1", produces="text/javascript")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
         String resultStr = null;
@@ -68,7 +69,6 @@ public String bad4(HttpServletRequest request) {
     @ResponseBody
     public void bad5(HttpServletRequest request,
             HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
         String jsonpCallback = request.getParameter("jsonpCallback");
         PrintWriter pw = null;
         Gson gson = new Gson();
@@ -84,7 +84,6 @@ public void bad5(HttpServletRequest request,
     @ResponseBody
     public void bad6(HttpServletRequest request,
             HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
         String jsonpCallback = request.getParameter("jsonpCallback");
         PrintWriter pw = null;
         ObjectMapper mapper = new ObjectMapper();
@@ -141,8 +140,10 @@ public String good2(HttpServletRequest request) {
         String referer = request.getHeader("Referer");
 
         boolean result = verifReferer(referer);
+
+        boolean test = result;
         // good
-        if (result){
+        if (test){
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
             return resultStr;
@@ -168,4 +169,4 @@ public static boolean verifReferer(String referer){
         }
         return true;
     }
-}
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class
deleted file mode 100644
index 438065489278b92503abc2ad8d75716c5e56ac08..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 385
zcmb7=!Ab)$5QhJ0x31k<t>DdrH&Kx0=)qG#3PM4!PcXZrOKO@(l3m};gAd?CiL-}x
zJqaEL=Fj~6^G&|KKRyB6W0qr@<21(^Vbrp1G~wdrcD3b}m1S3}bqdDS4}|lDb3So0
z-aYCKH#QMKxO{0`GCTd`S`$rab#IG=`O1e{#kVeF6L_cJeRx%s4_fgdPA#nAxb#7`
zj5*1|vPl9`tbG$Iy);(DbZ?q>Y=pc21QTZcMbG6{R|0?4KmBGoU|o}(H;@|2R}C^k
ghLPwaQNxHF$I?t>JeJBL3UL&FIx;a%x-6Xh0OC_*bpQYW

diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class
deleted file mode 100644
index 5392ca0ebc1593d6bfa2f7d765ee4ca169fb260f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 504
zcma)&y-ve06orr5G%4k$Ewlp@8)_FUu~3N#3Bgi?)JiO!oYW02i5(KVeK!UkfQLfd
z3?&dTFj%_xlg>TI=i~G39l#Za0geNl1Q;-QTBMR;Fd9$SVk3AWbj;^AS316C=-+5<
ztgy=HTe%W0u?%2nZA9WoH5`o>f62T|*k=Ym6S+tWhIV9h;Zj+SS#FjtD#y;;xIB_~
zDxp)|dubm;mXYs88HC|<=CoC*d{Tu96Imr8>11m1m={?Yb44C<Yw{Pql_3w6UUKoB
zn$P5`lf~{ded+SQ$|?{;uj=M8T+4`RIIGYPyDH^5qoNx0n$)@PQPXJA=F`?J5D;i%
gZwD3tfleLl*TF#@9R332cSQFa=%QD;()m8{1xN6E{{R30

diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
index 3415800b927d..ddb36bce4c00 100644
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
@@ -10,4 +10,6 @@
 
     @AliasFor("value")
     String[] path() default {};
+
+    RequestMethod[] method() default {};
 }
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
new file mode 100644
index 000000000000..78c90a6ef75b
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
@@ -0,0 +1,15 @@
+package org.springframework.web.bind.annotation;
+
+public enum RequestMethod {
+    GET,
+    HEAD,
+    POST,
+    PUT,
+    PATCH,
+    DELETE,
+    OPTIONS,
+    TRACE;
+
+    private RequestMethod() {
+    }
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class
deleted file mode 100644
index 5e08f3e6a0acd663e6130e304a4d1251a31188fb..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 184
zcmX^0Z`VEs1_pBmPId-1b_RBK1`b9BuHgLAqU2P!%$!t42Em}z;)49V;#8;nluEs<
z#Ii(229x}vbp7IjqRhPXw4%h^)bjkIZ2j`oB>kk!ycGS!yuAF9#FEVXJbh%nj0^%G
u-TFC+dFlH8Nm;4MC5#O62q7eGj&Kvy7#SEDn1GlW=t>44%>pEu7+3+XjWw+R


From 95d1994196dc52ad516b7c6df06e673be8906d9b Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Mon, 1 Mar 2021 22:06:52 +0000
Subject: [PATCH 008/433] Query to check sensitive cookies without the HttpOnly
 flag set

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  |  44 +++
 .../CWE-1004/SensitiveCookieNotHttpOnly.qhelp |  27 ++
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 194 ++++++++++
 .../SensitiveCookieNotHttpOnly.expected       |  13 +
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  |  57 +++
 .../CWE-1004/SensitiveCookieNotHttpOnly.qlref |   1 +
 .../query-tests/security/CWE-1004/options     |   1 +
 .../javax/ws/rs/core/Cookie.java              | 187 +++++++++
 .../javax/ws/rs/core/NewCookie.java           | 359 ++++++++++++++++++
 .../javax/servlet/http/Cookie.java            |  33 ++
 .../servlet/http/HttpServletResponse.java     |   6 +
 11 files changed, 922 insertions(+)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-1004/options
 create mode 100644 java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
 create mode 100644 java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java
new file mode 100644
index 000000000000..48d80707ff83
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -0,0 +1,44 @@
+class SensitiveCookieNotHttpOnly {
+    // GOOD - Create a sensitive cookie with the `HttpOnly` flag set.
+    public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        jwtCookie.setHttpOnly(true);
+        response.addCookie(jwtCookie);
+    }
+
+    // BAD - Create a sensitive cookie without the `HttpOnly` flag set.
+    public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        response.addCookie(jwtCookie);
+    }
+
+    // GOOD - Set a sensitive cookie header with the `HttpOnly` flag set.
+    public void addCookie3(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure");
+    }
+
+    // BAD - Set a sensitive cookie header without the `HttpOnly` flag set.
+    public void addCookie4(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";Secure");
+    }
+    
+    // GOOD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through string concatenation.
+    public void addCookie5(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true) + ";HttpOnly");
+    }
+
+    // BAD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie6(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true).toString());
+    }
+
+    // GOOD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through the constructor.
+    public void addCookie7(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true);
+        response.setHeader("Set-Cookie", accessKeyCookie.toString());
+    }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
new file mode 100644
index 000000000000..880ed767be98
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
@@ -0,0 +1,27 @@
+<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
+<qhelp>
+
+  <overview>
+    <p>Cross-Site Scripting (XSS) is categorized as one of the OWASP Top 10 Security Vulnerabilities. The <code>HttpOnly</code> flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header for a sensitive cookie helps mitigate the risk associated with XSS where an attacker's script code attempts to read the contents of a cookie and exfiltrate information obtained.</p>
+  </overview>
+
+  <recommendation>
+    <p>Use the <code>HttpOnly</code> flag when generating a cookie containing sensitive information to help mitigate the risk of client side script accessing the protected cookie.</p>
+  </recommendation>
+
+  <example>
+    <p>The following example shows two ways of generating sensitive cookies. In the 'BAD' cases, the <code>HttpOnly</code> flag is not set. In the 'GOOD' cases, the <code>HttpOnly</code> flag is set.</p>
+    <sample src="SensitiveCookieNotHttpOnly.java" />
+  </example>
+
+  <references>
+    <li>
+      PortSwigger:
+      <a href="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a>
+    </li>
+    <li>
+      OWASP:
+      <a href="https://owasp.org/www-community/HttpOnly">HttpOnly</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
new file mode 100644
index 000000000000..bf4e60134c9a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -0,0 +1,194 @@
+/**
+ * @name Sensitive cookies without the HttpOnly response header set
+ * @description Sensitive cookies without 'HttpOnly' leaves session cookies vulnerable to an XSS attack.
+ * @kind path-problem
+ * @id java/sensitive-cookie-not-httponly
+ * @tags security
+ *       external/cwe/cwe-1004
+ */
+
+import java
+import semmle.code.java.frameworks.Servlets
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+/** Gets a regular expression for matching common names of sensitive cookies. */
+string getSensitiveCookieNameRegex() { result = "(?i).*(auth|session|token|key|credential).*" }
+
+/** Holds if a string is concatenated with the name of a sensitive cookie. */
+predicate isSensitiveCookieNameExpr(Expr expr) {
+  expr.(StringLiteral)
+      .getRepresentedString()
+      .toLowerCase()
+      .regexpMatch(getSensitiveCookieNameRegex()) or
+  isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
+}
+
+/** Holds if a string is concatenated with the `HttpOnly` flag. */
+predicate hasHttpOnlyExpr(Expr expr) {
+  expr.(StringLiteral).getRepresentedString().toLowerCase().matches("%httponly%") or
+  hasHttpOnlyExpr(expr.(AddExpr).getAnOperand())
+}
+
+/** The method call `Set-Cookie` of `addHeader` or `setHeader`. */
+class SetCookieMethodAccess extends MethodAccess {
+  SetCookieMethodAccess() {
+    (
+      this.getMethod() instanceof ResponseAddHeaderMethod or
+      this.getMethod() instanceof ResponseSetHeaderMethod
+    ) and
+    this.getArgument(0).(StringLiteral).getRepresentedString().toLowerCase() = "set-cookie"
+  }
+}
+
+/** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
+class SensitiveCookieNameExpr extends Expr {
+  SensitiveCookieNameExpr() {
+    isSensitiveCookieNameExpr(this) and
+    (
+      exists(
+        ClassInstanceExpr cie // new Cookie("jwt_token", token)
+      |
+        (
+          cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
+          cie.getConstructor()
+              .getDeclaringType()
+              .getASupertype*()
+              .hasQualifiedName("javax.ws.rs.core", "Cookie") or
+          cie.getConstructor()
+              .getDeclaringType()
+              .getASupertype*()
+              .hasQualifiedName("jakarta.ws.rs.core", "Cookie")
+        ) and
+        DataFlow::localExprFlow(this, cie.getArgument(0))
+      )
+      or
+      exists(
+        SetCookieMethodAccess ma // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
+      |
+        DataFlow::localExprFlow(this, ma.getArgument(1))
+      )
+    )
+  }
+}
+
+/** Sink of adding a cookie to the HTTP response. */
+class CookieResponseSink extends DataFlow::ExprNode {
+  CookieResponseSink() {
+    exists(MethodAccess ma |
+      (
+        ma.getMethod() instanceof ResponseAddCookieMethod or
+        ma instanceof SetCookieMethodAccess
+      ) and
+      ma.getAnArgument() = this.getExpr()
+    )
+  }
+}
+
+/** Holds if the `node` is a method call of `setHttpOnly(true)` on a cookie. */
+predicate setHttpOnlyMethodAccess(DataFlow::Node node) {
+  exists(
+    MethodAccess addCookie, Variable cookie, MethodAccess m // jwtCookie.setHttpOnly(true)
+  |
+    addCookie.getMethod() instanceof ResponseAddCookieMethod and
+    addCookie.getArgument(0) = cookie.getAnAccess() and
+    m.getMethod().getName() = "setHttpOnly" and
+    m.getArgument(0).(BooleanLiteral).getBooleanValue() = true and
+    m.getQualifier() = cookie.getAnAccess() and
+    node.asExpr() = cookie.getAnAccess()
+  )
+}
+
+/** Holds if the `node` is a method call of `Set-Cookie` header with the `HttpOnly` flag whose cookie name is sensitive. */
+predicate setHttpOnlyInSetCookie(DataFlow::Node node) {
+  exists(SetCookieMethodAccess sa |
+    hasHttpOnlyExpr(node.asExpr()) and
+    DataFlow::localExprFlow(node.asExpr(), sa.getArgument(1))
+  )
+}
+
+/** Holds if the `node` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+predicate setHttpOnlyInNewCookie(DataFlow::Node node) {
+  exists(ClassInstanceExpr cie |
+    cie.getConstructor().getDeclaringType().hasName("NewCookie") and
+    DataFlow::localExprFlow(node.asExpr(), cie.getArgument(0)) and
+    (
+      cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+      or
+      cie.getNumArgument() = 8 and
+      cie.getArgument(6).getType() instanceof BooleanType and
+      cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+      or
+      cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    )
+  )
+}
+
+/**
+ * Holds if the node is a test method indicated by:
+ *    a) in a test directory such as `src/test/java`
+ *    b) in a test package whose name has the word `test`
+ *    c) in a test class whose name has the word `test`
+ *    d) in a test class implementing a test framework such as JUnit or TestNG
+ */
+predicate isTestMethod(DataFlow::Node node) {
+  exists(MethodAccess ma, Method m |
+    node.asExpr() = ma.getAnArgument() and
+    m = ma.getEnclosingCallable() and
+    (
+      m.getDeclaringType().getName().toLowerCase().matches("%test%") or // Simple check to exclude test classes to reduce FPs
+      m.getDeclaringType().getPackage().getName().toLowerCase().matches("%test%") or // Simple check to exclude classes in test packages to reduce FPs
+      exists(m.getLocation().getFile().getAbsolutePath().indexOf("/src/test/java")) or //  Match test directory structure of build tools like maven
+      m instanceof TestMethod // Test method of a test case implementing a test framework such as JUnit or TestNG
+    )
+  )
+}
+
+/** A taint configuration tracking flow from a sensitive cookie without HttpOnly flag set to its HTTP response. */
+class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
+  MissingHttpOnlyConfiguration() { this = "MissingHttpOnlyConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr() instanceof SensitiveCookieNameExpr
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof CookieResponseSink }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    // cookie.setHttpOnly(true)
+    setHttpOnlyMethodAccess(node)
+    or
+    // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
+    setHttpOnlyInSetCookie(node)
+    or
+    // new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)
+    setHttpOnlyInNewCookie(node)
+    or
+    // Test class or method
+    isTestMethod(node)
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(
+      ClassInstanceExpr cie // `NewCookie` constructor
+    |
+      cie.getAnArgument() = pred.asExpr() and
+      cie = succ.asExpr() and
+      cie.getConstructor().getDeclaringType().hasName("NewCookie")
+    )
+    or
+    exists(
+      MethodAccess ma // `toString` call on a cookie object
+    |
+      ma.getQualifier() = pred.asExpr() and
+      ma.getMethod().hasName("toString") and
+      ma = succ.asExpr()
+    )
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, MissingHttpOnlyConfiguration c
+where c.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "$@ doesn't have the HttpOnly flag set.", source.getNode(),
+  "This sensitive cookie"
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
new file mode 100644
index 000000000000..84d6be3863ac
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -0,0 +1,13 @@
+edges
+| SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) |
+nodes
+| SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | semmle.label | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | semmle.label | ... + ... |
+| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | semmle.label | toString(...) |
+| SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+#select
+| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
new file mode 100644
index 000000000000..5e4f349f7c88
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -0,0 +1,57 @@
+import java.io.IOException;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+import javax.ws.rs.core.NewCookie;
+
+class SensitiveCookieNotHttpOnly {
+    // GOOD - Tests adding a sensitive cookie with the `HttpOnly` flag set.
+    public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        jwtCookie.setHttpOnly(true);
+        response.addCookie(jwtCookie);
+    }
+
+    // BAD - Tests adding a sensitive cookie without the `HttpOnly` flag set.
+    public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        Cookie userIdCookie =new Cookie("user_id", userId.toString());
+        jwtCookie.setPath("/");
+        userIdCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        userIdCookie.setMaxAge(3600*24*7);
+        response.addCookie(jwtCookie);
+        response.addCookie(userIdCookie);
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set.
+    public void addCookie3(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure");
+    }
+
+    // BAD - Tests set a sensitive cookie header without the `HttpOnly` flag set.
+    public void addCookie4(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";Secure");
+    }
+    
+    // GOOD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through string concatenation.
+    public void addCookie5(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true) + ";HttpOnly");
+    }
+
+    // BAD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie6(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true).toString());
+    }
+
+    // GOOD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through the constructor.
+    public void addCookie7(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true);
+        response.setHeader("Set-Cookie", accessKeyCookie.toString());
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref
new file mode 100644
index 000000000000..cc2baaf6f7b2
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/options b/java/ql/test/experimental/query-tests/security/CWE-1004/options
new file mode 100644
index 000000000000..7f2b253fb20d
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jsr311-api-1.1.1
\ No newline at end of file
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
new file mode 100644
index 000000000000..4e4c7585c35d
--- /dev/null
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
@@ -0,0 +1,187 @@
+/*
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
+ *
+ * Copyright (c) 2010-2015 Oracle and/or its affiliates. All rights reserved.
+ *
+ * The contents of this file are subject to the terms of either the GNU
+ * General Public License Version 2 only ("GPL") or the Common Development
+ * and Distribution License("CDDL") (collectively, the "License").  You
+ * may not use this file except in compliance with the License.  You can
+ * obtain a copy of the License at
+ * http://glassfish.java.net/public/CDDL+GPL_1_1.html
+ * or packager/legal/LICENSE.txt.  See the License for the specific
+ * language governing permissions and limitations under the License.
+ *
+ * When distributing the software, include this License Header Notice in each
+ * file and include the License file at packager/legal/LICENSE.txt.
+ *
+ * GPL Classpath Exception:
+ * Oracle designates this particular file as subject to the "Classpath"
+ * exception as provided by Oracle in the GPL Version 2 section of the License
+ * file that accompanied this code.
+ *
+ * Modifications:
+ * If applicable, add the following below the License Header, with the fields
+ * enclosed by brackets [] replaced by your own identifying information:
+ * "Portions Copyright [year] [name of copyright owner]"
+ *
+ * Contributor(s):
+ * If you wish your version of this file to be governed by only the CDDL or
+ * only the GPL Version 2, indicate your decision by adding "[Contributor]
+ * elects to include this software in this distribution under the [CDDL or GPL
+ * Version 2] license."  If you don't indicate a single choice of license, a
+ * recipient has the option to distribute your version of this file under
+ * either the CDDL, the GPL Version 2 or to extend the choice of license to
+ * its licensees as provided above.  However, if you add GPL Version 2 code
+ * and therefore, elected the GPL Version 2 license, then the option applies
+ * only if the new code is made subject to such option by the copyright
+ * holder.
+ */
+
+package javax.ws.rs.core;
+
+/**
+ * Represents the value of a HTTP cookie, transferred in a request.
+ * RFC 2109 specifies the legal characters for name,
+ * value, path and domain. The default version of 1 corresponds to RFC 2109.
+ *
+ * @author Paul Sandoz
+ * @author Marc Hadley
+ * @see <a href="http://www.ietf.org/rfc/rfc2109.txt">IETF RFC 2109</a>
+ * @since 1.0
+ */
+public class Cookie {
+    /**
+     * Cookies using the default version correspond to RFC 2109.
+     */
+    public static final int DEFAULT_VERSION = 1;
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie.
+     * @param value   the value of the cookie.
+     * @param path    the URI path for which the cookie is valid.
+     * @param domain  the host domain for which the cookie is valid.
+     * @param version the version of the specification to which the cookie complies.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value, final String path, final String domain, final int version)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name   the name of the cookie.
+     * @param value  the value of the cookie.
+     * @param path   the URI path for which the cookie is valid.
+     * @param domain the host domain for which the cookie is valid.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value, final String path, final String domain)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name  the name of the cookie.
+     * @param value the value of the cookie.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Creates a new instance of {@code Cookie} by parsing the supplied string.
+     *
+     * @param value the cookie string.
+     * @return the newly created {@code Cookie}.
+     * @throws IllegalArgumentException if the supplied string cannot be parsed
+     *                                  or is {@code null}.
+     */
+    public static Cookie valueOf(final String value) {
+        return null;
+    }
+
+    /**
+     * Get the name of the cookie.
+     *
+     * @return the cookie name.
+     */
+    public String getName() {
+        return null;
+    }
+
+    /**
+     * Get the value of the cookie.
+     *
+     * @return the cookie value.
+     */
+    public String getValue() {
+        return null;
+    }
+
+    /**
+     * Get the version of the cookie.
+     *
+     * @return the cookie version.
+     */
+    public int getVersion() {
+        return -1;
+    }
+
+    /**
+     * Get the domain of the cookie.
+     *
+     * @return the cookie domain.
+     */
+    public String getDomain() {
+        return null;
+    }
+
+    /**
+     * Get the path of the cookie.
+     *
+     * @return the cookie path.
+     */
+    public String getPath() {
+        return null;
+    }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }
+
+    /**
+     * Generate a hash code by hashing all of the cookies properties.
+     *
+     * @return the cookie hash code.
+     */
+    @Override
+    public int hashCode() {
+        return -1;
+    }
+
+    /**
+     * Compare for equality.
+     *
+     * @param obj the object to compare to.
+     * @return {@code true}, if the object is a {@code Cookie} with the same
+     *         value for all properties, {@code false} otherwise.
+     */
+    @SuppressWarnings({"StringEquality", "RedundantIfStatement"})
+    @Override
+    public boolean equals(final Object obj) {
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
new file mode 100644
index 000000000000..43a4899e0ca3
--- /dev/null
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
@@ -0,0 +1,359 @@
+/*
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
+ *
+ * Copyright (c) 2010-2015 Oracle and/or its affiliates. All rights reserved.
+ *
+ * The contents of this file are subject to the terms of either the GNU
+ * General Public License Version 2 only ("GPL") or the Common Development
+ * and Distribution License("CDDL") (collectively, the "License").  You
+ * may not use this file except in compliance with the License.  You can
+ * obtain a copy of the License at
+ * http://glassfish.java.net/public/CDDL+GPL_1_1.html
+ * or packager/legal/LICENSE.txt.  See the License for the specific
+ * language governing permissions and limitations under the License.
+ *
+ * When distributing the software, include this License Header Notice in each
+ * file and include the License file at packager/legal/LICENSE.txt.
+ *
+ * GPL Classpath Exception:
+ * Oracle designates this particular file as subject to the "Classpath"
+ * exception as provided by Oracle in the GPL Version 2 section of the License
+ * file that accompanied this code.
+ *
+ * Modifications:
+ * If applicable, add the following below the License Header, with the fields
+ * enclosed by brackets [] replaced by your own identifying information:
+ * "Portions Copyright [year] [name of copyright owner]"
+ *
+ * Contributor(s):
+ * If you wish your version of this file to be governed by only the CDDL or
+ * only the GPL Version 2, indicate your decision by adding "[Contributor]
+ * elects to include this software in this distribution under the [CDDL or GPL
+ * Version 2] license."  If you don't indicate a single choice of license, a
+ * recipient has the option to distribute your version of this file under
+ * either the CDDL, the GPL Version 2 or to extend the choice of license to
+ * its licensees as provided above.  However, if you add GPL Version 2 code
+ * and therefore, elected the GPL Version 2 license, then the option applies
+ * only if the new code is made subject to such option by the copyright
+ * holder.
+ */
+
+package javax.ws.rs.core;
+
+import java.util.Date;
+
+/**
+ * Used to create a new HTTP cookie, transferred in a response.
+ *
+ * @author Paul Sandoz
+ * @author Marc Hadley
+ * @see <a href="http://www.ietf.org/rfc/rfc2109.txt">IETF RFC 2109</a>
+ * @since 1.0
+ */
+public class NewCookie extends Cookie {
+
+    /**
+     * Specifies that the cookie expires with the current application/browser session.
+     */
+    public static final int DEFAULT_MAX_AGE = -1;
+
+    private final String comment;
+    private final int maxAge;
+    private final Date expiry;
+    private final boolean secure;
+    private final boolean httpOnly;
+
+    /**
+     * Create a new instance.
+     *
+     * @param name  the name of the cookie.
+     * @param value the value of the cookie.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name, String value) {
+        this(name, value, null, null, DEFAULT_VERSION, null, DEFAULT_MAX_AGE, null, false, false);
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie.
+     * @param value   the value of the cookie.
+     * @param path    the URI path for which the cookie is valid.
+     * @param domain  the host domain for which the cookie is valid.
+     * @param comment the comment.
+     * @param maxAge  the maximum age of the cookie in seconds.
+     * @param secure  specifies whether the cookie will only be sent over a secure connection.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     String comment,
+                     int maxAge,
+                     boolean secure) {
+        this(name, value, path, domain, DEFAULT_VERSION, comment, maxAge, null, secure, false);                  
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name     the name of the cookie.
+     * @param value    the value of the cookie.
+     * @param path     the URI path for which the cookie is valid.
+     * @param domain   the host domain for which the cookie is valid.
+     * @param comment  the comment.
+     * @param maxAge   the maximum age of the cookie in seconds.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection.
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if name is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     String comment,
+                     int maxAge,
+                     boolean secure,
+                     boolean httpOnly) {
+        this(name, value, path, domain, DEFAULT_VERSION, comment, maxAge, null, secure, httpOnly);
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie
+     * @param value   the value of the cookie
+     * @param path    the URI path for which the cookie is valid
+     * @param domain  the host domain for which the cookie is valid
+     * @param version the version of the specification to which the cookie complies
+     * @param comment the comment
+     * @param maxAge  the maximum age of the cookie in seconds
+     * @param secure  specifies whether the cookie will only be sent over a secure connection
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     int version,
+                     String comment,
+                     int maxAge,
+                     boolean secure) {
+        this(name, value, path, domain, version, comment, maxAge, null, secure, false);                 
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name     the name of the cookie
+     * @param value    the value of the cookie
+     * @param path     the URI path for which the cookie is valid
+     * @param domain   the host domain for which the cookie is valid
+     * @param version  the version of the specification to which the cookie complies
+     * @param comment  the comment
+     * @param maxAge   the maximum age of the cookie in seconds
+     * @param expiry   the cookie expiry date.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if name is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     int version,
+                     String comment,
+                     int maxAge,
+                     Date expiry,
+                     boolean secure,
+                     boolean httpOnly) {
+            super(name, value, path, domain, version);
+            this.comment = comment;
+            this.maxAge = maxAge;
+            this.expiry = expiry;
+            this.secure = secure;
+            this.httpOnly = httpOnly;
+    }
+
+    /**
+     * Create a new instance copying the information in the supplied cookie.
+     *
+     * @param cookie the cookie to clone.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     */
+    public NewCookie(Cookie cookie) {
+        this(cookie, null, DEFAULT_MAX_AGE, null, false, false);
+    }
+
+    /**
+     * Create a new instance supplementing the information in the supplied cookie.
+     *
+     * @param cookie  the cookie to clone.
+     * @param comment the comment.
+     * @param maxAge  the maximum age of the cookie in seconds.
+     * @param secure  specifies whether the cookie will only be sent over a secure connection.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     */
+    public NewCookie(Cookie cookie, String comment, int maxAge, boolean secure) {
+        this(cookie, comment, maxAge, null, secure, false);
+    }
+
+    /**
+     * Create a new instance supplementing the information in the supplied cookie.
+     *
+     * @param cookie   the cookie to clone.
+     * @param comment  the comment.
+     * @param maxAge   the maximum age of the cookie in seconds.
+     * @param expiry   the cookie expiry date.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection.
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly) {
+        super(cookie == null ? null : cookie.getName(),
+        cookie == null ? null : cookie.getValue(),
+        cookie == null ? null : cookie.getPath(),
+        cookie == null ? null : cookie.getDomain(),
+        cookie == null ? Cookie.DEFAULT_VERSION : cookie.getVersion());
+        this.comment = comment;
+        this.maxAge = maxAge;
+        this.expiry = expiry;
+        this.secure = secure;
+        this.httpOnly = httpOnly;        
+    }
+
+    /**
+     * Creates a new instance of NewCookie by parsing the supplied string.
+     *
+     * @param value the cookie string.
+     * @return the newly created {@code NewCookie}.
+     * @throws IllegalArgumentException if the supplied string cannot be parsed
+     *                                  or is {@code null}.
+     */
+    public static NewCookie valueOf(String value) {
+        return null;
+    }
+
+    /**
+     * Get the comment associated with the cookie.
+     *
+     * @return the comment or null if none set
+     */
+    public String getComment() {
+        return null;
+    }
+
+    /**
+     * Get the maximum age of the the cookie in seconds. Cookies older than
+     * the maximum age are discarded. A cookie can be unset by sending a new
+     * cookie with maximum age of 0 since it will overwrite any existing cookie
+     * and then be immediately discarded. The default value of {@code -1} indicates
+     * that the cookie will be discarded at the end of the browser/application session.
+     * <p>
+     * Note that it is recommended to use {@code Max-Age} to control cookie
+     * expiration, however some browsers do not understand {@code Max-Age}, in which case
+     * setting {@link #getExpiry()} Expires} parameter may be necessary.
+     * </p>
+     *
+     * @return the maximum age in seconds.
+     * @see #getExpiry()
+     */
+    public int getMaxAge() {
+        return -1;
+    }
+
+    /**
+     * Get the cookie expiry date. Cookies whose expiry date has passed are discarded.
+     * A cookie can be unset by setting a new cookie with an expiry date in the past,
+     * typically the lowest possible date that can be set.
+     * <p>
+     * Note that it is recommended to use {@link #getMaxAge() Max-Age} to control cookie
+     * expiration, however some browsers do not understand {@code Max-Age}, in which case
+     * setting {@code Expires} parameter may be necessary.
+     * </p>
+     *
+     * @return cookie expiry date or {@code null} if no expiry date was set.
+     * @see #getMaxAge()
+     * @since 2.0
+     */
+    public Date getExpiry() {
+        return null;
+    }
+
+    /**
+     * Whether the cookie will only be sent over a secure connection. Defaults
+     * to {@code false}.
+     *
+     * @return {@code true} if the cookie will only be sent over a secure connection,
+     *         {@code false} otherwise.
+     */
+    public boolean isSecure() {
+        return false;
+    }
+
+    /**
+     * Returns {@code true} if this cookie contains the {@code HttpOnly} attribute.
+     * This means that the cookie should not be accessible to scripting engines,
+     * like javascript.
+     *
+     * @return {@code true} if this cookie should be considered http only, {@code false}
+     *         otherwise.
+     * @since 2.0
+     */
+    public boolean isHttpOnly() {
+        return false;
+    }
+
+    /**
+     * Obtain a new instance of a {@link Cookie} with the same name, value, path,
+     * domain and version as this {@code NewCookie}. This method can be used to
+     * obtain an object that can be compared for equality with another {@code Cookie};
+     * since a {@code Cookie} will never compare equal to a {@code NewCookie}.
+     *
+     * @return a {@link Cookie}
+     */
+    public Cookie toCookie() {
+        return null;
+    }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }
+
+    /**
+     * Generate a hash code by hashing all of the properties.
+     *
+     * @return the hash code.
+     */
+    @Override
+    public int hashCode() {
+        return -1;
+    }
+
+    /**
+     * Compare for equality. Use {@link #toCookie()} to compare a
+     * {@code NewCookie} to a {@code Cookie} considering only the common
+     * properties.
+     *
+     * @param obj the object to compare to
+     * @return true if the object is a {@code NewCookie} with the same value for
+     *         all properties, false otherwise.
+     */
+    @SuppressWarnings({"StringEquality", "RedundantIfStatement"})
+    @Override
+    public boolean equals(Object obj) {
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
index d8348e13e2ef..a93fec853e06 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
@@ -32,6 +32,7 @@ public class Cookie implements Cloneable {
     private String path; // ;Path=VALUE ... URLs that see the cookie
     private boolean secure; // ;Secure ... e.g. use SSL
     private int version = 0; // ;Version=1 ... means RFC 2109++ style
+    private boolean isHttpOnly = false;
 
     public Cookie(String name, String value) {
         this.name = name;
@@ -81,4 +82,36 @@ public int getVersion() {
     }
     public void setVersion(int v) {
     }
+
+    /**
+     * Marks or unmarks this Cookie as <i>HttpOnly</i>.
+     *
+     * <p>If <tt>isHttpOnly</tt> is set to <tt>true</tt>, this cookie is
+     * marked as <i>HttpOnly</i>, by adding the <tt>HttpOnly</tt> attribute
+     * to it.
+     *
+     * <p><i>HttpOnly</i> cookies are not supposed to be exposed to
+     * client-side scripting code, and may therefore help mitigate certain
+     * kinds of cross-site scripting attacks.
+     *
+     * @param isHttpOnly true if this cookie is to be marked as
+     * <i>HttpOnly</i>, false otherwise
+     *
+     * @since Servlet 3.0
+     */
+    public void setHttpOnly(boolean isHttpOnly) {
+        this.isHttpOnly = isHttpOnly;
+    }
+ 
+    /**
+     * Checks whether this Cookie has been marked as <i>HttpOnly</i>.
+     *
+     * @return true if this Cookie has been marked as <i>HttpOnly</i>,
+     * false otherwise
+     *
+     * @since Servlet 3.0
+     */
+    public boolean isHttpOnly() {
+        return isHttpOnly;
+    }
 }
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
index 2971e0233902..162ac0db3cc3 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
@@ -24,6 +24,7 @@
 package javax.servlet.http;
 
 import java.io.IOException;
+import java.util.Collection;
 import javax.servlet.ServletResponse;
 
 public interface HttpServletResponse extends ServletResponse {
@@ -44,6 +45,11 @@ public interface HttpServletResponse extends ServletResponse {
     public void addIntHeader(String name, int value);
     public void setStatus(int sc);
     public void setStatus(int sc, String sm);
+    public int getStatus();
+    public String getHeader(String name);
+    public Collection<String> getHeaders(String name);
+    public Collection<String> getHeaderNames();
+
 
     public static final int SC_CONTINUE = 100;
     public static final int SC_SWITCHING_PROTOCOLS = 101;

From b366ffa69e98e21ac8998bb08a8815fc4cae6b4f Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 3 Mar 2021 13:38:18 +0000
Subject: [PATCH 009/433] Revamp source of the query

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.qhelp |   2 +-
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 116 +++++++++---------
 .../SensitiveCookieNotHttpOnly.expected       |  12 +-
 .../javax/ws/rs/core/Cookie.java              |  59 +++------
 .../javax/ws/rs/core/NewCookie.java           |  36 ------
 5 files changed, 82 insertions(+), 143 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
index 880ed767be98..ee3e8a4181a9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
@@ -2,7 +2,7 @@
 <qhelp>
 
   <overview>
-    <p>Cross-Site Scripting (XSS) is categorized as one of the OWASP Top 10 Security Vulnerabilities. The <code>HttpOnly</code> flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header for a sensitive cookie helps mitigate the risk associated with XSS where an attacker's script code attempts to read the contents of a cookie and exfiltrate information obtained.</p>
+    <p>Cross-Site Scripting (XSS) is categorized as one of the OWASP Top 10 Security Vulnerabilities. The <code>HttpOnly</code> flag directs compatible browsers to prevent client-side script from accessing cookies. Including the <code>HttpOnly</code> flag in the Set-Cookie HTTP response header for a sensitive cookie helps mitigate the risk associated with XSS where an attacker's script code attempts to read the contents of a cookie and exfiltrate information obtained.</p>
   </overview>
 
   <recommendation>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index bf4e60134c9a..842e8b7eabbd 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -9,7 +9,6 @@
 
 import java
 import semmle.code.java.frameworks.Servlets
-import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow::PathGraph
 
@@ -18,8 +17,8 @@ string getSensitiveCookieNameRegex() { result = "(?i).*(auth|session|token|key|c
 
 /** Holds if a string is concatenated with the name of a sensitive cookie. */
 predicate isSensitiveCookieNameExpr(Expr expr) {
-  expr.(StringLiteral)
-      .getRepresentedString()
+  expr.(CompileTimeConstantExpr)
+      .getStringValue()
       .toLowerCase()
       .regexpMatch(getSensitiveCookieNameRegex()) or
   isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
@@ -27,7 +26,7 @@ predicate isSensitiveCookieNameExpr(Expr expr) {
 
 /** Holds if a string is concatenated with the `HttpOnly` flag. */
 predicate hasHttpOnlyExpr(Expr expr) {
-  expr.(StringLiteral).getRepresentedString().toLowerCase().matches("%httponly%") or
+  expr.(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%") or
   hasHttpOnlyExpr(expr.(AddExpr).getAnOperand())
 }
 
@@ -38,37 +37,34 @@ class SetCookieMethodAccess extends MethodAccess {
       this.getMethod() instanceof ResponseAddHeaderMethod or
       this.getMethod() instanceof ResponseSetHeaderMethod
     ) and
-    this.getArgument(0).(StringLiteral).getRepresentedString().toLowerCase() = "set-cookie"
+    this.getArgument(0).(CompileTimeConstantExpr).getStringValue().toLowerCase() = "set-cookie"
   }
 }
 
 /** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() {
-    isSensitiveCookieNameExpr(this) and
-    (
-      exists(
-        ClassInstanceExpr cie // new Cookie("jwt_token", token)
-      |
-        (
-          cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
-          cie.getConstructor()
-              .getDeclaringType()
-              .getASupertype*()
-              .hasQualifiedName("javax.ws.rs.core", "Cookie") or
-          cie.getConstructor()
-              .getDeclaringType()
-              .getASupertype*()
-              .hasQualifiedName("jakarta.ws.rs.core", "Cookie")
-        ) and
-        DataFlow::localExprFlow(this, cie.getArgument(0))
-      )
-      or
-      exists(
-        SetCookieMethodAccess ma // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
-      |
-        DataFlow::localExprFlow(this, ma.getArgument(1))
-      )
+    exists(
+      ClassInstanceExpr cie, Expr e // new Cookie("jwt_token", token)
+    |
+      (
+        cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
+        cie.getConstructor()
+            .getDeclaringType()
+            .getASupertype*()
+            .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
+      ) and
+      this = cie and
+      isSensitiveCookieNameExpr(e) and
+      DataFlow::localExprFlow(e, cie.getArgument(0))
+    )
+    or
+    exists(
+      SetCookieMethodAccess ma, Expr e // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
+    |
+      this = ma.getArgument(1) and
+      isSensitiveCookieNameExpr(e) and
+      DataFlow::localExprFlow(e, ma.getArgument(1))
     )
   }
 }
@@ -78,15 +74,20 @@ class CookieResponseSink extends DataFlow::ExprNode {
   CookieResponseSink() {
     exists(MethodAccess ma |
       (
-        ma.getMethod() instanceof ResponseAddCookieMethod or
-        ma instanceof SetCookieMethodAccess
-      ) and
-      ma.getAnArgument() = this.getExpr()
+        ma.getMethod() instanceof ResponseAddCookieMethod and
+        this.getExpr() = ma.getArgument(0)
+        or
+        ma instanceof SetCookieMethodAccess and
+        this.getExpr() = ma.getArgument(1)
+      )
     )
   }
 }
 
-/** Holds if the `node` is a method call of `setHttpOnly(true)` on a cookie. */
+/**
+ * Holds if `node` is an access to a variable which has `setHttpOnly(true)` called on it and is also
+ * the first argument to a call to the method `addCookie` of `javax.servlet.http.HttpServletResponse`.
+ */
 predicate setHttpOnlyMethodAccess(DataFlow::Node node) {
   exists(
     MethodAccess addCookie, Variable cookie, MethodAccess m // jwtCookie.setHttpOnly(true)
@@ -100,7 +101,10 @@ predicate setHttpOnlyMethodAccess(DataFlow::Node node) {
   )
 }
 
-/** Holds if the `node` is a method call of `Set-Cookie` header with the `HttpOnly` flag whose cookie name is sensitive. */
+/**
+ * Holds if `node` is a string that contains `httponly` and which flows to the second argument
+ * of a method to set a cookie.
+ */
 predicate setHttpOnlyInSetCookie(DataFlow::Node node) {
   exists(SetCookieMethodAccess sa |
     hasHttpOnlyExpr(node.asExpr()) and
@@ -108,20 +112,17 @@ predicate setHttpOnlyInSetCookie(DataFlow::Node node) {
   )
 }
 
-/** Holds if the `node` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
-predicate setHttpOnlyInNewCookie(DataFlow::Node node) {
-  exists(ClassInstanceExpr cie |
-    cie.getConstructor().getDeclaringType().hasName("NewCookie") and
-    DataFlow::localExprFlow(node.asExpr(), cie.getArgument(0)) and
-    (
-      cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-      or
-      cie.getNumArgument() = 8 and
-      cie.getArgument(6).getType() instanceof BooleanType and
-      cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
-      or
-      cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-    )
+/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
+  cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
+  (
+    cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 8 and
+    cie.getArgument(6).getType() instanceof BooleanType and
+    cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
   )
 }
 
@@ -145,7 +146,10 @@ predicate isTestMethod(DataFlow::Node node) {
   )
 }
 
-/** A taint configuration tracking flow from a sensitive cookie without HttpOnly flag set to its HTTP response. */
+/**
+ * A taint configuration tracking flow from a sensitive cookie without the `HttpOnly` flag
+ * set to its HTTP response.
+ */
 class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
   MissingHttpOnlyConfiguration() { this = "MissingHttpOnlyConfiguration" }
 
@@ -159,25 +163,17 @@ class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
     // cookie.setHttpOnly(true)
     setHttpOnlyMethodAccess(node)
     or
-    // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
+    // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
     setHttpOnlyInSetCookie(node)
     or
     // new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)
-    setHttpOnlyInNewCookie(node)
+    setHttpOnlyInNewCookie(node.asExpr())
     or
     // Test class or method
     isTestMethod(node)
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(
-      ClassInstanceExpr cie // `NewCookie` constructor
-    |
-      cie.getAnArgument() = pred.asExpr() and
-      cie = succ.asExpr() and
-      cie.getConstructor().getDeclaringType().hasName("NewCookie")
-    )
-    or
     exists(
       MethodAccess ma // `toString` call on a cookie object
     |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index 84d6be3863ac..e2d05a9b24d8 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -1,13 +1,13 @@
 edges
-| SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
-| SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) |
+| SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) |
 nodes
-| SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | semmle.label | jwtCookie |
 | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | semmle.label | ... + ... |
+| SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
 | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | semmle.label | toString(...) |
-| SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
 #select
-| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:38:22:48 | "jwt_token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:49:56:49:75 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) | This sensitive cookie |
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
index 4e4c7585c35d..f810600a7660 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
@@ -51,10 +51,16 @@
  * @since 1.0
  */
 public class Cookie {
+
     /**
      * Cookies using the default version correspond to RFC 2109.
      */
     public static final int DEFAULT_VERSION = 1;
+    private final String name;
+    private final String value;
+    private final int version;
+    private final String path;
+    private final String domain;
 
     /**
      * Create a new instance.
@@ -68,6 +74,11 @@ public class Cookie {
      */
     public Cookie(final String name, final String value, final String path, final String domain, final int version)
             throws IllegalArgumentException {
+        this.name = name;
+        this.value = value;
+        this.version = version;
+        this.domain = domain;
+        this.path = path;
     }
 
     /**
@@ -81,6 +92,7 @@ public Cookie(final String name, final String value, final String path, final St
      */
     public Cookie(final String name, final String value, final String path, final String domain)
             throws IllegalArgumentException {
+        this(name, value, path, domain, DEFAULT_VERSION);
     }
 
     /**
@@ -92,6 +104,7 @@ public Cookie(final String name, final String value, final String path, final St
      */
     public Cookie(final String name, final String value)
             throws IllegalArgumentException {
+        this(name, value, null, null);
     }
 
     /**
@@ -112,7 +125,7 @@ public static Cookie valueOf(final String value) {
      * @return the cookie name.
      */
     public String getName() {
-        return null;
+        return name;
     }
 
     /**
@@ -121,7 +134,7 @@ public String getName() {
      * @return the cookie value.
      */
     public String getValue() {
-        return null;
+        return value;
     }
 
     /**
@@ -130,7 +143,7 @@ public String getValue() {
      * @return the cookie version.
      */
     public int getVersion() {
-        return -1;
+        return version;
     }
 
     /**
@@ -139,7 +152,7 @@ public int getVersion() {
      * @return the cookie domain.
      */
     public String getDomain() {
-        return null;
+        return domain;
     }
 
     /**
@@ -148,40 +161,6 @@ public String getDomain() {
      * @return the cookie path.
      */
     public String getPath() {
-        return null;
-    }
-
-    /**
-     * Convert the cookie to a string suitable for use as the value of the
-     * corresponding HTTP header.
-     *
-     * @return a stringified cookie.
-     */
-    @Override
-    public String toString() {
-        return null;
-    }
-
-    /**
-     * Generate a hash code by hashing all of the cookies properties.
-     *
-     * @return the cookie hash code.
-     */
-    @Override
-    public int hashCode() {
-        return -1;
-    }
-
-    /**
-     * Compare for equality.
-     *
-     * @param obj the object to compare to.
-     * @return {@code true}, if the object is a {@code Cookie} with the same
-     *         value for all properties, {@code false} otherwise.
-     */
-    @SuppressWarnings({"StringEquality", "RedundantIfStatement"})
-    @Override
-    public boolean equals(final Object obj) {
-        return true;
+        return path;
     }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
index 43a4899e0ca3..7f2e3ec05351 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
@@ -320,40 +320,4 @@ public boolean isHttpOnly() {
     public Cookie toCookie() {
         return null;
     }
-
-    /**
-     * Convert the cookie to a string suitable for use as the value of the
-     * corresponding HTTP header.
-     *
-     * @return a stringified cookie.
-     */
-    @Override
-    public String toString() {
-        return null;
-    }
-
-    /**
-     * Generate a hash code by hashing all of the properties.
-     *
-     * @return the hash code.
-     */
-    @Override
-    public int hashCode() {
-        return -1;
-    }
-
-    /**
-     * Compare for equality. Use {@link #toCookie()} to compare a
-     * {@code NewCookie} to a {@code Cookie} considering only the common
-     * properties.
-     *
-     * @param obj the object to compare to
-     * @return true if the object is a {@code NewCookie} with the same value for
-     *         all properties, false otherwise.
-     */
-    @SuppressWarnings({"StringEquality", "RedundantIfStatement"})
-    @Override
-    public boolean equals(Object obj) {
-        return true;
-    }
 }
\ No newline at end of file

From 1b1c3f953b9ebb828e161e4b36d67075a7bca510 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 3 Mar 2021 13:54:26 +0000
Subject: [PATCH 010/433] Remove localflow from the source

---
 .../CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql         | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 842e8b7eabbd..258b2545b277 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -45,7 +45,7 @@ class SetCookieMethodAccess extends MethodAccess {
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() {
     exists(
-      ClassInstanceExpr cie, Expr e // new Cookie("jwt_token", token)
+      ClassInstanceExpr cie // new Cookie("jwt_token", token)
     |
       (
         cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
@@ -55,16 +55,14 @@ class SensitiveCookieNameExpr extends Expr {
             .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
       ) and
       this = cie and
-      isSensitiveCookieNameExpr(e) and
-      DataFlow::localExprFlow(e, cie.getArgument(0))
+      isSensitiveCookieNameExpr(cie.getArgument(0))
     )
     or
     exists(
-      SetCookieMethodAccess ma, Expr e // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
+      SetCookieMethodAccess ma // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
     |
       this = ma.getArgument(1) and
-      isSensitiveCookieNameExpr(e) and
-      DataFlow::localExprFlow(e, ma.getArgument(1))
+      isSensitiveCookieNameExpr(this)
     )
   }
 }

From 502cf38fccef4c0b2a1120f2fe175571ec1b9cb5 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 3 Mar 2021 14:07:43 +0000
Subject: [PATCH 011/433] Use concise API

---
 .../Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql      | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 258b2545b277..d9104cbad970 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -48,9 +48,8 @@ class SensitiveCookieNameExpr extends Expr {
       ClassInstanceExpr cie // new Cookie("jwt_token", token)
     |
       (
-        cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
-        cie.getConstructor()
-            .getDeclaringType()
+        cie.getConstructedType().hasQualifiedName("javax.servlet.http", "Cookie") or
+        cie.getConstructedType()
             .getASupertype*()
             .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
       ) and

From 86dde6eab16f9f28cc6bb68c8b2ed7fa8c40e3bd Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 17 Feb 2021 11:34:05 +0100
Subject: [PATCH 012/433] Python: start of port

---
 .../src/Security/CWE-327/InsecureProtocol.ql  | 299 +++++++++++++++++-
 .../examples/secure_default_protocol.py       |  13 +
 .../CWE-327/examples/secure_protocol.py       |  11 +
 3 files changed, 307 insertions(+), 16 deletions(-)
 create mode 100644 python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
 create mode 100644 python/ql/src/Security/CWE-327/examples/secure_protocol.py

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index d1ae714b6be6..6f2feedce22f 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -10,7 +10,270 @@
  */
 
 import python
+import semmle.python.ApiGraphs
 
+// The idea is to track flow from the creation of an insecure context to a use
+// such as `wrap_socket`. There should be a data-flow path for each insecure version
+// and each path should have a version specific sanitizer. This will allow fluent api
+// style code to block the paths one by one.
+//
+// class InsecureContextCreation extends DataFlow::CfgNode {
+//   override CallNode node;
+//   InsecureContextCreation() {
+//     this = API::moduleImport("ssl").getMember("SSLContext").getACall() and
+//     insecure_version().asCfgNode() in [node.getArg(0), node.getArgByName("protocol")]
+//   }
+// }
+// class InsecureSSLContextCreation extends DataFlow::CfgNode {
+//   override CallNode node;
+//   InsecureSSLContextCreation() {
+//     this = API::moduleImport("ssl").getMember("create_default_context").getACall()
+//     or
+//     this = API::moduleImport("ssl").getMember("SSLContext").getACall() and
+//     API::moduleImport("ssl").getMember("PROTOCOL_TLS").getAUse().asCfgNode() in [
+//         node.getArg(0), node.getArgByName("protocol")
+//       ]
+//   }
+// }
+abstract class ContextCreation extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getProtocol();
+}
+
+class SSLContextCreation extends ContextCreation {
+  override CallNode node;
+
+  SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
+
+  override DataFlow::CfgNode getProtocol() {
+    result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
+  }
+}
+
+class PyOpenSSLContextCreation extends ContextCreation {
+  override CallNode node;
+
+  PyOpenSSLContextCreation() {
+    this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Context").getACall()
+  }
+
+  override DataFlow::CfgNode getProtocol() {
+    result.getNode() in [node.getArg(0), node.getArgByName("method")]
+  }
+}
+
+abstract class ConnectionCreation extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getContext();
+}
+
+class WrapSocketCall extends ConnectionCreation {
+  override CallNode node;
+
+  WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() = node.getFunction().(AttrNode).getObject()
+  }
+}
+
+class ConnectionCall extends ConnectionCreation {
+  override CallNode node;
+
+  ConnectionCall() {
+    this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Connection").getACall()
+  }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() in [node.getArg(0), node.getArgByName("context")]
+  }
+}
+
+abstract class TlsLibrary extends string {
+  TlsLibrary() { this in ["ssl"] }
+
+  abstract string specific_insecure_version_name();
+
+  abstract string unspecific_version_name();
+
+  abstract API::Node version_constants();
+
+  DataFlow::Node insecure_version() {
+    result = version_constants().getMember(specific_insecure_version_name()).getAUse()
+  }
+
+  DataFlow::Node unspecific_version() {
+    result = version_constants().getMember(unspecific_version_name()).getAUse()
+  }
+
+  abstract DataFlow::CfgNode default_context_creation();
+
+  abstract ContextCreation specific_context_creation();
+
+  ContextCreation insecure_context_creation() {
+    result = specific_context_creation() and
+    result.getProtocol() = insecure_version()
+  }
+
+  DataFlow::CfgNode unspecific_context_creation() {
+    result = default_context_creation()
+    or
+    result = specific_context_creation() and
+    result.(ContextCreation).getProtocol() = unspecific_version()
+  }
+
+  abstract ConnectionCreation connection_creation();
+}
+
+class Ssl extends TlsLibrary {
+  Ssl() { this = "ssl" }
+
+  override string specific_insecure_version_name() {
+    result in [
+        "PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_TLSv1", "PROTOCOL_TLSv1_1"
+      ]
+  }
+
+  override string unspecific_version_name() { result = "PROTOCOL_TLS" }
+
+  override API::Node version_constants() { result = API::moduleImport("ssl") }
+
+  override DataFlow::CfgNode default_context_creation() {
+    result = API::moduleImport("ssl").getMember("create_default_context").getACall()
+  }
+
+  override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
+
+  override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
+}
+
+class PyOpenSSL extends TlsLibrary {
+  PyOpenSSL() { this = "pyOpenSSL" }
+
+  override string specific_insecure_version_name() {
+    result in ["SSLv2_METHOD", "SSLv23_METHOD", "SSLv3_METHOD", "TLSv1_METHOD", "TLSv1_1_METHOD"]
+  }
+
+  override string unspecific_version_name() { result = "TLS_METHOD" }
+
+  override API::Node version_constants() {
+    result = API::moduleImport("pyOpenSSL").getMember("SSL")
+  }
+
+  override DataFlow::CfgNode default_context_creation() { none() }
+
+  override ContextCreation specific_context_creation() {
+    result instanceof PyOpenSSLContextCreation
+  }
+
+  override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
+}
+
+module ssl {
+  string insecure_version_name() {
+    result = "PROTOCOL_SSLv2" or
+    result = "PROTOCOL_SSLv3" or
+    result = "PROTOCOL_SSLv23" or
+    result = "PROTOCOL_TLSv1" or
+    result = "PROTOCOL_TLSv1_1"
+  }
+
+  DataFlow::Node insecure_version() {
+    result = API::moduleImport("ssl").getMember(insecure_version_name()).getAUse()
+  }
+}
+
+module pyOpenSSL {
+  string insecure_version_name() {
+    result = "SSLv2_METHOD" or
+    result = "SSLv23_METHOD" or
+    result = "SSLv3_METHOD" or
+    result = "TLSv1_METHOD" or
+    result = "TLSv1_1_METHOD"
+  }
+
+  DataFlow::Node insecure_version() {
+    result =
+      API::moduleImport("pyOpenSSL").getMember("SSL").getMember(insecure_version_name()).getAUse()
+  }
+}
+
+class InsecureContextConfiguration extends DataFlow::Configuration {
+  TlsLibrary library;
+
+  InsecureContextConfiguration() { this = library + ["AllowsTLSv1", "AllowsTLSv1_1"] }
+
+  override predicate isSource(DataFlow::Node source) {
+    source = library.unspecific_context_creation()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = library.connection_creation().getContext()
+  }
+
+  abstract string flag();
+
+  override predicate isBarrierOut(DataFlow::Node node) {
+    exists(AugAssign aa, AttrNode attr |
+      aa.getOperation().getOp() instanceof BitOr and
+      aa.getTarget() = attr.getNode() and
+      attr.getName() = "options" and
+      attr.getObject() = node.asCfgNode() and
+      aa.getValue() = API::moduleImport("ssl").getMember(flag()).getAUse().asExpr()
+    )
+  }
+}
+
+class AllowsTLSv1 extends InsecureContextConfiguration {
+  AllowsTLSv1() { this = library + "AllowsTLSv1" }
+
+  override string flag() { result = "OP_NO_TLSv1" }
+}
+
+class AllowsTLSv1_1 extends InsecureContextConfiguration {
+  AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
+
+  override string flag() { result = "OP_NO_TLSv1_2" }
+}
+
+predicate unsafe_connection_creation(DataFlow::Node node) {
+  exists(AllowsTLSv1 c | c.hasFlowTo(node)) or
+  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) //or
+  // node = API::moduleImport("ssl").getMember("wrap_socket").getACall()
+}
+
+predicate unsafe_context_creation(DataFlow::Node node) {
+  exists(TlsLibrary l | l.insecure_context_creation() = node)
+}
+
+// class InsecureTLSContextConfiguration extends DataFlow::Configuration {
+//   InsecureTLSContextConfiguration() { this in ["AllowsTLSv1", "AllowsTLSv1_1"] }
+//   override predicate isSource(DataFlow::Node source) {
+//     source instanceof InsecureSSLContextCreation
+//   }
+//   override predicate isSink(DataFlow::Node sink) { sink = any(WrapSocketCall c).getContext() }
+//   abstract string flag();
+//   override predicate isBarrierOut(DataFlow::Node node) {
+//     exists(AugAssign aa, AttrNode attr |
+//       aa.getOperation().getOp() instanceof BitOr and
+//       aa.getTarget() = attr.getNode() and
+//       attr.getName() = "options" and
+//       attr.getObject() = node.asCfgNode() and
+//       aa.getValue() = API::moduleImport("ssl").getMember(flag()).getAUse().asExpr()
+//     )
+//   }
+// }
+// class AllowsTLSv1 extends InsecureTLSContextConfiguration {
+//   AllowsTLSv1() { this = "AllowsTLSv1" }
+//   override string flag() { result = "OP_NO_TLSv1" }
+// }
+// class AllowsTLSv1_1 extends InsecureTLSContextConfiguration {
+//   AllowsTLSv1_1() { this = "AllowsTLSv1_1" }
+//   override string flag() { result = "OP_NO_TLSv1_1" }
+// }
+// predicate unsafe_wrap_socket_call(DataFlow::Node node) {
+//   exists(AllowsTLSv1 c | c.hasFlowTo(node)) or
+//   exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) or
+//   node = API::moduleImport("ssl").getMember("wrap_socket").getACall()
+// }
 private ModuleValue the_ssl_module() { result = Module::named("ssl") }
 
 FunctionValue ssl_wrap_socket() { result = the_ssl_module().attr("wrap_socket") }
@@ -21,20 +284,24 @@ private ModuleValue the_pyOpenSSL_module() { result = Value::named("pyOpenSSL.SS
 
 ClassValue the_pyOpenSSL_Context_class() { result = Value::named("pyOpenSSL.SSL.Context") }
 
-string insecure_version_name() {
-  // For `pyOpenSSL.SSL`
-  result = "SSLv2_METHOD" or
-  result = "SSLv23_METHOD" or
-  result = "SSLv3_METHOD" or
-  result = "TLSv1_METHOD" or
-  // For the `ssl` module
-  result = "PROTOCOL_SSLv2" or
-  result = "PROTOCOL_SSLv3" or
-  result = "PROTOCOL_SSLv23" or
-  result = "PROTOCOL_TLS" or
-  result = "PROTOCOL_TLSv1"
-}
-
+// Since version 3.6, it is fine to call `ssl.SSLContext(protocol=PROTOCOL_TLS)`
+// if one also specifies either OP_NO_TLSv1 (introduced in 3.2)
+// or SSLContext.minimum_version other than TLSVersion.TLSv1 (introduced in 3.7)
+// See https://docs.python.org/3/library/ssl.html?highlight=ssl#ssl.SSLContext
+// and https://docs.python.org/3/library/ssl.html?highlight=ssl#protocol-versions
+// FP reported here: https://github.com/github/codeql/issues/2554
+// string insecure_version_name() {
+//   // For `pyOpenSSL.SSL`
+//   result = "SSLv2_METHOD" or
+//   result = "SSLv23_METHOD" or
+//   result = "SSLv3_METHOD" or
+//   result = "TLSv1_METHOD" or
+//   // For the `ssl` module
+//   result = "PROTOCOL_SSLv2" or
+//   result = "PROTOCOL_SSLv3" or
+//   result = "PROTOCOL_SSLv23" or
+//   result = "PROTOCOL_TLSv1"
+// }
 /*
  * A syntactic check for cases where points-to analysis cannot infer the presence of
  * a protocol constant, e.g. if it has been removed in later versions of the `ssl`
@@ -71,7 +338,7 @@ predicate unsafe_ssl_wrap_socket_call(
     named_argument = "protocol" and
     method_name = "ssl.SSLContext"
   ) and
-  insecure_version = insecure_version_name() and
+  insecure_version = ssl::insecure_version_name() and
   (
     call.getArgByName(named_argument).pointsTo(the_ssl_module().attr(insecure_version))
     or
@@ -81,7 +348,7 @@ predicate unsafe_ssl_wrap_socket_call(
 
 predicate unsafe_pyOpenSSL_Context_call(CallNode call, string insecure_version) {
   call = the_pyOpenSSL_Context_class().getACall() and
-  insecure_version = insecure_version_name() and
+  insecure_version = pyOpenSSL::insecure_version_name() and
   call.getArg(0).pointsTo(the_pyOpenSSL_module().attr(insecure_version))
 }
 
diff --git a/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py b/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
new file mode 100644
index 000000000000..83c6dbbba0e0
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
@@ -0,0 +1,13 @@
+# taken from https://docs.python.org/3/library/ssl.html?highlight=ssl#ssl.SSLContext
+
+import socket
+import ssl
+
+hostname = 'www.python.org'
+context = ssl.create_default_context()
+context.options |= ssl.OP_NO_TLSv1 # This added by me
+context.options |= ssl.OP_NO_TLSv1_1 # This added by me
+
+with socket.create_connection((hostname, 443)) as sock:
+    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+        print(ssock.version())
diff --git a/python/ql/src/Security/CWE-327/examples/secure_protocol.py b/python/ql/src/Security/CWE-327/examples/secure_protocol.py
new file mode 100644
index 000000000000..94b3557d0172
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/examples/secure_protocol.py
@@ -0,0 +1,11 @@
+import socket
+import ssl
+
+hostname = 'www.python.org'
+context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+context.options |= ssl.OP_NO_TLSv1
+context.options |= ssl.OP_NO_TLSv1_1 # This added by me
+
+with socket.create_connection((hostname, 443)) as sock:
+    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+        print(ssock.version())

From 72b37a5b1bb344dcdd9b4e2d1172c540df678408 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 17 Feb 2021 13:21:33 +0100
Subject: [PATCH 013/433] Python: factor out barrier

---
 .../src/Security/CWE-327/InsecureProtocol.ql  | 58 ++++++++++++++++---
 1 file changed, 51 insertions(+), 7 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 6f2feedce22f..6b5b2e75d22a 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -87,6 +87,46 @@ class ConnectionCall extends ConnectionCreation {
   }
 }
 
+class ProtocolRestriction extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getContext();
+
+  abstract string getRestriction();
+}
+
+class OptionsAugOr extends ProtocolRestriction {
+  string restriction;
+
+  OptionsAugOr() {
+    exists(AugAssign aa, AttrNode attr |
+      aa.getOperation().getOp() instanceof BitOr and
+      aa.getTarget() = attr.getNode() and
+      attr.getName() = "options" and
+      attr.getObject() = node and
+      aa.getValue() = API::moduleImport("ssl").getMember(restriction).getAUse().asExpr()
+    )
+  }
+
+  override DataFlow::CfgNode getContext() { result = this }
+
+  override string getRestriction() { result = restriction }
+}
+
+class SetOptionsCall extends ProtocolRestriction {
+  override CallNode node;
+
+  SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() = node.getFunction().(AttrNode).getObject()
+  }
+
+  override string getRestriction() {
+    API::moduleImport("PyOpenSSL").getMember("SSL").getMember(result).getAUse().asCfgNode() in [
+        node.getArg(0), node.getArgByName("options")
+      ]
+  }
+}
+
 abstract class TlsLibrary extends string {
   TlsLibrary() { this in ["ssl"] }
 
@@ -121,6 +161,8 @@ abstract class TlsLibrary extends string {
   }
 
   abstract ConnectionCreation connection_creation();
+
+  abstract ProtocolRestriction protocol_restriction();
 }
 
 class Ssl extends TlsLibrary {
@@ -143,6 +185,8 @@ class Ssl extends TlsLibrary {
   override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
 
   override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
+
+  override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
 }
 
 class PyOpenSSL extends TlsLibrary {
@@ -165,6 +209,8 @@ class PyOpenSSL extends TlsLibrary {
   }
 
   override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
+
+  override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
 }
 
 module ssl {
@@ -212,12 +258,10 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
   abstract string flag();
 
   override predicate isBarrierOut(DataFlow::Node node) {
-    exists(AugAssign aa, AttrNode attr |
-      aa.getOperation().getOp() instanceof BitOr and
-      aa.getTarget() = attr.getNode() and
-      attr.getName() = "options" and
-      attr.getObject() = node.asCfgNode() and
-      aa.getValue() = API::moduleImport("ssl").getMember(flag()).getAUse().asExpr()
+    exists(ProtocolRestriction r |
+      r = library.protocol_restriction() and
+      node = r.getContext() and
+      r.getRestriction() = flag()
     )
   }
 }
@@ -231,7 +275,7 @@ class AllowsTLSv1 extends InsecureContextConfiguration {
 class AllowsTLSv1_1 extends InsecureContextConfiguration {
   AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
 
-  override string flag() { result = "OP_NO_TLSv1_2" }
+  override string flag() { result = "OP_NO_TLSv1_1" }
 }
 
 predicate unsafe_connection_creation(DataFlow::Node node) {

From 7ed018aff6c9f79a3ea60ef8ae4d2f2067b81442 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 17 Feb 2021 14:30:28 +0100
Subject: [PATCH 014/433] Python: refactor into modules and turn on the
 pyOpenSSL module

---
 .../src/Security/CWE-327/InsecureProtocol.ql  | 385 +++++++-----------
 1 file changed, 138 insertions(+), 247 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 6b5b2e75d22a..81b3558907e3 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -39,96 +39,18 @@ abstract class ContextCreation extends DataFlow::CfgNode {
   abstract DataFlow::CfgNode getProtocol();
 }
 
-class SSLContextCreation extends ContextCreation {
-  override CallNode node;
-
-  SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
-
-  override DataFlow::CfgNode getProtocol() {
-    result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
-  }
-}
-
-class PyOpenSSLContextCreation extends ContextCreation {
-  override CallNode node;
-
-  PyOpenSSLContextCreation() {
-    this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Context").getACall()
-  }
-
-  override DataFlow::CfgNode getProtocol() {
-    result.getNode() in [node.getArg(0), node.getArgByName("method")]
-  }
-}
-
 abstract class ConnectionCreation extends DataFlow::CfgNode {
   abstract DataFlow::CfgNode getContext();
 }
 
-class WrapSocketCall extends ConnectionCreation {
-  override CallNode node;
-
-  WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
-
-  override DataFlow::CfgNode getContext() {
-    result.getNode() = node.getFunction().(AttrNode).getObject()
-  }
-}
-
-class ConnectionCall extends ConnectionCreation {
-  override CallNode node;
-
-  ConnectionCall() {
-    this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Connection").getACall()
-  }
-
-  override DataFlow::CfgNode getContext() {
-    result.getNode() in [node.getArg(0), node.getArgByName("context")]
-  }
-}
-
 class ProtocolRestriction extends DataFlow::CfgNode {
   abstract DataFlow::CfgNode getContext();
 
   abstract string getRestriction();
 }
 
-class OptionsAugOr extends ProtocolRestriction {
-  string restriction;
-
-  OptionsAugOr() {
-    exists(AugAssign aa, AttrNode attr |
-      aa.getOperation().getOp() instanceof BitOr and
-      aa.getTarget() = attr.getNode() and
-      attr.getName() = "options" and
-      attr.getObject() = node and
-      aa.getValue() = API::moduleImport("ssl").getMember(restriction).getAUse().asExpr()
-    )
-  }
-
-  override DataFlow::CfgNode getContext() { result = this }
-
-  override string getRestriction() { result = restriction }
-}
-
-class SetOptionsCall extends ProtocolRestriction {
-  override CallNode node;
-
-  SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
-
-  override DataFlow::CfgNode getContext() {
-    result.getNode() = node.getFunction().(AttrNode).getObject()
-  }
-
-  override string getRestriction() {
-    API::moduleImport("PyOpenSSL").getMember("SSL").getMember(result).getAUse().asCfgNode() in [
-        node.getArg(0), node.getArgByName("options")
-      ]
-  }
-}
-
 abstract class TlsLibrary extends string {
-  TlsLibrary() { this in ["ssl"] }
+  TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
 
   abstract string specific_insecure_version_name();
 
@@ -160,85 +82,149 @@ abstract class TlsLibrary extends string {
     result.(ContextCreation).getProtocol() = unspecific_version()
   }
 
+  /** A connection is created in an outright insecure manner. */
+  abstract DataFlow::CfgNode insecure_connection_creation();
+
+  /** A connection is created from a context. */
   abstract ConnectionCreation connection_creation();
 
   abstract ProtocolRestriction protocol_restriction();
 }
 
-class Ssl extends TlsLibrary {
-  Ssl() { this = "ssl" }
+module ssl {
+  class SSLContextCreation extends ContextCreation {
+    override CallNode node;
+
+    SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
 
-  override string specific_insecure_version_name() {
-    result in [
-        "PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_TLSv1", "PROTOCOL_TLSv1_1"
-      ]
+    override DataFlow::CfgNode getProtocol() {
+      result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
+    }
   }
 
-  override string unspecific_version_name() { result = "PROTOCOL_TLS" }
+  class WrapSocketCall extends ConnectionCreation {
+    override CallNode node;
 
-  override API::Node version_constants() { result = API::moduleImport("ssl") }
+    WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
 
-  override DataFlow::CfgNode default_context_creation() {
-    result = API::moduleImport("ssl").getMember("create_default_context").getACall()
+    override DataFlow::CfgNode getContext() {
+      result.getNode() = node.getFunction().(AttrNode).getObject()
+    }
   }
 
-  override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
+  class OptionsAugOr extends ProtocolRestriction {
+    string restriction;
 
-  override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
+    OptionsAugOr() {
+      exists(AugAssign aa, AttrNode attr |
+        aa.getOperation().getOp() instanceof BitOr and
+        aa.getTarget() = attr.getNode() and
+        attr.getName() = "options" and
+        attr.getObject() = node and
+        aa.getValue() = API::moduleImport("ssl").getMember(restriction).getAUse().asExpr()
+      )
+    }
 
-  override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
-}
+    override DataFlow::CfgNode getContext() { result = this }
 
-class PyOpenSSL extends TlsLibrary {
-  PyOpenSSL() { this = "pyOpenSSL" }
-
-  override string specific_insecure_version_name() {
-    result in ["SSLv2_METHOD", "SSLv23_METHOD", "SSLv3_METHOD", "TLSv1_METHOD", "TLSv1_1_METHOD"]
+    override string getRestriction() { result = restriction }
   }
 
-  override string unspecific_version_name() { result = "TLS_METHOD" }
+  class Ssl extends TlsLibrary {
+    Ssl() { this = "ssl" }
 
-  override API::Node version_constants() {
-    result = API::moduleImport("pyOpenSSL").getMember("SSL")
-  }
+    override string specific_insecure_version_name() {
+      result in [
+          "PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_TLSv1",
+          "PROTOCOL_TLSv1_1"
+        ]
+    }
 
-  override DataFlow::CfgNode default_context_creation() { none() }
+    override string unspecific_version_name() { result = "PROTOCOL_TLS" }
 
-  override ContextCreation specific_context_creation() {
-    result instanceof PyOpenSSLContextCreation
-  }
+    override API::Node version_constants() { result = API::moduleImport("ssl") }
 
-  override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
+    override DataFlow::CfgNode default_context_creation() {
+      result = API::moduleImport("ssl").getMember("create_default_context").getACall()
+    }
 
-  override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
-}
+    override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
 
-module ssl {
-  string insecure_version_name() {
-    result = "PROTOCOL_SSLv2" or
-    result = "PROTOCOL_SSLv3" or
-    result = "PROTOCOL_SSLv23" or
-    result = "PROTOCOL_TLSv1" or
-    result = "PROTOCOL_TLSv1_1"
-  }
+    override DataFlow::CfgNode insecure_connection_creation() {
+      result = API::moduleImport("ssl").getMember("wrap_socket").getACall()
+    }
 
-  DataFlow::Node insecure_version() {
-    result = API::moduleImport("ssl").getMember(insecure_version_name()).getAUse()
+    override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
+
+    override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
   }
 }
 
 module pyOpenSSL {
-  string insecure_version_name() {
-    result = "SSLv2_METHOD" or
-    result = "SSLv23_METHOD" or
-    result = "SSLv3_METHOD" or
-    result = "TLSv1_METHOD" or
-    result = "TLSv1_1_METHOD"
+  class PyOpenSSLContextCreation extends ContextCreation {
+    override CallNode node;
+
+    PyOpenSSLContextCreation() {
+      this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Context").getACall()
+    }
+
+    override DataFlow::CfgNode getProtocol() {
+      result.getNode() in [node.getArg(0), node.getArgByName("method")]
+    }
   }
 
-  DataFlow::Node insecure_version() {
-    result =
-      API::moduleImport("pyOpenSSL").getMember("SSL").getMember(insecure_version_name()).getAUse()
+  class ConnectionCall extends ConnectionCreation {
+    override CallNode node;
+
+    ConnectionCall() {
+      this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Connection").getACall()
+    }
+
+    override DataFlow::CfgNode getContext() {
+      result.getNode() in [node.getArg(0), node.getArgByName("context")]
+    }
+  }
+
+  class SetOptionsCall extends ProtocolRestriction {
+    override CallNode node;
+
+    SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
+
+    override DataFlow::CfgNode getContext() {
+      result.getNode() = node.getFunction().(AttrNode).getObject()
+    }
+
+    override string getRestriction() {
+      API::moduleImport("PyOpenSSL").getMember("SSL").getMember(result).getAUse().asCfgNode() in [
+          node.getArg(0), node.getArgByName("options")
+        ]
+    }
+  }
+
+  class PyOpenSSL extends TlsLibrary {
+    PyOpenSSL() { this = "pyOpenSSL" }
+
+    override string specific_insecure_version_name() {
+      result in ["SSLv2_METHOD", "SSLv23_METHOD", "SSLv3_METHOD", "TLSv1_METHOD", "TLSv1_1_METHOD"]
+    }
+
+    override string unspecific_version_name() { result = "TLS_METHOD" }
+
+    override API::Node version_constants() {
+      result = API::moduleImport("pyOpenSSL").getMember("SSL")
+    }
+
+    override DataFlow::CfgNode default_context_creation() { none() }
+
+    override ContextCreation specific_context_creation() {
+      result instanceof PyOpenSSLContextCreation
+    }
+
+    override DataFlow::CfgNode insecure_connection_creation() { none() }
+
+    override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
+
+    override ProtocolRestriction protocol_restriction() { result instanceof SetOptionsCall }
   }
 }
 
@@ -278,129 +264,34 @@ class AllowsTLSv1_1 extends InsecureContextConfiguration {
   override string flag() { result = "OP_NO_TLSv1_1" }
 }
 
-predicate unsafe_connection_creation(DataFlow::Node node) {
-  exists(AllowsTLSv1 c | c.hasFlowTo(node)) or
-  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) //or
-  // node = API::moduleImport("ssl").getMember("wrap_socket").getACall()
-}
-
-predicate unsafe_context_creation(DataFlow::Node node) {
-  exists(TlsLibrary l | l.insecure_context_creation() = node)
-}
-
-// class InsecureTLSContextConfiguration extends DataFlow::Configuration {
-//   InsecureTLSContextConfiguration() { this in ["AllowsTLSv1", "AllowsTLSv1_1"] }
-//   override predicate isSource(DataFlow::Node source) {
-//     source instanceof InsecureSSLContextCreation
-//   }
-//   override predicate isSink(DataFlow::Node sink) { sink = any(WrapSocketCall c).getContext() }
-//   abstract string flag();
-//   override predicate isBarrierOut(DataFlow::Node node) {
-//     exists(AugAssign aa, AttrNode attr |
-//       aa.getOperation().getOp() instanceof BitOr and
-//       aa.getTarget() = attr.getNode() and
-//       attr.getName() = "options" and
-//       attr.getObject() = node.asCfgNode() and
-//       aa.getValue() = API::moduleImport("ssl").getMember(flag()).getAUse().asExpr()
-//     )
-//   }
-// }
-// class AllowsTLSv1 extends InsecureTLSContextConfiguration {
-//   AllowsTLSv1() { this = "AllowsTLSv1" }
-//   override string flag() { result = "OP_NO_TLSv1" }
-// }
-// class AllowsTLSv1_1 extends InsecureTLSContextConfiguration {
-//   AllowsTLSv1_1() { this = "AllowsTLSv1_1" }
-//   override string flag() { result = "OP_NO_TLSv1_1" }
-// }
-// predicate unsafe_wrap_socket_call(DataFlow::Node node) {
-//   exists(AllowsTLSv1 c | c.hasFlowTo(node)) or
-//   exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) or
-//   node = API::moduleImport("ssl").getMember("wrap_socket").getACall()
-// }
-private ModuleValue the_ssl_module() { result = Module::named("ssl") }
-
-FunctionValue ssl_wrap_socket() { result = the_ssl_module().attr("wrap_socket") }
-
-ClassValue ssl_Context_class() { result = the_ssl_module().attr("SSLContext") }
-
-private ModuleValue the_pyOpenSSL_module() { result = Value::named("pyOpenSSL.SSL") }
-
-ClassValue the_pyOpenSSL_Context_class() { result = Value::named("pyOpenSSL.SSL.Context") }
-
-// Since version 3.6, it is fine to call `ssl.SSLContext(protocol=PROTOCOL_TLS)`
-// if one also specifies either OP_NO_TLSv1 (introduced in 3.2)
-// or SSLContext.minimum_version other than TLSVersion.TLSv1 (introduced in 3.7)
-// See https://docs.python.org/3/library/ssl.html?highlight=ssl#ssl.SSLContext
-// and https://docs.python.org/3/library/ssl.html?highlight=ssl#protocol-versions
-// FP reported here: https://github.com/github/codeql/issues/2554
-// string insecure_version_name() {
-//   // For `pyOpenSSL.SSL`
-//   result = "SSLv2_METHOD" or
-//   result = "SSLv23_METHOD" or
-//   result = "SSLv3_METHOD" or
-//   result = "TLSv1_METHOD" or
-//   // For the `ssl` module
-//   result = "PROTOCOL_SSLv2" or
-//   result = "PROTOCOL_SSLv3" or
-//   result = "PROTOCOL_SSLv23" or
-//   result = "PROTOCOL_TLSv1"
-// }
-/*
- * A syntactic check for cases where points-to analysis cannot infer the presence of
- * a protocol constant, e.g. if it has been removed in later versions of the `ssl`
- * library.
- */
-
-bindingset[named_argument]
-predicate probable_insecure_ssl_constant(
-  CallNode call, string insecure_version, string named_argument
-) {
-  exists(ControlFlowNode arg |
-    arg = call.getArgByName(named_argument) or
-    arg = call.getArg(0)
-  |
-    arg.(AttrNode).getObject(insecure_version).pointsTo(the_ssl_module())
-    or
-    arg.(NameNode).getId() = insecure_version and
-    exists(Import imp |
-      imp.getAnImportedModuleName() = "ssl" and
-      imp.getAName().getAsname().(Name).getId() = insecure_version
-    )
-  )
+predicate unsafe_connection_creation(DataFlow::Node node, string insecure_version) {
+  exists(AllowsTLSv1 c | c.hasFlowTo(node)) and
+  insecure_version = "TLSv1"
+  or
+  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) and
+  insecure_version = "TLSv1"
+  or
+  exists(TlsLibrary l | l.insecure_connection_creation() = node) and
+  insecure_version = "[multiple]"
 }
 
-predicate unsafe_ssl_wrap_socket_call(
-  CallNode call, string method_name, string insecure_version, string named_argument
-) {
-  (
-    call = ssl_wrap_socket().getACall() and
-    method_name = "deprecated method ssl.wrap_socket" and
-    named_argument = "ssl_version"
-    or
-    call = ssl_Context_class().getACall() and
-    named_argument = "protocol" and
-    method_name = "ssl.SSLContext"
-  ) and
-  insecure_version = ssl::insecure_version_name() and
-  (
-    call.getArgByName(named_argument).pointsTo(the_ssl_module().attr(insecure_version))
-    or
-    probable_insecure_ssl_constant(call, insecure_version, named_argument)
+predicate unsafe_context_creation(DataFlow::Node node, string insecure_version) {
+  exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation() |
+    cc = node and insecure_version = cc.getProtocol().toString()
   )
 }
 
-predicate unsafe_pyOpenSSL_Context_call(CallNode call, string insecure_version) {
-  call = the_pyOpenSSL_Context_class().getACall() and
-  insecure_version = pyOpenSSL::insecure_version_name() and
-  call.getArg(0).pointsTo(the_pyOpenSSL_module().attr(insecure_version))
-}
-
-from CallNode call, string method_name, string insecure_version
+from DataFlow::Node node, string insecure_version
 where
-  unsafe_ssl_wrap_socket_call(call, method_name, insecure_version, _)
+  unsafe_connection_creation(node, insecure_version)
   or
-  unsafe_pyOpenSSL_Context_call(call, insecure_version) and method_name = "pyOpenSSL.SSL.Context"
-select call,
-  "Insecure SSL/TLS protocol version " + insecure_version + " specified in call to " + method_name +
-    "."
+  unsafe_context_creation(node, insecure_version)
+select node, "Insecure SSL/TLS protocol version " + insecure_version //+ " specified in call to " + method_name + "."
+// from CallNode call, string method_name, string insecure_version
+// where
+//   unsafe_ssl_wrap_socket_call(call, method_name, insecure_version, _)
+//   or
+//   unsafe_pyOpenSSL_Context_call(call, insecure_version) and method_name = "pyOpenSSL.SSL.Context"
+// select call,
+//   "Insecure SSL/TLS protocol version " + insecure_version + " specified in call to " + method_name +
+//     "."

From 186db7f43ec254792ca3b0ded440fd0a06080711 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 21 Feb 2021 12:07:48 +0100
Subject: [PATCH 015/433] Python: factor into modules and files

---
 .../src/Security/CWE-327/FluentApiModel.qll   |  54 ++++
 .../src/Security/CWE-327/InsecureProtocol.ql  | 268 +-----------------
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  |  73 +++++
 python/ql/src/Security/CWE-327/Ssl.qll        | 106 +++++++
 .../src/Security/CWE-327/TlsLibraryModel.qll  |  80 ++++++
 5 files changed, 315 insertions(+), 266 deletions(-)
 create mode 100644 python/ql/src/Security/CWE-327/FluentApiModel.qll
 create mode 100644 python/ql/src/Security/CWE-327/PyOpenSSL.qll
 create mode 100644 python/ql/src/Security/CWE-327/Ssl.qll
 create mode 100644 python/ql/src/Security/CWE-327/TlsLibraryModel.qll

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
new file mode 100644
index 000000000000..4c2278b86942
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -0,0 +1,54 @@
+import python
+import TlsLibraryModel
+
+class InsecureContextConfiguration extends DataFlow::Configuration {
+  TlsLibrary library;
+
+  InsecureContextConfiguration() { this = library + ["AllowsTLSv1", "AllowsTLSv1_1"] }
+
+  override predicate isSource(DataFlow::Node source) {
+    source = library.unspecific_context_creation()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = library.connection_creation().getContext()
+  }
+
+  abstract string flag();
+
+  override predicate isBarrierOut(DataFlow::Node node) {
+    exists(ProtocolRestriction r |
+      r = library.protocol_restriction() and
+      node = r.getContext() and
+      r.getRestriction() = flag()
+    )
+  }
+}
+
+class AllowsTLSv1 extends InsecureContextConfiguration {
+  AllowsTLSv1() { this = library + "AllowsTLSv1" }
+
+  override string flag() { result = "TLSv1" }
+}
+
+class AllowsTLSv1_1 extends InsecureContextConfiguration {
+  AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
+
+  override string flag() { result = "TLSv1_1" }
+}
+
+predicate unsafe_connection_creation(DataFlow::Node node, ProtocolVersion insecure_version) {
+  exists(AllowsTLSv1 c | c.hasFlowTo(node)) and
+  insecure_version = "TLSv1"
+  or
+  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) and
+  insecure_version = "TLSv1_1"
+  or
+  exists(TlsLibrary l | l.insecure_connection_creation(insecure_version) = node)
+}
+
+predicate unsafe_context_creation(DataFlow::Node node, string insecure_version) {
+  exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
+    cc = node
+  )
+}
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 81b3558907e3..b873e5f3ce8f 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -10,277 +10,13 @@
  */
 
 import python
-import semmle.python.ApiGraphs
+import FluentApiModel
 
+// string foo(ProtocolRestriction r) { result = r.getRestriction() }
 // The idea is to track flow from the creation of an insecure context to a use
 // such as `wrap_socket`. There should be a data-flow path for each insecure version
 // and each path should have a version specific sanitizer. This will allow fluent api
 // style code to block the paths one by one.
-//
-// class InsecureContextCreation extends DataFlow::CfgNode {
-//   override CallNode node;
-//   InsecureContextCreation() {
-//     this = API::moduleImport("ssl").getMember("SSLContext").getACall() and
-//     insecure_version().asCfgNode() in [node.getArg(0), node.getArgByName("protocol")]
-//   }
-// }
-// class InsecureSSLContextCreation extends DataFlow::CfgNode {
-//   override CallNode node;
-//   InsecureSSLContextCreation() {
-//     this = API::moduleImport("ssl").getMember("create_default_context").getACall()
-//     or
-//     this = API::moduleImport("ssl").getMember("SSLContext").getACall() and
-//     API::moduleImport("ssl").getMember("PROTOCOL_TLS").getAUse().asCfgNode() in [
-//         node.getArg(0), node.getArgByName("protocol")
-//       ]
-//   }
-// }
-abstract class ContextCreation extends DataFlow::CfgNode {
-  abstract DataFlow::CfgNode getProtocol();
-}
-
-abstract class ConnectionCreation extends DataFlow::CfgNode {
-  abstract DataFlow::CfgNode getContext();
-}
-
-class ProtocolRestriction extends DataFlow::CfgNode {
-  abstract DataFlow::CfgNode getContext();
-
-  abstract string getRestriction();
-}
-
-abstract class TlsLibrary extends string {
-  TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
-
-  abstract string specific_insecure_version_name();
-
-  abstract string unspecific_version_name();
-
-  abstract API::Node version_constants();
-
-  DataFlow::Node insecure_version() {
-    result = version_constants().getMember(specific_insecure_version_name()).getAUse()
-  }
-
-  DataFlow::Node unspecific_version() {
-    result = version_constants().getMember(unspecific_version_name()).getAUse()
-  }
-
-  abstract DataFlow::CfgNode default_context_creation();
-
-  abstract ContextCreation specific_context_creation();
-
-  ContextCreation insecure_context_creation() {
-    result = specific_context_creation() and
-    result.getProtocol() = insecure_version()
-  }
-
-  DataFlow::CfgNode unspecific_context_creation() {
-    result = default_context_creation()
-    or
-    result = specific_context_creation() and
-    result.(ContextCreation).getProtocol() = unspecific_version()
-  }
-
-  /** A connection is created in an outright insecure manner. */
-  abstract DataFlow::CfgNode insecure_connection_creation();
-
-  /** A connection is created from a context. */
-  abstract ConnectionCreation connection_creation();
-
-  abstract ProtocolRestriction protocol_restriction();
-}
-
-module ssl {
-  class SSLContextCreation extends ContextCreation {
-    override CallNode node;
-
-    SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
-
-    override DataFlow::CfgNode getProtocol() {
-      result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
-    }
-  }
-
-  class WrapSocketCall extends ConnectionCreation {
-    override CallNode node;
-
-    WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
-
-    override DataFlow::CfgNode getContext() {
-      result.getNode() = node.getFunction().(AttrNode).getObject()
-    }
-  }
-
-  class OptionsAugOr extends ProtocolRestriction {
-    string restriction;
-
-    OptionsAugOr() {
-      exists(AugAssign aa, AttrNode attr |
-        aa.getOperation().getOp() instanceof BitOr and
-        aa.getTarget() = attr.getNode() and
-        attr.getName() = "options" and
-        attr.getObject() = node and
-        aa.getValue() = API::moduleImport("ssl").getMember(restriction).getAUse().asExpr()
-      )
-    }
-
-    override DataFlow::CfgNode getContext() { result = this }
-
-    override string getRestriction() { result = restriction }
-  }
-
-  class Ssl extends TlsLibrary {
-    Ssl() { this = "ssl" }
-
-    override string specific_insecure_version_name() {
-      result in [
-          "PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_TLSv1",
-          "PROTOCOL_TLSv1_1"
-        ]
-    }
-
-    override string unspecific_version_name() { result = "PROTOCOL_TLS" }
-
-    override API::Node version_constants() { result = API::moduleImport("ssl") }
-
-    override DataFlow::CfgNode default_context_creation() {
-      result = API::moduleImport("ssl").getMember("create_default_context").getACall()
-    }
-
-    override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
-
-    override DataFlow::CfgNode insecure_connection_creation() {
-      result = API::moduleImport("ssl").getMember("wrap_socket").getACall()
-    }
-
-    override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
-
-    override ProtocolRestriction protocol_restriction() { result instanceof OptionsAugOr }
-  }
-}
-
-module pyOpenSSL {
-  class PyOpenSSLContextCreation extends ContextCreation {
-    override CallNode node;
-
-    PyOpenSSLContextCreation() {
-      this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Context").getACall()
-    }
-
-    override DataFlow::CfgNode getProtocol() {
-      result.getNode() in [node.getArg(0), node.getArgByName("method")]
-    }
-  }
-
-  class ConnectionCall extends ConnectionCreation {
-    override CallNode node;
-
-    ConnectionCall() {
-      this = API::moduleImport("pyOpenSSL").getMember("SSL").getMember("Connection").getACall()
-    }
-
-    override DataFlow::CfgNode getContext() {
-      result.getNode() in [node.getArg(0), node.getArgByName("context")]
-    }
-  }
-
-  class SetOptionsCall extends ProtocolRestriction {
-    override CallNode node;
-
-    SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
-
-    override DataFlow::CfgNode getContext() {
-      result.getNode() = node.getFunction().(AttrNode).getObject()
-    }
-
-    override string getRestriction() {
-      API::moduleImport("PyOpenSSL").getMember("SSL").getMember(result).getAUse().asCfgNode() in [
-          node.getArg(0), node.getArgByName("options")
-        ]
-    }
-  }
-
-  class PyOpenSSL extends TlsLibrary {
-    PyOpenSSL() { this = "pyOpenSSL" }
-
-    override string specific_insecure_version_name() {
-      result in ["SSLv2_METHOD", "SSLv23_METHOD", "SSLv3_METHOD", "TLSv1_METHOD", "TLSv1_1_METHOD"]
-    }
-
-    override string unspecific_version_name() { result = "TLS_METHOD" }
-
-    override API::Node version_constants() {
-      result = API::moduleImport("pyOpenSSL").getMember("SSL")
-    }
-
-    override DataFlow::CfgNode default_context_creation() { none() }
-
-    override ContextCreation specific_context_creation() {
-      result instanceof PyOpenSSLContextCreation
-    }
-
-    override DataFlow::CfgNode insecure_connection_creation() { none() }
-
-    override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
-
-    override ProtocolRestriction protocol_restriction() { result instanceof SetOptionsCall }
-  }
-}
-
-class InsecureContextConfiguration extends DataFlow::Configuration {
-  TlsLibrary library;
-
-  InsecureContextConfiguration() { this = library + ["AllowsTLSv1", "AllowsTLSv1_1"] }
-
-  override predicate isSource(DataFlow::Node source) {
-    source = library.unspecific_context_creation()
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink = library.connection_creation().getContext()
-  }
-
-  abstract string flag();
-
-  override predicate isBarrierOut(DataFlow::Node node) {
-    exists(ProtocolRestriction r |
-      r = library.protocol_restriction() and
-      node = r.getContext() and
-      r.getRestriction() = flag()
-    )
-  }
-}
-
-class AllowsTLSv1 extends InsecureContextConfiguration {
-  AllowsTLSv1() { this = library + "AllowsTLSv1" }
-
-  override string flag() { result = "OP_NO_TLSv1" }
-}
-
-class AllowsTLSv1_1 extends InsecureContextConfiguration {
-  AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
-
-  override string flag() { result = "OP_NO_TLSv1_1" }
-}
-
-predicate unsafe_connection_creation(DataFlow::Node node, string insecure_version) {
-  exists(AllowsTLSv1 c | c.hasFlowTo(node)) and
-  insecure_version = "TLSv1"
-  or
-  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) and
-  insecure_version = "TLSv1"
-  or
-  exists(TlsLibrary l | l.insecure_connection_creation() = node) and
-  insecure_version = "[multiple]"
-}
-
-predicate unsafe_context_creation(DataFlow::Node node, string insecure_version) {
-  exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation() |
-    cc = node and insecure_version = cc.getProtocol().toString()
-  )
-}
-
 from DataFlow::Node node, string insecure_version
 where
   unsafe_connection_creation(node, insecure_version)
diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
new file mode 100644
index 000000000000..b9a68648f935
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -0,0 +1,73 @@
+import python
+import semmle.python.ApiGraphs
+import TlsLibraryModel
+
+class PyOpenSSLContextCreation extends ContextCreation {
+  override CallNode node;
+
+  PyOpenSSLContextCreation() {
+    this = API::moduleImport("OpenSSL").getMember("SSL").getMember("Context").getACall()
+  }
+
+  override DataFlow::CfgNode getProtocol() {
+    result.getNode() in [node.getArg(0), node.getArgByName("method")]
+  }
+}
+
+class ConnectionCall extends ConnectionCreation {
+  override CallNode node;
+
+  ConnectionCall() {
+    this = API::moduleImport("OpenSSL").getMember("SSL").getMember("Connection").getACall()
+  }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() in [node.getArg(0), node.getArgByName("context")]
+  }
+}
+
+class SetOptionsCall extends ProtocolRestriction {
+  override CallNode node;
+
+  SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() = node.getFunction().(AttrNode).getObject()
+  }
+
+  override ProtocolVersion getRestriction() {
+    API::moduleImport("OpenSSL").getMember("SSL").getMember("OP_NO_" + result).getAUse().asCfgNode() in [
+        node.getArg(0), node.getArgByName("options")
+      ]
+  }
+}
+
+class PyOpenSSL extends TlsLibrary {
+  PyOpenSSL() { this = "pyOpenSSL" }
+
+  override string specific_insecure_version_name(ProtocolVersion version) {
+    version in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] and
+    result = version + "_METHOD"
+  }
+
+  override string unspecific_version_name() {
+    result in [
+        "TLS_METHOD", // This is not actually available in pyOpenSSL yet
+        "SSLv23_METHOD" // This is what can negotiate TLS 1.3 (indeed, I know, I did test that..)
+      ]
+  }
+
+  override API::Node version_constants() { result = API::moduleImport("OpenSSL").getMember("SSL") }
+
+  override DataFlow::CfgNode default_context_creation() { none() }
+
+  override ContextCreation specific_context_creation() {
+    result instanceof PyOpenSSLContextCreation
+  }
+
+  override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) { none() }
+
+  override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
+
+  override ProtocolRestriction protocol_restriction() { result instanceof SetOptionsCall }
+}
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
new file mode 100644
index 000000000000..369149fd6384
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -0,0 +1,106 @@
+import python
+import semmle.python.ApiGraphs
+import semmle.python.dataflow.new.internal.Attributes as Attributes
+import TlsLibraryModel
+
+class SSLContextCreation extends ContextCreation {
+  override CallNode node;
+
+  SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
+
+  override DataFlow::CfgNode getProtocol() {
+    result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
+  }
+}
+
+class WrapSocketCall extends ConnectionCreation {
+  override CallNode node;
+
+  WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
+
+  override DataFlow::CfgNode getContext() {
+    result.getNode() = node.getFunction().(AttrNode).getObject()
+  }
+}
+
+class OptionsAugOr extends ProtocolRestriction {
+  ProtocolVersion restriction;
+
+  OptionsAugOr() {
+    exists(AugAssign aa, AttrNode attr |
+      aa.getOperation().getOp() instanceof BitOr and
+      aa.getTarget() = attr.getNode() and
+      attr.getName() = "options" and
+      attr.getObject() = node and
+      API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() in [
+          aa.getValue(), aa.getValue().getAChildNode()
+        ]
+    )
+  }
+
+  override DataFlow::CfgNode getContext() { result = this }
+
+  override ProtocolVersion getRestriction() { result = restriction }
+}
+
+class ContextSetVersion extends ProtocolRestriction {
+  string restriction;
+
+  ContextSetVersion() {
+    exists(Attributes::AttrWrite aw |
+      aw.getObject().asCfgNode() = node and
+      aw.getAttributeName() = "minimum_version" and
+      aw.getValue() =
+        API::moduleImport("ssl").getMember("TLSVersion").getMember(restriction).getAUse()
+    )
+  }
+
+  override DataFlow::CfgNode getContext() { result = this }
+
+  override ProtocolVersion getRestriction() { result.lessThan(restriction) }
+}
+
+class Ssl extends TlsLibrary {
+  Ssl() { this = "ssl" }
+
+  override string specific_insecure_version_name(ProtocolVersion version) {
+    version in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] and
+    result = "PROTOCOL_" + version
+    // result in ["PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_TLSv1", "PROTOCOL_TLSv1_1"]
+  }
+
+  override string unspecific_version_name() {
+    result =
+      "PROTOCOL_" +
+        [
+          "TLS",
+          // This can negotiate a TLS 1.3 connection (!)
+          // see https://docs.python.org/3/library/ssl.html#ssl-contexts
+          "SSLv23"
+        ]
+  }
+
+  override API::Node version_constants() { result = API::moduleImport("ssl") }
+
+  override DataFlow::CfgNode default_context_creation() {
+    result = API::moduleImport("ssl").getMember("create_default_context").getACall() //and
+    // see https://docs.python.org/3/library/ssl.html#context-creation
+    // version in ["TLSv1", "TLSv1_1"]
+  }
+
+  override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
+
+  override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) {
+    result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
+    insecure_version(version).asCfgNode() =
+      result.asCfgNode().(CallNode).getArgByName("ssl_version")
+  }
+
+  override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
+
+  override ProtocolRestriction protocol_restriction() {
+    result instanceof OptionsAugOr
+    or
+    result instanceof ContextSetVersion
+  }
+}
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
new file mode 100644
index 000000000000..41db81ad1c80
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -0,0 +1,80 @@
+import python
+import semmle.python.ApiGraphs
+import Ssl
+import PyOpenSSL
+
+/**
+ * A specific protocol version.
+ * We use this to identify a protocol.
+ */
+class ProtocolVersion extends string {
+  ProtocolVersion() { this in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"] }
+
+  predicate lessThan(ProtocolVersion version) {
+    this = "SSLv2" and version = "SSLv3"
+    or
+    this = "TLSv1" and version = ["TLSv1_1", "TLSv1_2", "TLSv1_3"]
+    or
+    this = ["TLSv1", "TLSv1_1"] and version = ["TLSv1_2", "TLSv1_3"]
+    or
+    this = ["TLSv1", "TLSv1_1", "TLSv1_2"] and version = "TLSv1_3"
+  }
+}
+
+abstract class ContextCreation extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getProtocol();
+}
+
+abstract class ConnectionCreation extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getContext();
+}
+
+abstract class ProtocolRestriction extends DataFlow::CfgNode {
+  abstract DataFlow::CfgNode getContext();
+
+  abstract ProtocolVersion getRestriction();
+}
+
+abstract class TlsLibrary extends string {
+  TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
+
+  /** The name of a specific protocol version, known to be insecure. */
+  abstract string specific_insecure_version_name(ProtocolVersion version);
+
+  /** The name of an unspecific protocol version, say TLS, known to have insecure insatnces. */
+  abstract string unspecific_version_name();
+
+  abstract API::Node version_constants();
+
+  DataFlow::Node insecure_version(ProtocolVersion version) {
+    result = version_constants().getMember(specific_insecure_version_name(version)).getAUse()
+  }
+
+  DataFlow::Node unspecific_version() {
+    result = version_constants().getMember(unspecific_version_name()).getAUse()
+  }
+
+  abstract DataFlow::CfgNode default_context_creation();
+
+  abstract ContextCreation specific_context_creation();
+
+  ContextCreation insecure_context_creation(ProtocolVersion version) {
+    result = specific_context_creation() and
+    result.getProtocol() = insecure_version(version)
+  }
+
+  DataFlow::CfgNode unspecific_context_creation() {
+    result = default_context_creation()
+    or
+    result = specific_context_creation() and
+    result.(ContextCreation).getProtocol() = unspecific_version()
+  }
+
+  /** A connection is created in an outright insecure manner. */
+  abstract DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version);
+
+  /** A connection is created from a context. */
+  abstract ConnectionCreation connection_creation();
+
+  abstract ProtocolRestriction protocol_restriction();
+}

From 87e1a062ea750a3b2acc95d75583099c055defe9 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 21 Feb 2021 12:08:11 +0100
Subject: [PATCH 016/433] Python: fluent api tests

---
 .../Security/CWE-327/pyOpenSSL_fluent.py      | 31 +++++++
 .../Security/CWE-327/ssl_fluent.py            | 87 +++++++++++++++++++
 2 files changed, 118 insertions(+)
 create mode 100644 python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
 create mode 100644 python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py

diff --git a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
new file mode 100644
index 000000000000..028c318be668
--- /dev/null
+++ b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
@@ -0,0 +1,31 @@
+import socket
+from OpenSSL import SSL
+
+def test_fluent():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(conn.get_protocol_version_name())
+
+
+def test_fluent_no_TLSv1():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+    context.set_options(SSL.OP_NO_TLSv1)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(conn.get_protocol_version_name())
+
+
+def test_fluent_safe():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+    context.set_options(SSL.OP_NO_TLSv1)
+    context.set_options(SSL.OP_NO_TLSv1_1)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(r, conn.get_protocol_version_name())
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
new file mode 100644
index 000000000000..9f9e01294cb5
--- /dev/null
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -0,0 +1,87 @@
+import socket
+import ssl
+
+def test_fluent_tls():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+
+def test_fluent_tls_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_tls_safe():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.options |= ssl.OP_NO_TLSv1
+    context.options |= ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+
+def test_fluent_ssl_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1
+    context.options |= ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe_combined():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+# From Python 3.7
+# see https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
+def test_fluent_ssl_unsafe_version():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.minimum_version = ssl.TLSVersion.TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe_version():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.minimum_version = ssl.TLSVersion.TLSv1_3
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())

From ea8c6f04e2ba137b6501152f22b93f642e17b372 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 21 Feb 2021 12:09:56 +0100
Subject: [PATCH 017/433] Python: Update old test and qlhelp

---
 .../Security/CWE-327/InsecureProtocol.qhelp   |  6 ++---
 python/ql/src/Security/CWE-327/ReadMe.md      | 24 +++++++++++++++++++
 .../Security/CWE-327/InsecureProtocol.py      |  8 +++----
 3 files changed, 31 insertions(+), 7 deletions(-)
 create mode 100644 python/ql/src/Security/CWE-327/ReadMe.md

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
index 63545129cc79..4a7364ca14e2 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
@@ -13,8 +13,8 @@
 
           <p>
             Ensure that a modern, strong protocol is used. All versions of SSL,
-            and TLS 1.0 are known to be vulnerable to attacks. Using TLS 1.1 or
-            above is strongly recommended.
+            and TLS versions 1.0 and 1.1 are known to be vulnerable to attacks.
+            Using TLS 1.2 or above is strongly recommended.
           </p>
 
      </recommendation>
@@ -30,7 +30,7 @@
 
           <p>
             All cases should be updated to use a secure protocol, such as
-            <code>PROTOCOL_TLSv1_1</code>.
+            <code>PROTOCOL_TLSv1_2</code>.
           </p>
           <p>
             Note that <code>ssl.wrap_socket</code> has been deprecated in
diff --git a/python/ql/src/Security/CWE-327/ReadMe.md b/python/ql/src/Security/CWE-327/ReadMe.md
new file mode 100644
index 000000000000..c5330a78fda9
--- /dev/null
+++ b/python/ql/src/Security/CWE-327/ReadMe.md
@@ -0,0 +1,24 @@
+# Current status (Feb 2021)
+
+This should be kept up to date; the world is moving fast and protocols are being broken.
+
+## Protocols
+
+- All versions of SSL are insecure
+- TLS 1.0 and TLS 1.1 are insecure
+- TLS 1.2 have some issues. but TLS 1.3 is not widely supported
+
+## Conection methods
+
+- `ssl.wrap_socket` is creating insecure connections, use `SSLContext.wrap_socket` instead. [link](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)
+    > Deprecated since version 3.7: Since Python 3.2 and 2.7.9, it is recommended to use the `SSLContext.wrap_socket()` instead of `wrap_socket()`. The top-level function is limited and creates an insecure client socket without server name indication or hostname matching.
+- Default consteructors are fine, a sluent api is used to constrain possible protocols later.
+
+## Current recomendation
+
+TLS 1.2 or TLS 1.3
+
+## Queries
+
+- `InsecureProtocol` detects uses of insecure protocols.
+- `InsecureDefaultProtocol` detect default constructions, this is no longer unsafe.
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
index 5a6d044aa6de..cb21a6623c9e 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
@@ -1,5 +1,5 @@
 import ssl
-from pyOpenSSL import SSL
+from OpenSSL import SSL
 from ssl import SSLContext
 
 # true positives
@@ -33,9 +33,9 @@
 
 # secure versions
 
-ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_1)
-SSLContext(protocol=ssl.PROTOCOL_TLSv1_1)
-SSL.Context(SSL.TLSv1_1_METHOD)
+ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_2)
+SSLContext(protocol=ssl.PROTOCOL_TLSv1_2)
+SSL.Context(SSL.TLSv1_2_METHOD)
 
 # possibly insecure default
 ssl.wrap_socket()

From 3b856010f28ade83481b3e9fe553c4bb56f0f432 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 23 Feb 2021 19:29:30 +0100
Subject: [PATCH 018/433] Python: add TODO comment

---
 python/ql/src/Security/CWE-327/Ssl.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 369149fd6384..e3247d5143c3 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -32,6 +32,7 @@ class OptionsAugOr extends ProtocolRestriction {
       aa.getTarget() = attr.getNode() and
       attr.getName() = "options" and
       attr.getObject() = node and
+      // TODO: Use something like BoolExpr::impliesValue here
       API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() in [
           aa.getValue(), aa.getValue().getAChildNode()
         ]

From d5171fc043cd4a66372780bcbe5c758cd7c594e2 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Feb 2021 21:12:34 +0100
Subject: [PATCH 019/433] Python: Comment everything

---
 .../src/Security/CWE-327/FluentApiModel.qll   | 15 +++++++++++++
 .../src/Security/CWE-327/InsecureProtocol.ql  | 13 ------------
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  |  2 +-
 python/ql/src/Security/CWE-327/Ssl.qll        | 17 ++++++++++-----
 .../src/Security/CWE-327/TlsLibraryModel.qll  | 21 ++++++++++++++++---
 5 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 4c2278b86942..3dc12e2f434b 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -1,6 +1,11 @@
 import python
 import TlsLibraryModel
 
+/**
+ * Configuration to track flow from the creation of a context to
+ * that context being used to create a connection.
+ * Flow is broken if the insecure protocol of interest is being restricted.
+ */
 class InsecureContextConfiguration extends DataFlow::Configuration {
   TlsLibrary library;
 
@@ -25,28 +30,38 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
   }
 }
 
+/** Configuration to specifically track the insecure protocol TLS 1.0 */
 class AllowsTLSv1 extends InsecureContextConfiguration {
   AllowsTLSv1() { this = library + "AllowsTLSv1" }
 
   override string flag() { result = "TLSv1" }
 }
 
+/** Configuration to specifically track the insecure protocol TLS 1.1 */
 class AllowsTLSv1_1 extends InsecureContextConfiguration {
   AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
 
   override string flag() { result = "TLSv1_1" }
 }
 
+/**
+ * A connection is created from a context allowing an insecure protocol,
+ * and that protocol has not been restricted appropriately.
+ */
 predicate unsafe_connection_creation(DataFlow::Node node, ProtocolVersion insecure_version) {
+  // Connection created from a context allowing TLS 1.0.
   exists(AllowsTLSv1 c | c.hasFlowTo(node)) and
   insecure_version = "TLSv1"
   or
+  // Connection created from a context allowing TLS 1.1.
   exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) and
   insecure_version = "TLSv1_1"
   or
+  // Connection created from a context for an insecure protocol.
   exists(TlsLibrary l | l.insecure_connection_creation(insecure_version) = node)
 }
 
+/** A connection is created insecurely without reference to a context. */
 predicate unsafe_context_creation(DataFlow::Node node, string insecure_version) {
   exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
     cc = node
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index b873e5f3ce8f..c902d9a284d4 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -12,22 +12,9 @@
 import python
 import FluentApiModel
 
-// string foo(ProtocolRestriction r) { result = r.getRestriction() }
-// The idea is to track flow from the creation of an insecure context to a use
-// such as `wrap_socket`. There should be a data-flow path for each insecure version
-// and each path should have a version specific sanitizer. This will allow fluent api
-// style code to block the paths one by one.
 from DataFlow::Node node, string insecure_version
 where
   unsafe_connection_creation(node, insecure_version)
   or
   unsafe_context_creation(node, insecure_version)
 select node, "Insecure SSL/TLS protocol version " + insecure_version //+ " specified in call to " + method_name + "."
-// from CallNode call, string method_name, string insecure_version
-// where
-//   unsafe_ssl_wrap_socket_call(call, method_name, insecure_version, _)
-//   or
-//   unsafe_pyOpenSSL_Context_call(call, insecure_version) and method_name = "pyOpenSSL.SSL.Context"
-// select call,
-//   "Insecure SSL/TLS protocol version " + insecure_version + " specified in call to " + method_name +
-//     "."
diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index b9a68648f935..a89c7ff08867 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -59,7 +59,7 @@ class PyOpenSSL extends TlsLibrary {
 
   override API::Node version_constants() { result = API::moduleImport("OpenSSL").getMember("SSL") }
 
-  override DataFlow::CfgNode default_context_creation() { none() }
+  override ContextCreation default_context_creation() { none() }
 
   override ContextCreation specific_context_creation() {
     result instanceof PyOpenSSLContextCreation
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index e3247d5143c3..ba91b39bdeb4 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -13,6 +13,16 @@ class SSLContextCreation extends ContextCreation {
   }
 }
 
+class SSLDefaultContextCreation extends ContextCreation {
+  SSLDefaultContextCreation() {
+    this = API::moduleImport("ssl").getMember("create_default_context").getACall()
+  }
+
+  // Allowed insecure versions are "TLSv1" and "TLSv1_1"
+  // see https://docs.python.org/3/library/ssl.html#context-creation
+  override DataFlow::CfgNode getProtocol() { none() }
+}
+
 class WrapSocketCall extends ConnectionCreation {
   override CallNode node;
 
@@ -67,7 +77,6 @@ class Ssl extends TlsLibrary {
   override string specific_insecure_version_name(ProtocolVersion version) {
     version in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] and
     result = "PROTOCOL_" + version
-    // result in ["PROTOCOL_SSLv2", "PROTOCOL_SSLv3", "PROTOCOL_TLSv1", "PROTOCOL_TLSv1_1"]
   }
 
   override string unspecific_version_name() {
@@ -83,10 +92,8 @@ class Ssl extends TlsLibrary {
 
   override API::Node version_constants() { result = API::moduleImport("ssl") }
 
-  override DataFlow::CfgNode default_context_creation() {
-    result = API::moduleImport("ssl").getMember("create_default_context").getACall() //and
-    // see https://docs.python.org/3/library/ssl.html#context-creation
-    // version in ["TLSv1", "TLSv1_1"]
+  override ContextCreation default_context_creation() {
+    result instanceof SSLDefaultContextCreation
   }
 
   override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 41db81ad1c80..36e58acd9266 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -21,17 +21,24 @@ class ProtocolVersion extends string {
   }
 }
 
+/** The creation of a context. */
 abstract class ContextCreation extends DataFlow::CfgNode {
+  /** Gets the requested protocol if any. */
   abstract DataFlow::CfgNode getProtocol();
 }
 
+/** The creation of a connection from a context. */
 abstract class ConnectionCreation extends DataFlow::CfgNode {
+  /** Gets the context used to create the connection. */
   abstract DataFlow::CfgNode getContext();
 }
 
+/** A context is being restricted on which protocols it can accepts. */
 abstract class ProtocolRestriction extends DataFlow::CfgNode {
+  /** Gets the context being restricted. */
   abstract DataFlow::CfgNode getContext();
 
+  /** Gets the protocol version being disallowed. */
   abstract ProtocolVersion getRestriction();
 }
 
@@ -41,28 +48,35 @@ abstract class TlsLibrary extends string {
   /** The name of a specific protocol version, known to be insecure. */
   abstract string specific_insecure_version_name(ProtocolVersion version);
 
-  /** The name of an unspecific protocol version, say TLS, known to have insecure insatnces. */
+  /** The name of an unspecific protocol version, say TLS, known to have insecure instances. */
   abstract string unspecific_version_name();
 
+  /** The module or class holding the version constants. */
   abstract API::Node version_constants();
 
+  /** A dataflow node representing a specific protocol version, known to be insecure. */
   DataFlow::Node insecure_version(ProtocolVersion version) {
     result = version_constants().getMember(specific_insecure_version_name(version)).getAUse()
   }
 
+  /** A dataflow node representing an unspecific protocol version, say TLS, known to have insecure instances. */
   DataFlow::Node unspecific_version() {
     result = version_constants().getMember(unspecific_version_name()).getAUse()
   }
 
-  abstract DataFlow::CfgNode default_context_creation();
+  /** The creation of a context with a deafult protocol. */
+  abstract ContextCreation default_context_creation();
 
+  /** The creation of a context with a specific protocol. */
   abstract ContextCreation specific_context_creation();
 
+  /** The creation of a context with a specific protocol version, known to be insecure. */
   ContextCreation insecure_context_creation(ProtocolVersion version) {
     result = specific_context_creation() and
     result.getProtocol() = insecure_version(version)
   }
 
+  /** The creation of a context with an unspecific protocol version, say TLS, known to have insecure instances. */
   DataFlow::CfgNode unspecific_context_creation() {
     result = default_context_creation()
     or
@@ -70,11 +84,12 @@ abstract class TlsLibrary extends string {
     result.(ContextCreation).getProtocol() = unspecific_version()
   }
 
-  /** A connection is created in an outright insecure manner. */
+  /** A connection is created in an insecure manner, not from a context. */
   abstract DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version);
 
   /** A connection is created from a context. */
   abstract ConnectionCreation connection_creation();
 
+  /** A context is being restricted on which protocols it can accepts. */
   abstract ProtocolRestriction protocol_restriction();
 }

From 9e696ff0fbaac008a12bfa1a7241a0f0140bbc9d Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Feb 2021 21:58:00 +0100
Subject: [PATCH 020/433] Python: Add false negative to test

---
 .../ql/test/query-tests/Security/CWE-327/ssl_fluent.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index 9f9e01294cb5..252ab0a9e49a 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -85,3 +85,13 @@ def test_fluent_ssl_safe_version():
     with socket.create_connection((hostname, 443)) as sock:
         with context.wrap_socket(sock, server_hostname=hostname) as ssock:
             print(ssock.version())
+
+# Taken from https://docs.python.org/3/library/ssl.html#context-creation
+def test_fluent_explicitly_unsafe():
+    hostname = 'www.python.org'
+    context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+    context.options &= ~ssl.OP_NO_SSLv3  # This not recognized
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:  # SSLv3 not flagged here
+            print(ssock.version())

From 60525ec3018924898d47d72d133cb0b1431a2bea Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Feb 2021 21:58:30 +0100
Subject: [PATCH 021/433] Python: Also track offending call update test
 expectations at this point

---
 .../src/Security/CWE-327/FluentApiModel.qll   | 20 +++++++---
 .../src/Security/CWE-327/InsecureProtocol.ql  | 16 ++++++--
 .../CWE-327/InsecureProtocol.expected         | 38 ++++++++++++-------
 3 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 3dc12e2f434b..23922a905950 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -48,22 +48,30 @@ class AllowsTLSv1_1 extends InsecureContextConfiguration {
  * A connection is created from a context allowing an insecure protocol,
  * and that protocol has not been restricted appropriately.
  */
-predicate unsafe_connection_creation(DataFlow::Node node, ProtocolVersion insecure_version) {
+predicate unsafe_connection_creation(
+  DataFlow::Node node, ProtocolVersion insecure_version, CallNode call
+) {
   // Connection created from a context allowing TLS 1.0.
-  exists(AllowsTLSv1 c | c.hasFlowTo(node)) and
+  exists(AllowsTLSv1 c, ContextCreation cc | c.hasFlow(cc, node) | cc.getNode() = call) and
   insecure_version = "TLSv1"
   or
   // Connection created from a context allowing TLS 1.1.
-  exists(AllowsTLSv1_1 c | c.hasFlowTo(node)) and
+  exists(AllowsTLSv1_1 c, ContextCreation cc | c.hasFlow(cc, node) | cc.getNode() = call) and
   insecure_version = "TLSv1_1"
   or
   // Connection created from a context for an insecure protocol.
-  exists(TlsLibrary l | l.insecure_connection_creation(insecure_version) = node)
+  exists(TlsLibrary l, DataFlow::CfgNode cc |
+    cc = l.insecure_connection_creation(insecure_version)
+  |
+    cc = node and
+    cc.getNode() = call
+  )
 }
 
 /** A connection is created insecurely without reference to a context. */
-predicate unsafe_context_creation(DataFlow::Node node, string insecure_version) {
+predicate unsafe_context_creation(DataFlow::Node node, string insecure_version, CallNode call) {
   exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
-    cc = node
+    cc = node and
+    cc.getNode() = call
   )
 }
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index c902d9a284d4..51247dbd75aa 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -12,9 +12,17 @@
 import python
 import FluentApiModel
 
-from DataFlow::Node node, string insecure_version
+string callName(AstNode call) {
+  result = call.(Name).getId()
+  or
+  exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())
+}
+
+from DataFlow::Node node, string insecure_version, CallNode call
 where
-  unsafe_connection_creation(node, insecure_version)
+  unsafe_connection_creation(node, insecure_version, call)
   or
-  unsafe_context_creation(node, insecure_version)
-select node, "Insecure SSL/TLS protocol version " + insecure_version //+ " specified in call to " + method_name + "."
+  unsafe_context_creation(node, insecure_version, call)
+select node, "Insecure SSL/TLS protocol version " + insecure_version + " specified in $@ ", call,
+  "call to " + callName(call.getFunction().getNode())
+//+ " specified in call to " + method_name + "."
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index 33542e4a048e..7b646f9fd3e8 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -1,14 +1,24 @@
-| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to deprecated method ssl.wrap_socket. |
-| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv3 specified in call to deprecated method ssl.wrap_socket. |
-| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_TLSv1 specified in call to deprecated method ssl.wrap_socket. |
-| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to ssl.SSLContext. |
-| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv3 specified in call to ssl.SSLContext. |
-| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_TLSv1 specified in call to ssl.SSLContext. |
-| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2_METHOD specified in call to pyOpenSSL.SSL.Context. |
-| InsecureProtocol.py:15:1:15:30 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv23_METHOD specified in call to pyOpenSSL.SSL.Context. |
-| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3_METHOD specified in call to pyOpenSSL.SSL.Context. |
-| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1_METHOD specified in call to pyOpenSSL.SSL.Context. |
-| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2_METHOD specified in call to pyOpenSSL.SSL.Context. |
-| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to deprecated method ssl.wrap_socket. |
-| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to ssl.SSLContext. |
-| InsecureProtocol.py:52:1:52:33 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv23_METHOD specified in call to ssl.SSLContext. |
+| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | call to SSLContext |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:47:14:47:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:43:15:43:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:73:15:73:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:96:14:96:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:92:15:92:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:96:14:96:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:92:15:92:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |

From 7a1d953fcac8d159440345dd26dd13b4136f1481 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 2 Mar 2021 22:46:01 +0100
Subject: [PATCH 022/433] Python: More tests

---
 .../CWE-327/InsecureProtocol.expected         | 14 ++-
 .../Security/CWE-327/ssl_fluent.py            | 96 +++++++++++++++++++
 2 files changed, 107 insertions(+), 3 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index 7b646f9fd3e8..e116662ce659 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -19,6 +19,14 @@
 | ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:47:14:47:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:43:15:43:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:73:15:73:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:96:14:96:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:92:15:92:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
-| ssl_fluent.py:96:14:96:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:92:15:92:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:173:14:173:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:169:15:169:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index 252ab0a9e49a..eceacaebe215 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -66,6 +66,102 @@ def test_fluent_ssl_safe_combined():
         with context.wrap_socket(sock, server_hostname=hostname) as ssock:
             print(ssock.version())
 
+def test_fluent_ssl_unsafe_combined_wrongly():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 & ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe_combined_multiple():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1_2
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+
+def create_relaxed_context():
+    return ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+
+def create_secure_context():
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    return context
+
+def create_connection(context):
+    with socket.create_connection(('www.python.org', 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_delegated_context_unsafe():
+    context = create_relaxed_context()
+    with socket.create_connection(('www.python.org', 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_delegated_context_safe():
+    context = create_secure_context()
+    with socket.create_connection(('www.python.org', 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_delegated_context_made_safe():
+    context = create_relaxed_context()
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    with socket.create_connection(('www.python.org', 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_delegated_context_made_unsafe():
+    context = create_secure_context()
+    context.options &= ~ssl.OP_NO_TLSv1_1
+    with socket.create_connection(('www.python.org', 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_delegated_connection_unsafe():
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    create_connection(context)
+
+def test_delegated_connection_safe():
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    create_connection(context)
+
+def test_delegated_connection_made_safe():
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    create_connection(context)
+
+def test_delegated_connection_made_unsafe():
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    context.options &= ~ssl.OP_NO_TLSv1_1
+    create_connection(context)
+
+def test_delegated_unsafe():
+    context = create_relaxed_context()
+    create_connection(context)
+
+def test_delegated_safe():
+    context = create_secure_context()
+    create_connection(context)
+
+def test_delegated_made_safe():
+    context = create_relaxed_context()
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    create_connection(context)
+
+def test_delegated_made_unsafe():
+    context = create_secure_context()
+    context.options &= ~ssl.OP_NO_TLSv1_1
+    create_connection(context)
+
 # From Python 3.7
 # see https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
 def test_fluent_ssl_unsafe_version():

From 97d26687fed6b102c0c2be075ec6a0350a9ef246 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 1 Mar 2021 15:04:48 +0100
Subject: [PATCH 023/433] Python: Improve logic of bit fields

---
 python/ql/src/Security/CWE-327/Ssl.qll | 31 +++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index ba91b39bdeb4..4caa0ae7302e 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -37,15 +37,17 @@ class OptionsAugOr extends ProtocolRestriction {
   ProtocolVersion restriction;
 
   OptionsAugOr() {
-    exists(AugAssign aa, AttrNode attr |
+    exists(AugAssign aa, AttrNode attr, Expr flag |
       aa.getOperation().getOp() instanceof BitOr and
       aa.getTarget() = attr.getNode() and
       attr.getName() = "options" and
       attr.getObject() = node and
-      // TODO: Use something like BoolExpr::impliesValue here
-      API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() in [
-          aa.getValue(), aa.getValue().getAChildNode()
-        ]
+      flag = API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() and
+      (
+        aa.getValue() = flag
+        or
+        impliesValue(aa.getValue(), flag, false, false)
+      )
     )
   }
 
@@ -54,6 +56,25 @@ class OptionsAugOr extends ProtocolRestriction {
   override ProtocolVersion getRestriction() { result = restriction }
 }
 
+/** Whether `part` evaluates to `partIsTrue` if `whole` evaluates to `wholeIsTrue`. */
+predicate impliesValue(BinaryExpr whole, Expr part, boolean partIsTrue, boolean wholeIsTrue) {
+  whole.getOp() instanceof BitAnd and
+  (
+    wholeIsTrue = true and partIsTrue = true and part in [whole.getLeft(), whole.getRight()]
+    or
+    wholeIsTrue = true and
+    impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
+  )
+  or
+  whole.getOp() instanceof BitOr and
+  (
+    wholeIsTrue = false and partIsTrue = false and part in [whole.getLeft(), whole.getRight()]
+    or
+    wholeIsTrue = false and
+    impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
+  )
+}
+
 class ContextSetVersion extends ProtocolRestriction {
   string restriction;
 

From cbbc7b2bcd160bdfc268252644f35daf4c1bcfd9 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 3 Mar 2021 23:42:48 +0100
Subject: [PATCH 024/433] Python: support unrestrictions Also pyOpenSSL allows
 SSL 2 and SSL 3 on `SSLv23`

---
 .../src/Security/CWE-327/FluentApiModel.qll   | 62 ++++++++--------
 .../src/Security/CWE-327/InsecureProtocol.ql  | 26 +++++--
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  | 18 +++--
 python/ql/src/Security/CWE-327/Ssl.qll        | 63 ++++++++++++----
 .../src/Security/CWE-327/TlsLibraryModel.qll  | 48 +++++++++++--
 .../CWE-327/InsecureProtocol.expected         | 72 ++++++++++---------
 6 files changed, 200 insertions(+), 89 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 23922a905950..d222af704997 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -8,40 +8,44 @@ import TlsLibraryModel
  */
 class InsecureContextConfiguration extends DataFlow::Configuration {
   TlsLibrary library;
+  ProtocolVersion tracked_version;
 
-  InsecureContextConfiguration() { this = library + ["AllowsTLSv1", "AllowsTLSv1_1"] }
+  InsecureContextConfiguration() {
+    this = library + "Allows" + tracked_version and
+    tracked_version.isInsecure()
+  }
+
+  ProtocolVersion getTrackedVersion() { result = tracked_version }
 
   override predicate isSource(DataFlow::Node source) {
-    source = library.unspecific_context_creation()
+    // source = library.unspecific_context_creation()
+    exists(ProtocolUnrestriction pu |
+      pu = library.protocol_unrestriction() and
+      pu.getUnrestriction() = tracked_version
+    |
+      source = pu.getContext()
+    )
   }
 
   override predicate isSink(DataFlow::Node sink) {
     sink = library.connection_creation().getContext()
   }
 
-  abstract string flag();
-
   override predicate isBarrierOut(DataFlow::Node node) {
     exists(ProtocolRestriction r |
       r = library.protocol_restriction() and
       node = r.getContext() and
-      r.getRestriction() = flag()
+      r.getRestriction() = tracked_version
     )
   }
-}
-
-/** Configuration to specifically track the insecure protocol TLS 1.0 */
-class AllowsTLSv1 extends InsecureContextConfiguration {
-  AllowsTLSv1() { this = library + "AllowsTLSv1" }
-
-  override string flag() { result = "TLSv1" }
-}
 
-/** Configuration to specifically track the insecure protocol TLS 1.1 */
-class AllowsTLSv1_1 extends InsecureContextConfiguration {
-  AllowsTLSv1_1() { this = library + "AllowsTLSv1_1" }
-
-  override string flag() { result = "TLSv1_1" }
+  override predicate isBarrierIn(DataFlow::Node node) {
+    exists(ProtocolUnrestriction r |
+      r = library.protocol_unrestriction() and
+      node = r.getContext() and
+      r.getUnrestriction() = tracked_version
+    )
+  }
 }
 
 /**
@@ -49,22 +53,22 @@ class AllowsTLSv1_1 extends InsecureContextConfiguration {
  * and that protocol has not been restricted appropriately.
  */
 predicate unsafe_connection_creation(
-  DataFlow::Node node, ProtocolVersion insecure_version, CallNode call
+  DataFlow::Node creation, ProtocolVersion insecure_version, DataFlow::Node source, boolean specific
 ) {
-  // Connection created from a context allowing TLS 1.0.
-  exists(AllowsTLSv1 c, ContextCreation cc | c.hasFlow(cc, node) | cc.getNode() = call) and
-  insecure_version = "TLSv1"
-  or
-  // Connection created from a context allowing TLS 1.1.
-  exists(AllowsTLSv1_1 c, ContextCreation cc | c.hasFlow(cc, node) | cc.getNode() = call) and
-  insecure_version = "TLSv1_1"
+  // Connection created from a context allowing `insecure_version`.
+  exists(InsecureContextConfiguration c, ProtocolUnrestriction cc | c.hasFlow(cc, creation) |
+    insecure_version = c.getTrackedVersion() and
+    source = cc and
+    specific = false
+  )
   or
-  // Connection created from a context for an insecure protocol.
+  // Connection created from a context specifying `insecure_version`.
   exists(TlsLibrary l, DataFlow::CfgNode cc |
     cc = l.insecure_connection_creation(insecure_version)
   |
-    cc = node and
-    cc.getNode() = call
+    creation = cc and
+    source = cc and
+    specific = true
   )
 }
 
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 51247dbd75aa..194cc1f5ec1d 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -18,11 +18,25 @@ string callName(AstNode call) {
   exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())
 }
 
-from DataFlow::Node node, string insecure_version, CallNode call
+string sourceName(DataFlow::Node source) {
+  result = "call to " + callName(source.asCfgNode().(CallNode).getFunction().getNode())
+  or
+  not source.asCfgNode() instanceof CallNode and
+  not source instanceof ContextCreation and
+  result = "context modification"
+}
+
+string verb(boolean specific) {
+  specific = true and result = "specified"
+  or
+  specific = false and result = "allowed"
+}
+
+from DataFlow::Node creation, string insecure_version, DataFlow::Node source, boolean specific
 where
-  unsafe_connection_creation(node, insecure_version, call)
+  unsafe_connection_creation(creation, insecure_version, source, specific)
   or
-  unsafe_context_creation(node, insecure_version, call)
-select node, "Insecure SSL/TLS protocol version " + insecure_version + " specified in $@ ", call,
-  "call to " + callName(call.getFunction().getNode())
-//+ " specified in call to " + method_name + "."
+  unsafe_context_creation(creation, insecure_version, source.asCfgNode()) and specific = true
+select creation,
+  "Insecure SSL/TLS protocol version " + insecure_version + " " + verb(specific) + " by $@ ",
+  source, sourceName(source)
diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index a89c7ff08867..3c36c568ef5b 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -26,6 +26,8 @@ class ConnectionCall extends ConnectionCreation {
   }
 }
 
+// This cannot be used to unrestrict,
+// see https://www.pyopenssl.org/en/stable/api/ssl.html#OpenSSL.SSL.Context.set_options
 class SetOptionsCall extends ProtocolRestriction {
   override CallNode node;
 
@@ -42,6 +44,10 @@ class SetOptionsCall extends ProtocolRestriction {
   }
 }
 
+class UnspecificPyOpenSSLContextCreation extends PyOpenSSLContextCreation, UnspecificContextCreation {
+  UnspecificPyOpenSSLContextCreation() { library = "pyOpenSSL" }
+}
+
 class PyOpenSSL extends TlsLibrary {
   PyOpenSSL() { this = "pyOpenSSL" }
 
@@ -50,11 +56,9 @@ class PyOpenSSL extends TlsLibrary {
     result = version + "_METHOD"
   }
 
-  override string unspecific_version_name() {
-    result in [
-        "TLS_METHOD", // This is not actually available in pyOpenSSL yet
-        "SSLv23_METHOD" // This is what can negotiate TLS 1.3 (indeed, I know, I did test that..)
-      ]
+  override string unspecific_version_name(ProtocolFamily family) {
+    // `"TLS_METHOD"` is not actually available in pyOpenSSL yet, but should be coming soon..
+    result = family + "_METHOD"
   }
 
   override API::Node version_constants() { result = API::moduleImport("OpenSSL").getMember("SSL") }
@@ -70,4 +74,8 @@ class PyOpenSSL extends TlsLibrary {
   override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
 
   override ProtocolRestriction protocol_restriction() { result instanceof SetOptionsCall }
+
+  override ProtocolUnrestriction protocol_unrestriction() {
+    result instanceof UnspecificPyOpenSSLContextCreation
+  }
 }
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 4caa0ae7302e..e749bb9bc3c9 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -56,6 +56,31 @@ class OptionsAugOr extends ProtocolRestriction {
   override ProtocolVersion getRestriction() { result = restriction }
 }
 
+class OptionsAugAndNot extends ProtocolUnrestriction {
+  ProtocolVersion restriction;
+
+  OptionsAugAndNot() {
+    exists(AugAssign aa, AttrNode attr, Expr flag, UnaryExpr notFlag |
+      aa.getOperation().getOp() instanceof BitAnd and
+      aa.getTarget() = attr.getNode() and
+      attr.getName() = "options" and
+      attr.getObject() = node and
+      notFlag.getOp() instanceof Invert and
+      notFlag.getOperand() = flag and
+      flag = API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() and
+      (
+        aa.getValue() = notFlag
+        or
+        impliesValue(aa.getValue(), notFlag, true, true)
+      )
+    )
+  }
+
+  override DataFlow::CfgNode getContext() { result = this }
+
+  override ProtocolVersion getUnrestriction() { result = restriction }
+}
+
 /** Whether `part` evaluates to `partIsTrue` if `whole` evaluates to `wholeIsTrue`. */
 predicate impliesValue(BinaryExpr whole, Expr part, boolean partIsTrue, boolean wholeIsTrue) {
   whole.getOp() instanceof BitAnd and
@@ -75,8 +100,8 @@ predicate impliesValue(BinaryExpr whole, Expr part, boolean partIsTrue, boolean
   )
 }
 
-class ContextSetVersion extends ProtocolRestriction {
-  string restriction;
+class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction {
+  ProtocolVersion restriction;
 
   ContextSetVersion() {
     exists(Attributes::AttrWrite aw |
@@ -90,6 +115,21 @@ class ContextSetVersion extends ProtocolRestriction {
   override DataFlow::CfgNode getContext() { result = this }
 
   override ProtocolVersion getRestriction() { result.lessThan(restriction) }
+
+  override ProtocolVersion getUnrestriction() {
+    restriction = result or restriction.lessThan(result)
+  }
+}
+
+class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContextCreation {
+  UnspecificSSLContextCreation() { library = "ssl" }
+
+  override ProtocolVersion getUnrestriction() {
+    result = UnspecificContextCreation.super.getUnrestriction() and
+    // These are turned off by default
+    // see https://docs.python.org/3/library/ssl.html#ssl-contexts
+    not result in ["SSLv2", "SSLv3"]
+  }
 }
 
 class Ssl extends TlsLibrary {
@@ -100,16 +140,7 @@ class Ssl extends TlsLibrary {
     result = "PROTOCOL_" + version
   }
 
-  override string unspecific_version_name() {
-    result =
-      "PROTOCOL_" +
-        [
-          "TLS",
-          // This can negotiate a TLS 1.3 connection (!)
-          // see https://docs.python.org/3/library/ssl.html#ssl-contexts
-          "SSLv23"
-        ]
-  }
+  override string unspecific_version_name(ProtocolFamily family) { result = "PROTOCOL_" + family }
 
   override API::Node version_constants() { result = API::moduleImport("ssl") }
 
@@ -132,4 +163,12 @@ class Ssl extends TlsLibrary {
     or
     result instanceof ContextSetVersion
   }
+
+  override ProtocolUnrestriction protocol_unrestriction() {
+    result instanceof OptionsAugAndNot
+    or
+    result instanceof ContextSetVersion
+    or
+    result instanceof UnspecificSSLContextCreation
+  }
 }
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 36e58acd9266..97ceec006887 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -19,6 +19,13 @@ class ProtocolVersion extends string {
     or
     this = ["TLSv1", "TLSv1_1", "TLSv1_2"] and version = "TLSv1_3"
   }
+
+  predicate isInsecure() { this in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] }
+}
+
+/** An unspecific protocol version */
+class ProtocolFamily extends string {
+  ProtocolFamily() { this in ["SSLv23", "TLS"] }
 }
 
 /** The creation of a context. */
@@ -42,6 +49,34 @@ abstract class ProtocolRestriction extends DataFlow::CfgNode {
   abstract ProtocolVersion getRestriction();
 }
 
+/** A context is being relaxed on which protocols it can accepts. */
+abstract class ProtocolUnrestriction extends DataFlow::CfgNode {
+  /** Gets the context being relaxed. */
+  abstract DataFlow::CfgNode getContext();
+
+  /** Gets the protocol version being allowed. */
+  abstract ProtocolVersion getUnrestriction();
+}
+
+abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrestriction {
+  TlsLibrary library;
+  ProtocolFamily family;
+
+  UnspecificContextCreation() { this.getProtocol() = library.unspecific_version(family) }
+
+  override DataFlow::CfgNode getContext() { result = this }
+
+  override ProtocolVersion getUnrestriction() {
+    family = "TLS" and
+    result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
+    or
+    // This can negotiate a TLS 1.3 connection (!)
+    // see https://docs.python.org/3/library/ssl.html#ssl-contexts
+    family = "SSLv23" and
+    result in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
+  }
+}
+
 abstract class TlsLibrary extends string {
   TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
 
@@ -49,7 +84,7 @@ abstract class TlsLibrary extends string {
   abstract string specific_insecure_version_name(ProtocolVersion version);
 
   /** The name of an unspecific protocol version, say TLS, known to have insecure instances. */
-  abstract string unspecific_version_name();
+  abstract string unspecific_version_name(ProtocolFamily family);
 
   /** The module or class holding the version constants. */
   abstract API::Node version_constants();
@@ -60,8 +95,8 @@ abstract class TlsLibrary extends string {
   }
 
   /** A dataflow node representing an unspecific protocol version, say TLS, known to have insecure instances. */
-  DataFlow::Node unspecific_version() {
-    result = version_constants().getMember(unspecific_version_name()).getAUse()
+  DataFlow::Node unspecific_version(ProtocolFamily family) {
+    result = version_constants().getMember(unspecific_version_name(family)).getAUse()
   }
 
   /** The creation of a context with a deafult protocol. */
@@ -77,11 +112,11 @@ abstract class TlsLibrary extends string {
   }
 
   /** The creation of a context with an unspecific protocol version, say TLS, known to have insecure instances. */
-  DataFlow::CfgNode unspecific_context_creation() {
+  DataFlow::CfgNode unspecific_context_creation(ProtocolFamily family) {
     result = default_context_creation()
     or
     result = specific_context_creation() and
-    result.(ContextCreation).getProtocol() = unspecific_version()
+    result.(ContextCreation).getProtocol() = unspecific_version(family)
   }
 
   /** A connection is created in an insecure manner, not from a context. */
@@ -92,4 +127,7 @@ abstract class TlsLibrary extends string {
 
   /** A context is being restricted on which protocols it can accepts. */
   abstract ProtocolRestriction protocol_restriction();
+
+  /** A context is being relaxed on which protocols it can accepts. */
+  abstract ProtocolUnrestriction protocol_unrestriction();
 }
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index e116662ce659..afd9cc15d9f4 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -1,32 +1,40 @@
-| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
-| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
-| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
-| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | call to SSLContext |
-| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | call to SSLContext |
-| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | call to SSLContext |
-| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified in $@  | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified in $@  | InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
-| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified in $@  | InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | call to SSLContext |
-| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
-| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
-| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
-| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:47:14:47:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:43:15:43:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:173:14:173:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:169:15:169:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 specified in $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
-| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 specified in $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | call to SSLContext |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:29:27:29:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:25:15:25:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| pyOpenSSL_fluent.py:29:27:29:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:25:15:25:44 | ControlFlowNode for Attribute() | call to SSL.Context |
+| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:47:14:47:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:43:15:43:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:144:5:144:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:124:14:124:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:122:5:122:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:173:14:173:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:170:5:170:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:189:5:189:11 | ControlFlowNode for context | context modification |

From ee038373571b4d3fe2490c2fd19eaeb9afbbfa49 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 3 Mar 2021 23:46:18 +0100
Subject: [PATCH 025/433] Python: small refactor

---
 python/ql/src/Security/CWE-327/PyOpenSSL.qll       | 5 +----
 python/ql/src/Security/CWE-327/Ssl.qll             | 5 +----
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 7 ++++---
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index 3c36c568ef5b..d2cfb74b3ab9 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -51,10 +51,7 @@ class UnspecificPyOpenSSLContextCreation extends PyOpenSSLContextCreation, Unspe
 class PyOpenSSL extends TlsLibrary {
   PyOpenSSL() { this = "pyOpenSSL" }
 
-  override string specific_insecure_version_name(ProtocolVersion version) {
-    version in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] and
-    result = version + "_METHOD"
-  }
+  override string specific_version_name(ProtocolVersion version) { result = version + "_METHOD" }
 
   override string unspecific_version_name(ProtocolFamily family) {
     // `"TLS_METHOD"` is not actually available in pyOpenSSL yet, but should be coming soon..
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index e749bb9bc3c9..66a821e83ac8 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -135,10 +135,7 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
 class Ssl extends TlsLibrary {
   Ssl() { this = "ssl" }
 
-  override string specific_insecure_version_name(ProtocolVersion version) {
-    version in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] and
-    result = "PROTOCOL_" + version
-  }
+  override string specific_version_name(ProtocolVersion version) { result = "PROTOCOL_" + version }
 
   override string unspecific_version_name(ProtocolFamily family) { result = "PROTOCOL_" + family }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 97ceec006887..3ab880e8bd9e 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -80,8 +80,8 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
 abstract class TlsLibrary extends string {
   TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
 
-  /** The name of a specific protocol version, known to be insecure. */
-  abstract string specific_insecure_version_name(ProtocolVersion version);
+  /** The name of a specific protocol version. */
+  abstract string specific_version_name(ProtocolVersion version);
 
   /** The name of an unspecific protocol version, say TLS, known to have insecure instances. */
   abstract string unspecific_version_name(ProtocolFamily family);
@@ -91,7 +91,8 @@ abstract class TlsLibrary extends string {
 
   /** A dataflow node representing a specific protocol version, known to be insecure. */
   DataFlow::Node insecure_version(ProtocolVersion version) {
-    result = version_constants().getMember(specific_insecure_version_name(version)).getAUse()
+    version.isInsecure() and
+    result = version_constants().getMember(specific_version_name(version)).getAUse()
   }
 
   /** A dataflow node representing an unspecific protocol version, say TLS, known to have insecure instances. */

From de9469bbfc1769e6e705165b6e53efa12a0c97eb Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 4 Mar 2021 00:01:44 +0100
Subject: [PATCH 026/433] Python: complete `ssl.create_default_context`

---
 python/ql/src/Security/CWE-327/Ssl.qll | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 66a821e83ac8..d4886219d084 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -132,6 +132,15 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
   }
 }
 
+class UnspecificSSLDefaultContextCreation extends SSLDefaultContextCreation, ProtocolUnrestriction {
+  override DataFlow::CfgNode getContext() { result = this }
+
+  // see https://docs.python.org/3/library/ssl.html#ssl.create_default_context
+  override ProtocolVersion getUnrestriction() {
+    result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
+  }
+}
+
 class Ssl extends TlsLibrary {
   Ssl() { this = "ssl" }
 
@@ -167,5 +176,7 @@ class Ssl extends TlsLibrary {
     result instanceof ContextSetVersion
     or
     result instanceof UnspecificSSLContextCreation
+    or
+    result instanceof UnspecificSSLDefaultContextCreation
   }
 }

From d02c5298725695e1fe3dc663922619a7f0a8b35d Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 4 Mar 2021 00:06:36 +0100
Subject: [PATCH 027/433] Python: Update annotation

---
 python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index eceacaebe215..ab65e3bd2068 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -186,7 +186,7 @@ def test_fluent_ssl_safe_version():
 def test_fluent_explicitly_unsafe():
     hostname = 'www.python.org'
     context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
-    context.options &= ~ssl.OP_NO_SSLv3  # This not recognized
+    context.options &= ~ssl.OP_NO_SSLv3
 
     with socket.create_connection((hostname, 443)) as sock:
         with context.wrap_socket(sock, server_hostname=hostname) as ssock:  # SSLv3 not flagged here

From c5577cb09a073c2fb4f6feeca887c437d5fbe2fb Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 4 Mar 2021 19:54:49 +0800
Subject: [PATCH 028/433] Fix the problem

---
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  68 --------
 .../CWE/CWE-352/JsonpInjectionFilterLib.qll   |  77 ---------
 .../CWE/CWE-352/JsonpInjectionLib.qll         | 155 ------------------
 .../Security/CWE/CWE-352/JsonStringLib.qll    |   0
 .../CWE/CWE-352/JsonpController.java}         |  48 +-----
 .../Security/CWE/CWE-352/JsonpInjection.java  |   0
 .../Security/CWE/CWE-352/JsonpInjection.qhelp |   2 +-
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  64 ++++++++
 .../CWE/CWE-352/JsonpInjectionLib.qll         | 130 +++++++++++++++
 .../CWE/CWE-352/JsonpInjectionServlet1.java   |   0
 .../CWE/CWE-352/JsonpInjectionServlet2.java   |   0
 .../Security/CWE/CWE-352/RefererFilter.java   |  43 +++++
 .../semmle/code/java/frameworks/Servlets.qll  |  12 +-
 .../security/CWE-352/JsonpController.java     | 128 +++++++++++++++
 .../security/CWE-352/JsonpInjection.expected  |  60 -------
 .../CWE-352/JsonpInjectionServlet1.java       |  64 ++++++++
 .../CWE-352/JsonpInjectionServlet2.java}      |  16 +-
 .../CWE-352/JsonpInjection_1.expected         |  60 +++++++
 .../CWE-352/JsonpInjection_2.expected         |  78 +++++++++
 .../CWE-352/JsonpInjection_3.expected         |  66 ++++++++
 .../query-tests/security/CWE-352/Readme       |   3 +
 .../security/CWE-352/RefererFilter.java       |  43 +++++
 .../gson-2.8.6/com/google/gson/Gson.java      |   7 +
 .../org/springframework/util/StringUtils.java |   8 +
 .../javax/servlet/Filter.java                 |  13 ++
 .../javax/servlet/FilterChain.java            |   8 +
 .../javax/servlet/FilterConfig.java           |   3 +
 .../javax/servlet/ServletException.java       |   8 +
 .../javax/servlet/ServletRequest.java         |  87 ++++++++++
 .../javax/servlet/ServletResponse.java        |  39 +++++
 .../servlet/http/HttpServletRequest.java      | 116 +++++++++++++
 .../servlet/http/HttpServletResponse.java     | 106 ++++++++++++
 32 files changed, 1084 insertions(+), 428 deletions(-)
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
 delete mode 100644 java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
 rename java/ql/src/{ => experimental}/Security/CWE/CWE-352/JsonStringLib.qll (100%)
 rename java/ql/{test/experimental/query-tests/security/CWE-352/JsonpInjection.java => src/experimental/Security/CWE/CWE-352/JsonpController.java} (72%)
 rename java/ql/src/{ => experimental}/Security/CWE/CWE-352/JsonpInjection.java (100%)
 rename java/ql/src/{ => experimental}/Security/CWE/CWE-352/JsonpInjection.qhelp (96%)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
 rename java/ql/src/{ => experimental}/Security/CWE/CWE-352/JsonpInjectionServlet1.java (100%)
 rename java/ql/src/{ => experimental}/Security/CWE/CWE-352/JsonpInjectionServlet2.java (100%)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java
 rename java/ql/{src/Security/CWE/CWE-352/JsonpInjectionServlet.java => test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java} (75%)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/Readme
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
 create mode 100644 java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java

diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
deleted file mode 100644
index 53ee6182511b..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.ql
+++ /dev/null
@@ -1,68 +0,0 @@
-/**
- * @name JSONP Injection
- * @description User-controlled callback function names that are not verified are vulnerable
- *              to jsonp injection attacks.
- * @kind path-problem
- * @problem.severity error
- * @precision high
- * @id java/JSONP-Injection
- * @tags security
- *       external/cwe/cwe-352
- */
-
-import java
-import JsonpInjectionLib
-import JsonpInjectionFilterLib
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.deadcode.WebEntryPoints
-import DataFlow::PathGraph
-
-
-/** If there is a method to verify `token`, `auth`, `referer`, and `origin`, it will not pass. */
-class ServletVerifAuth extends DataFlow::BarrierGuard {
-  ServletVerifAuth() {
-    exists(MethodAccess ma, Node prod, Node succ |
-      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      prod instanceof RemoteFlowSource and
-      succ.asExpr() = ma.getAnArgument() and
-      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      localFlowStep*(prod, succ) and
-      this = ma
-    )
-  }
-
-  override predicate checks(Expr e, boolean branch) {
-    exists(Node node |
-      node instanceof JsonpInjectionSink and
-      e = node.asExpr() and
-      branch = true
-    )
-  }
-}
-
-/** Taint-tracking configuration tracing flow from get method request sources to output jsonp data. */
-class JsonpInjectionConfig extends TaintTracking::Configuration {
-  JsonpInjectionConfig() { this = "JsonpInjectionConfig" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof GetHttpRequestSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonpInjectionSink }
-
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof ServletVerifAuth
-  }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(MethodAccess ma |
-      isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
-    )
-  }
-}
-
-from DataFlow::PathNode source, DataFlow::PathNode sink, JsonpInjectionConfig conf
-where
-  not checks() = false and
-  conf.hasFlowPath(source, sink) and
-  exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
-select sink.getNode(), source, sink, "Jsonp Injection query might include code from $@.",
-  source.getNode(), "this user input"
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
deleted file mode 100644
index b349bed26414..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionFilterLib.qll
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * @name JSONP Injection
- * @description User-controlled callback function names that are not verified are vulnerable
- *              to json hijacking attacks.
- * @kind path-problem
- */
-
-import java
-import DataFlow
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking2
-import DataFlow::PathGraph
-
-class FilterVerifAuth extends DataFlow::BarrierGuard {
-  FilterVerifAuth() {
-    exists(MethodAccess ma, Node prod, Node succ |
-      ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      prod instanceof RemoteFlowSource and
-      succ.asExpr() = ma.getAnArgument() and
-      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      localFlowStep*(prod, succ) and
-      this = ma
-    )
-  }
-
-  override predicate checks(Expr e, boolean branch) {
-    exists(Node node |
-      node instanceof DoFilterMethodSink and
-      e = node.asExpr() and
-      branch = true
-    )
-  }
-}
-
-/** A data flow source for `Filter.doFilter` method paramters. */
-private class DoFilterMethodSource extends DataFlow::Node {
-  DoFilterMethodSource() {
-    exists(Method m |
-      isDoFilterMethod(m) and
-      m.getAParameter().getAnAccess() = this.asExpr()
-    )
-  }
-}
-
-/** A data flow sink for `FilterChain.doFilter` method qualifying expression. */
-private class DoFilterMethodSink extends DataFlow::Node {
-  DoFilterMethodSink() {
-    exists(MethodAccess ma, Method m | ma.getMethod() = m |
-      m.hasName("doFilter") and
-      m.getDeclaringType*().hasQualifiedName("javax.servlet", "FilterChain") and
-      ma.getQualifier() = this.asExpr()
-    )
-  }
-}
-
-/** Taint-tracking configuration tracing flow from `doFilter` method paramter source to output 
- * `FilterChain.doFilter` method qualifying expression. 
- * */
-class DoFilterMethodConfig extends TaintTracking::Configuration {
-  DoFilterMethodConfig() { this = "DoFilterMethodConfig" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof DoFilterMethodSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof DoFilterMethodSink }
-
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof FilterVerifAuth
-  }
-}
-
-/** Implement class modeling verification for `Filter.doFilter`, return false if it fails. */
-boolean checks() {
-  exists(DataFlow::PathNode source, DataFlow::PathNode sink, DoFilterMethodConfig conf |
-    conf.hasFlowPath(source, sink) and
-    result = false
-  )
-}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
deleted file mode 100644
index 3f7304258232..000000000000
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ /dev/null
@@ -1,155 +0,0 @@
-import java
-import DataFlow
-import JsonStringLib
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.frameworks.spring.SpringController
-
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
-private predicate isGetServletMethod(Method m) {
-  isServletRequestMethod(m) and m.getName() = "doGet"
-}
-
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
-private predicate isGetSpringControllerMethod(Method m) {
-  exists(Annotation a |
-    a = m.getAnAnnotation() and
-    a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
-  )
-  or
-  exists(Annotation a |
-    a = m.getAnAnnotation() and
-    a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
-    a.getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}")
-  )
-}
-
-/** Method parameters use the annotation `@RequestParam` or the parameter type is `ServletRequest`, `String`, `Object` */
-predicate checkSpringMethodParameterType(Method m, int i) {
-  m.getParameter(i).getType() instanceof ServletRequest
-  or
-  exists(Parameter p |
-    p = m.getParameter(i) and
-    p.hasAnnotation() and
-    p.getAnAnnotation()
-        .getType()
-        .hasQualifiedName("org.springframework.web.bind.annotation", "RequestParam") and
-    p.getType().getName().regexpMatch("String|Object")
-  )
-  or
-  exists(Parameter p |
-    p = m.getParameter(i) and
-    not p.hasAnnotation() and
-    p.getType().getName().regexpMatch("String|Object")
-  )
-}
-
-/** A data flow source for get method request parameters. */
-abstract class GetHttpRequestSource extends DataFlow::Node { }
-
-/** A data flow source for servlet get method request parameters. */
-private class ServletGetHttpRequestSource extends GetHttpRequestSource {
-  ServletGetHttpRequestSource() {
-    exists(Method m |
-      isGetServletMethod(m) and
-      m.getParameter(0).getAnAccess() = this.asExpr()
-    )
-  }
-}
-
-/** A data flow source for spring controller get method request parameters. */
-private class SpringGetHttpRequestSource extends GetHttpRequestSource {
-  SpringGetHttpRequestSource() {
-    exists(SpringControllerMethod scm, int i |
-      isGetSpringControllerMethod(scm) and
-      checkSpringMethodParameterType(scm, i) and
-      scm.getParameter(i).getAnAccess() = this.asExpr()
-    )
-  }
-}
-
-/** A data flow sink for unvalidated user input that is used to jsonp. */
-abstract class JsonpInjectionSink extends DataFlow::Node { }
-
-/** Use ```print```, ```println```, ```write``` to output result. */
-private class WriterPrintln extends JsonpInjectionSink {
-  WriterPrintln() {
-    exists(MethodAccess ma |
-      ma.getMethod().getName().regexpMatch("print|println|write") and
-      ma.getMethod()
-          .getDeclaringType()
-          .getASourceSupertype*()
-          .hasQualifiedName("java.io", "PrintWriter") and
-      ma.getArgument(0) = this.asExpr()
-    )
-  }
-}
-
-/** Spring Request Method return result. */
-private class SpringReturn extends JsonpInjectionSink {
-  SpringReturn() {
-    exists(ReturnStmt rs, Method m | m = rs.getEnclosingCallable() |
-      isGetSpringControllerMethod(m) and
-      rs.getResult() = this.asExpr()
-    )
-  }
-}
-
-/** A concatenate expression using `(` and `)` or `);`. */
-class JsonpInjectionExpr extends AddExpr {
-  JsonpInjectionExpr() {
-    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
-    getLeftOperand()
-        .(AddExpr)
-        .getLeftOperand()
-        .(AddExpr)
-        .getRightOperand()
-        .toString()
-        .regexpMatch("\"\\(\"")
-  }
-
-  /** Get the jsonp function name of this expression */
-  Expr getFunctionName() {
-    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
-  }
-
-  /** Get the json data of this expression */
-  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
-}
-
-/** A data flow configuration tracing flow from remote sources to jsonp function name. */
-class RemoteFlowConfig extends DataFlow2::Configuration {
-  RemoteFlowConfig() { this = "RemoteFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(JsonpInjectionExpr jhe | jhe.getFunctionName() = sink.asExpr())
-  }
-}
-
-/** A data flow configuration tracing flow from json data to splicing jsonp data. */
-class JsonDataFlowConfig extends DataFlow2::Configuration {
-  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(JsonpInjectionExpr jhe | jhe.getJsonExpr() = sink.asExpr())
-  }
-}
-
-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
-class JsonpInjectionFlowConfig extends DataFlow::Configuration {
-  JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) {
-    exists(JsonpInjectionExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
-      jhe = src.asExpr() and
-      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
-      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof JsonpInjectionSink }
-}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
similarity index 100%
rename from java/ql/src/Security/CWE/CWE-352/JsonStringLib.qll
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java
similarity index 72%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java
index 9f079513a8b9..84a172a7aebd 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java
@@ -3,17 +3,14 @@
 import com.google.gson.Gson;
 import java.io.PrintWriter;
 import java.util.HashMap;
-import java.util.Random;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 @Controller
-public class JsonpInjection {
+public class JsonpController {
     private static HashMap hashMap = new HashMap();
 
     static {
@@ -96,54 +93,13 @@ public void bad6(HttpServletRequest request,
 
     @GetMapping(value = "jsonp7")
     @ResponseBody
-    public String good(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        String val = "";
-        Random random = new Random();
-        for (int i = 0; i < 10; i++) {
-            val += String.valueOf(random.nextInt(10));
-        }
-        // good
-        jsonpCallback = jsonpCallback + "_" + val;
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp8")
-    @ResponseBody
     public String good1(HttpServletRequest request) {
         String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
 
         String token = request.getParameter("token");
 
-        // good
         if (verifToken(token)){
-            System.out.println(token);
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
-        }
-
-        return "error";
-    }
-
-    @GetMapping(value = "jsonp9")
-    @ResponseBody
-    public String good2(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
-        String referer = request.getHeader("Referer");
-
-        boolean result = verifReferer(referer);
-
-        boolean test = result;
-        // good
-        if (test){
+            String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
             return resultStr;
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
similarity index 100%
rename from java/ql/src/Security/CWE/CWE-352/JsonpInjection.java
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
similarity index 96%
rename from java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index b063b409d3a5..bb5d628ac0b7 100644
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -16,7 +16,7 @@ there is a problem of sensitive information leakage.</p>
 
 <p>The following example shows the case of no verification processing and verification processing for the external input function name.</p>
 
-<sample src="JsonHijacking.java" />
+<sample src="JsonpInjection.java" />
 
 </example>
 <references>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
new file mode 100644
index 000000000000..f3ae25daa034
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -0,0 +1,64 @@
+/**
+ * @name JSONP Injection
+ * @description User-controlled callback function names that are not verified are vulnerable
+ *              to jsonp injection attacks.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/JSONP-Injection
+ * @tags security
+ *       external/cwe/cwe-352
+ */
+
+import java
+import JsonpInjectionLib
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.deadcode.WebEntryPoints
+import semmle.code.java.security.XSS
+import DataFlow::PathGraph
+
+/** Determine whether there is a verification method for the remote streaming source data flow path method. */
+predicate existsFilterVerificationMethod() {
+  exists(MethodAccess ma,Node existsNode, Method m|
+    ma.getMethod() instanceof VerificationMethodClass and
+    existsNode.asExpr() = ma and
+    m = getAnMethod(existsNode.getEnclosingCallable()) and
+    isDoFilterMethod(m)
+  )
+}
+
+/** Determine whether there is a verification method for the remote streaming source data flow path method. */
+predicate existsServletVerificationMethod(Node checkNode) {
+  exists(MethodAccess ma,Node existsNode|
+    ma.getMethod() instanceof VerificationMethodClass and
+    existsNode.asExpr() = ma and
+    getAnMethod(existsNode.getEnclosingCallable()) = getAnMethod(checkNode.getEnclosingCallable())
+  )
+}
+
+/** Taint-tracking configuration tracing flow from get method request sources to output jsonp data. */
+class RequestResponseFlowConfig extends TaintTracking::Configuration {
+  RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source instanceof RemoteFlowSource and
+    getAnMethod(source.getEnclosingCallable()) instanceof RequestGetMethod
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(MethodAccess ma |
+      isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
+    )
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, RequestResponseFlowConfig conf
+where
+  not existsServletVerificationMethod(source.getNode()) and
+  not existsFilterVerificationMethod() and
+  conf.hasFlowPath(source, sink) and
+  exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
+select sink.getNode(), source, sink, "Jsonp Injection query might include code from $@.",
+  source.getNode(), "this user input"
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
new file mode 100644
index 000000000000..b8964524a9f8
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -0,0 +1,130 @@
+import java
+import DataFlow
+import JsonStringLib
+import semmle.code.java.security.XSS
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.spring.SpringController
+
+/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+class VerificationMethodFlowConfig extends TaintTracking::Configuration {
+  VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma, BarrierGuard bg |
+      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
+      bg = ma and
+      sink.asExpr() = ma.getAnArgument()
+    )
+  }
+}
+
+/** The parameter name of the method is `token`, `auth`, `referer`, `origin`. */
+class VerificationMethodClass extends Method {
+  VerificationMethodClass() {
+    exists(MethodAccess ma, BarrierGuard bg, VerificationMethodFlowConfig vmfc, Node node |
+      this = ma.getMethod() and
+      this.getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
+      bg = ma and
+      node.asExpr() = ma.getAnArgument() and
+      vmfc.hasFlowTo(node)
+    )
+  }
+}
+
+/** Get Callable by recursive method. */
+Callable getAnMethod(Callable call) {
+  result = call
+  or
+  result = getAnMethod(call.getAReference().getEnclosingCallable())
+}
+
+abstract class RequestGetMethod extends Method { }
+
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private class ServletGetMethod extends RequestGetMethod {
+  ServletGetMethod() {
+    exists(Method m |
+      m = this and
+      isServletRequestMethod(m) and
+      m.getName() = "doGet"
+    )
+  }
+}
+
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private class SpringControllerGetMethod extends RequestGetMethod {
+  SpringControllerGetMethod() {
+    exists(Annotation a |
+      a = this.getAnAnnotation() and
+      a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
+    )
+    or
+    exists(Annotation a |
+      a = this.getAnAnnotation() and
+      a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
+      a.getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}")
+    )
+  }
+}
+
+/** A concatenate expression using `(` and `)` or `);`. */
+class JsonpInjectionExpr extends AddExpr {
+  JsonpInjectionExpr() {
+    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
+    getLeftOperand()
+        .(AddExpr)
+        .getLeftOperand()
+        .(AddExpr)
+        .getRightOperand()
+        .toString()
+        .regexpMatch("\"\\(\"")
+  }
+
+  /** Get the jsonp function name of this expression */
+  Expr getFunctionName() {
+    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
+  }
+
+  /** Get the json data of this expression */
+  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
+}
+
+/** A data flow configuration tracing flow from remote sources to jsonp function name. */
+class RemoteFlowConfig extends DataFlow2::Configuration {
+  RemoteFlowConfig() { this = "RemoteFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpInjectionExpr jhe | jhe.getFunctionName() = sink.asExpr())
+  }
+}
+
+/** A data flow configuration tracing flow from json data to splicing jsonp data. */
+class JsonDataFlowConfig extends DataFlow2::Configuration {
+  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpInjectionExpr jhe | jhe.getJsonExpr() = sink.asExpr())
+  }
+}
+
+/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+class JsonpInjectionFlowConfig extends TaintTracking::Configuration {
+  JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(JsonpInjectionExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
+      jhe = src.asExpr() and
+      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
+      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet1.java
similarity index 100%
rename from java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet1.java
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet1.java
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet2.java
similarity index 100%
rename from java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet2.java
rename to java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet2.java
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java b/java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java
new file mode 100644
index 000000000000..97444932ae17
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java
@@ -0,0 +1,43 @@
+import java.io.IOException;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.util.StringUtils;
+
+public class RefererFilter implements Filter {
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        String refefer = request.getHeader("Referer");
+        boolean result = verifReferer(refefer);
+        if (result){
+            filterChain.doFilter(servletRequest, servletResponse);
+        }
+        response.sendError(444, "Referer xxx.");
+    }
+
+    @Override
+    public void destroy() {
+    }
+
+    public static boolean verifReferer(String referer){
+        if (StringUtils.isEmpty(referer)){
+            return false;
+        }
+        if (referer.startsWith("http://www.baidu.com/")){
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index b2054dc30cb7..5cccf62122ff 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -338,7 +338,6 @@ predicate isRequestGetParamMethod(MethodAccess ma) {
   ma.getMethod() instanceof HttpServletRequestGetQueryStringMethod
 }
 
-
 /**
  * A class that has `javax.servlet.Filter` as an ancestor.
  */
@@ -346,21 +345,18 @@ class FilterClass extends Class {
   FilterClass() { getAnAncestor().hasQualifiedName("javax.servlet", "Filter") }
 }
 
-
 /**
  * The interface `javax.servlet.FilterChain`
  */
-class FilterChain extends RefType {
-  FilterChain() {
-    hasQualifiedName("javax.servlet", "FilterChain")
-  }
+class FilterChain extends Interface {
+  FilterChain() { hasQualifiedName("javax.servlet", "FilterChain") }
 }
 
-/** Holds if `m` is a request handler method (for example `doGet` or `doPost`). */
+/** Holds if `m` is a filter handler method (for example `doFilter`). */
 predicate isDoFilterMethod(Method m) {
   m.getDeclaringType() instanceof FilterClass and
   m.getNumberOfParameters() = 3 and
   m.getParameter(0).getType() instanceof ServletRequest and
   m.getParameter(1).getType() instanceof ServletResponse and
   m.getParameter(2).getType() instanceof FilterChain
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
new file mode 100644
index 000000000000..cf860c756409
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
@@ -0,0 +1,128 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class JsonpController {
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+
+    @GetMapping(value = "jsonp1", produces="text/javascript")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp7")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+
+        String token = request.getParameter("token");
+
+        if (verifToken(token)){
+            String jsonpCallback = request.getParameter("jsonpCallback");
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+
+        return "error";
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+
+    public static boolean verifToken(String token){
+        if (token != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+
+    public static boolean verifReferer(String referer){
+        if (!referer.startsWith("http://test.com/")){
+            return false;
+        }
+        return true;
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
deleted file mode 100644
index 7e3069cf1d93..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
+++ /dev/null
@@ -1,60 +0,0 @@
-edges
-| JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | JsonpInjection.java:34:16:34:24 | resultStr |
-| JsonpInjection.java:33:21:33:54 | ... + ... : String | JsonpInjection.java:34:16:34:24 | resultStr |
-| JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | JsonpInjection.java:45:16:45:24 | resultStr |
-| JsonpInjection.java:43:21:43:80 | ... + ... : String | JsonpInjection.java:45:16:45:24 | resultStr |
-| JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | JsonpInjection.java:55:16:55:24 | resultStr |
-| JsonpInjection.java:54:21:54:55 | ... + ... : String | JsonpInjection.java:55:16:55:24 | resultStr |
-| JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | JsonpInjection.java:65:16:65:24 | resultStr |
-| JsonpInjection.java:64:21:64:54 | ... + ... : String | JsonpInjection.java:65:16:65:24 | resultStr |
-| JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | JsonpInjection.java:80:20:80:28 | resultStr |
-| JsonpInjection.java:79:21:79:54 | ... + ... : String | JsonpInjection.java:80:20:80:28 | resultStr |
-| JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | JsonpInjection.java:94:20:94:28 | resultStr |
-| JsonpInjection.java:93:21:93:54 | ... + ... : String | JsonpInjection.java:94:20:94:28 | resultStr |
-| JsonpInjection.java:101:32:101:38 | request : HttpServletRequest | JsonpInjection.java:112:16:112:24 | resultStr |
-| JsonpInjection.java:127:25:127:59 | ... + ... : String | JsonpInjection.java:128:20:128:28 | resultStr |
-| JsonpInjection.java:148:25:148:59 | ... + ... : String | JsonpInjection.java:149:20:149:28 | resultStr |
-nodes
-| JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:33:21:33:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:34:16:34:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:34:16:34:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:43:21:43:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:45:16:45:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:45:16:45:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:54:21:54:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:55:16:55:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:55:16:55:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:64:21:64:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:65:16:65:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:65:16:65:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:101:32:101:38 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
-| JsonpInjection.java:112:16:112:24 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:127:25:127:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:128:20:128:28 | resultStr | semmle.label | resultStr |
-| JsonpInjection.java:148:25:148:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjection.java:149:20:149:28 | resultStr | semmle.label | resultStr |
-#select
-| JsonpInjection.java:34:16:34:24 | resultStr | JsonpInjection.java:29:32:29:38 | request : HttpServletRequest | JsonpInjection.java:34:16:34:24 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:29:32:29:38 | request | this user input |
-| JsonpInjection.java:45:16:45:24 | resultStr | JsonpInjection.java:41:32:41:38 | request : HttpServletRequest | JsonpInjection.java:45:16:45:24 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:41:32:41:38 | request | this user input |
-| JsonpInjection.java:55:16:55:24 | resultStr | JsonpInjection.java:52:32:52:38 | request : HttpServletRequest | JsonpInjection.java:55:16:55:24 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:52:32:52:38 | request | this user input |
-| JsonpInjection.java:65:16:65:24 | resultStr | JsonpInjection.java:62:32:62:38 | request : HttpServletRequest | JsonpInjection.java:65:16:65:24 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:62:32:62:38 | request | this user input |
-| JsonpInjection.java:80:20:80:28 | resultStr | JsonpInjection.java:72:32:72:38 | request : HttpServletRequest | JsonpInjection.java:80:20:80:28 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:72:32:72:38 | request | this user input |
-| JsonpInjection.java:94:20:94:28 | resultStr | JsonpInjection.java:87:32:87:38 | request : HttpServletRequest | JsonpInjection.java:94:20:94:28 | 
-resultStr | Jsonp Injection query might include code from $@. | JsonpInjection.java:87:32:87:38 | request | this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java
new file mode 100644
index 000000000000..14ef76275b1d
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java
@@ -0,0 +1,64 @@
+import com.google.gson.Gson;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class JsonpInjectionServlet1 extends HttpServlet {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    private static final long serialVersionUID = 1L;
+
+    private String key = "test";
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        doPost(req, resp);
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        resp.setContentType("application/json");
+        String jsonpCallback = req.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String jsonResult = gson.toJson(hashMap);
+
+        String referer = req.getHeader("Referer");
+
+        boolean result = verifReferer(referer);
+
+        // good
+        if (result){
+            String resultStr = null;
+            pw = resp.getWriter();
+            resultStr = jsonpCallback + "(" + jsonResult + ")";
+            pw.println(resultStr);
+            pw.flush();
+        }
+    }
+
+    public static boolean verifReferer(String referer){
+        if (!referer.startsWith("http://test.com/")){
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+        this.key = config.getInitParameter("key");
+        System.out.println("初始化" + this.key);
+        super.init(config);
+    }
+
+}
diff --git a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java
similarity index 75%
rename from java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java
index 916cd9bf676e..bbfbc2dc4360 100644
--- a/java/ql/src/Security/CWE/CWE-352/JsonpInjectionServlet.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java
@@ -4,12 +4,11 @@
 import java.util.HashMap;
 import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-public class JsonpInjectionServlet  extends HttpServlet {
+public class JsonpInjectionServlet2  extends HttpServlet {
 
     private static HashMap hashMap = new HashMap();
 
@@ -23,21 +22,12 @@ public class JsonpInjectionServlet  extends HttpServlet {
     private String key = "test";
     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        String jsonpCallback = req.getParameter("jsonpCallback");
-
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-
-        String resultStr = null;
-        pw = resp.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-        pw.flush();
+        doPost(req, resp);
     }
 
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        resp.setContentType("application/json");
         String jsonpCallback = req.getParameter("jsonpCallback");
         PrintWriter pw = null;
         Gson gson = new Gson();
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
new file mode 100644
index 000000000000..a89d03b67a7b
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
@@ -0,0 +1,60 @@
+edges
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
+| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
+nodes
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:101:24:101:28 | token | semmle.label | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+#select
+| JsonpController.java:31:16:31:24 | resultStr | JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:26:32:26:68 | getParameter(...) | this user input |
+| JsonpController.java:42:16:42:24 | resultStr | JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:38:32:38:68 | getParameter(...) | this user input |
+| JsonpController.java:52:16:52:24 | resultStr | JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:49:32:49:68 | getParameter(...) | this user input |
+| JsonpController.java:62:16:62:24 | resultStr | JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:59:32:59:68 | getParameter(...) | this user input |
+| JsonpController.java:77:20:77:28 | resultStr | JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:69:32:69:68 | getParameter(...) | this user input |
+| JsonpController.java:91:20:91:28 | resultStr | JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:84:32:84:68 | getParameter(...) | this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
new file mode 100644
index 000000000000..4b12308a212d
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
@@ -0,0 +1,78 @@
+edges
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
+| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+nodes
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:101:24:101:28 | token | semmle.label | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+#select
+| JsonpController.java:31:16:31:24 | resultStr | JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:26:32:26:68 | getParameter(...) | this user input |
+| JsonpController.java:42:16:42:24 | resultStr | JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:38:32:38:68 | getParameter(...) | this user input |
+| JsonpController.java:52:16:52:24 | resultStr | JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:49:32:49:68 | getParameter(...) | this user input |
+| JsonpController.java:62:16:62:24 | resultStr | JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:59:32:59:68 | getParameter(...) | this user input |
+| JsonpController.java:77:20:77:28 | resultStr | JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:69:32:69:68 | getParameter(...) | this user input |
+| JsonpController.java:91:20:91:28 | resultStr | JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 |
+ resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:84:32:84:68 | getParameter(...) | this user input |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServle
+t2.java:39:20:39:28 | resultStr | Jsonp Injection query might include code from $@. | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) |
+ this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
new file mode 100644
index 000000000000..8e33ca6984c6
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
@@ -0,0 +1,66 @@
+edges
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
+| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| RefererFilter.java:22:26:22:53 | getHeader(...) : String | RefererFilter.java:23:39:23:45 | refefer |
+nodes
+| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:101:24:101:28 | token | semmle.label | token |
+| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| RefererFilter.java:22:26:22:53 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| RefererFilter.java:23:39:23:45 | refefer | semmle.label | refefer |
+#select
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/Readme b/java/ql/test/experimental/query-tests/security/CWE-352/Readme
new file mode 100644
index 000000000000..15715d6187c9
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/Readme
@@ -0,0 +1,3 @@
+1. The JsonpInjection_1.expected result is obtained through the test of `JsonpController.java`.
+2. The JsonpInjection_2.expected result is obtained through the test of `JsonpController.java`, `JsonpInjectionServlet1.java`, `JsonpInjectionServlet2.java`.
+3. The JsonpInjection_3.expected result is obtained through the test of `JsonpController.java`, `JsonpInjectionServlet1.java`, `JsonpInjectionServlet2.java`, `RefererFilter.java`.
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java b/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
new file mode 100644
index 000000000000..97444932ae17
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
@@ -0,0 +1,43 @@
+import java.io.IOException;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.util.StringUtils;
+
+public class RefererFilter implements Filter {
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        String refefer = request.getHeader("Referer");
+        boolean result = verifReferer(refefer);
+        if (result){
+            filterChain.doFilter(servletRequest, servletResponse);
+        }
+        response.sendError(444, "Referer xxx.");
+    }
+
+    @Override
+    public void destroy() {
+    }
+
+    public static boolean verifReferer(String referer){
+        if (StringUtils.isEmpty(referer)){
+            return false;
+        }
+        if (referer.startsWith("http://www.baidu.com/")){
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java b/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java
new file mode 100644
index 000000000000..bbe53dc2a5f6
--- /dev/null
+++ b/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java
@@ -0,0 +1,7 @@
+package com.google.gson;
+
+public final class Gson {
+    public String toJson(Object src) {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
new file mode 100644
index 000000000000..6ee07f84593f
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
@@ -0,0 +1,8 @@
+package org.springframework.util;
+
+public abstract class StringUtils {
+
+    public static boolean isEmpty(Object str) {
+        return str == null || "".equals(str);
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
new file mode 100644
index 000000000000..5833e3c909da
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
@@ -0,0 +1,13 @@
+package javax.servlet;
+
+import java.io.IOException;
+
+public interface Filter {
+    default void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    void doFilter(ServletRequest var1, ServletResponse var2, FilterChain var3) throws IOException, ServletException;
+
+    default void destroy() {
+    }
+}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
new file mode 100644
index 000000000000..6a1dfc588b6a
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
@@ -0,0 +1,8 @@
+package javax.servlet;
+
+import java.io.IOException;
+
+public interface FilterChain {
+    void doFilter(ServletRequest var1, ServletResponse var2) throws IOException, ServletException;
+}
+
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
new file mode 100644
index 000000000000..66c13eb54f0b
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
@@ -0,0 +1,3 @@
+package javax.servlet;
+
+public interface FilterConfig {}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
new file mode 100644
index 000000000000..ce5f7c4465ae
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
@@ -0,0 +1,8 @@
+package javax.servlet;
+
+public class ServletException extends Exception {
+    private static final long serialVersionUID = 1L;
+
+    public ServletException() {
+    }
+}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
new file mode 100644
index 000000000000..4ee0026d0668
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
@@ -0,0 +1,87 @@
+package javax.servlet;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.Map;
+
+public interface ServletRequest {
+    Object getAttribute(String var1);
+
+    Enumeration<String> getAttributeNames();
+
+    String getCharacterEncoding();
+
+    void setCharacterEncoding(String var1) throws UnsupportedEncodingException;
+
+    int getContentLength();
+
+    long getContentLengthLong();
+
+    String getContentType();
+
+    ServletInputStream getInputStream() throws IOException;
+
+    String getParameter(String var1);
+
+    Enumeration<String> getParameterNames();
+
+    String[] getParameterValues(String var1);
+
+    Map<String, String[]> getParameterMap();
+
+    String getProtocol();
+
+    String getScheme();
+
+    String getServerName();
+
+    int getServerPort();
+
+    BufferedReader getReader() throws IOException;
+
+    String getRemoteAddr();
+
+    String getRemoteHost();
+
+    void setAttribute(String var1, Object var2);
+
+    void removeAttribute(String var1);
+
+    Locale getLocale();
+
+    Enumeration<Locale> getLocales();
+
+    boolean isSecure();
+
+    RequestDispatcher getRequestDispatcher(String var1);
+
+    /** @deprecated */
+    @Deprecated
+    String getRealPath(String var1);
+
+    int getRemotePort();
+
+    String getLocalName();
+
+    String getLocalAddr();
+
+    int getLocalPort();
+
+    ServletContext getServletContext();
+
+    AsyncContext startAsync() throws IllegalStateException;
+
+    AsyncContext startAsync(ServletRequest var1, ServletResponse var2) throws IllegalStateException;
+
+    boolean isAsyncStarted();
+
+    boolean isAsyncSupported();
+
+    AsyncContext getAsyncContext();
+
+    DispatcherType getDispatcherType();
+}
+
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
new file mode 100644
index 000000000000..0aa6121e686d
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
@@ -0,0 +1,39 @@
+package javax.servlet;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.Locale;
+
+public interface ServletResponse {
+    String getCharacterEncoding();
+
+    String getContentType();
+
+    ServletOutputStream getOutputStream() throws IOException;
+
+    PrintWriter getWriter() throws IOException;
+
+    void setCharacterEncoding(String var1);
+
+    void setContentLength(int var1);
+
+    void setContentLengthLong(long var1);
+
+    void setContentType(String var1);
+
+    void setBufferSize(int var1);
+
+    int getBufferSize();
+
+    void flushBuffer() throws IOException;
+
+    void resetBuffer();
+
+    boolean isCommitted();
+
+    void reset();
+
+    void setLocale(Locale var1);
+
+    Locale getLocale();
+}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
new file mode 100644
index 000000000000..02d53a96a333
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
@@ -0,0 +1,116 @@
+package javax.servlet.http;
+
+import java.io.IOException;
+import java.security.Principal;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.Map;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+
+public interface HttpServletRequest extends ServletRequest {
+    String BASIC_AUTH = "BASIC";
+    String FORM_AUTH = "FORM";
+    String CLIENT_CERT_AUTH = "CLIENT_CERT";
+    String DIGEST_AUTH = "DIGEST";
+
+    String getAuthType();
+
+    Cookie[] getCookies();
+
+    long getDateHeader(String var1);
+
+    String getHeader(String var1);
+
+    Enumeration<String> getHeaders(String var1);
+
+    Enumeration<String> getHeaderNames();
+
+    int getIntHeader(String var1);
+
+    default HttpServletMapping getHttpServletMapping() {
+        return new HttpServletMapping() {
+            public String getMatchValue() {
+                return "";
+            }
+
+            public String getPattern() {
+                return "";
+            }
+
+            public String getServletName() {
+                return "";
+            }
+
+            public MappingMatch getMappingMatch() {
+                return null;
+            }
+        };
+    }
+
+    String getMethod();
+
+    String getPathInfo();
+
+    String getPathTranslated();
+
+    default PushBuilder newPushBuilder() {
+        return null;
+    }
+
+    String getContextPath();
+
+    String getQueryString();
+
+    String getRemoteUser();
+
+    boolean isUserInRole(String var1);
+
+    Principal getUserPrincipal();
+
+    String getRequestedSessionId();
+
+    String getRequestURI();
+
+    StringBuffer getRequestURL();
+
+    String getServletPath();
+
+    HttpSession getSession(boolean var1);
+
+    HttpSession getSession();
+
+    String changeSessionId();
+
+    boolean isRequestedSessionIdValid();
+
+    boolean isRequestedSessionIdFromCookie();
+
+    boolean isRequestedSessionIdFromURL();
+
+    /** @deprecated */
+    @Deprecated
+    boolean isRequestedSessionIdFromUrl();
+
+    boolean authenticate(HttpServletResponse var1) throws IOException, ServletException;
+
+    void login(String var1, String var2) throws ServletException;
+
+    void logout() throws ServletException;
+
+    Collection<Part> getParts() throws IOException, ServletException;
+
+    Part getPart(String var1) throws IOException, ServletException;
+
+    <T extends HttpUpgradeHandler> T upgrade(Class<T> var1) throws IOException, ServletException;
+
+    default Map<String, String> getTrailerFields() {
+        return Collections.emptyMap();
+    }
+
+    default boolean isTrailerFieldsReady() {
+        return false;
+    }
+}
+
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java
new file mode 100644
index 000000000000..0a2c6af0913c
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java
@@ -0,0 +1,106 @@
+package javax.servlet.http;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Map;
+import java.util.function.Supplier;
+import javax.servlet.ServletResponse;
+
+public interface HttpServletResponse extends ServletResponse {
+    int SC_CONTINUE = 100;
+    int SC_SWITCHING_PROTOCOLS = 101;
+    int SC_OK = 200;
+    int SC_CREATED = 201;
+    int SC_ACCEPTED = 202;
+    int SC_NON_AUTHORITATIVE_INFORMATION = 203;
+    int SC_NO_CONTENT = 204;
+    int SC_RESET_CONTENT = 205;
+    int SC_PARTIAL_CONTENT = 206;
+    int SC_MULTIPLE_CHOICES = 300;
+    int SC_MOVED_PERMANENTLY = 301;
+    int SC_MOVED_TEMPORARILY = 302;
+    int SC_FOUND = 302;
+    int SC_SEE_OTHER = 303;
+    int SC_NOT_MODIFIED = 304;
+    int SC_USE_PROXY = 305;
+    int SC_TEMPORARY_REDIRECT = 307;
+    int SC_BAD_REQUEST = 400;
+    int SC_UNAUTHORIZED = 401;
+    int SC_PAYMENT_REQUIRED = 402;
+    int SC_FORBIDDEN = 403;
+    int SC_NOT_FOUND = 404;
+    int SC_METHOD_NOT_ALLOWED = 405;
+    int SC_NOT_ACCEPTABLE = 406;
+    int SC_PROXY_AUTHENTICATION_REQUIRED = 407;
+    int SC_REQUEST_TIMEOUT = 408;
+    int SC_CONFLICT = 409;
+    int SC_GONE = 410;
+    int SC_LENGTH_REQUIRED = 411;
+    int SC_PRECONDITION_FAILED = 412;
+    int SC_REQUEST_ENTITY_TOO_LARGE = 413;
+    int SC_REQUEST_URI_TOO_LONG = 414;
+    int SC_UNSUPPORTED_MEDIA_TYPE = 415;
+    int SC_REQUESTED_RANGE_NOT_SATISFIABLE = 416;
+    int SC_EXPECTATION_FAILED = 417;
+    int SC_INTERNAL_SERVER_ERROR = 500;
+    int SC_NOT_IMPLEMENTED = 501;
+    int SC_BAD_GATEWAY = 502;
+    int SC_SERVICE_UNAVAILABLE = 503;
+    int SC_GATEWAY_TIMEOUT = 504;
+    int SC_HTTP_VERSION_NOT_SUPPORTED = 505;
+
+    void addCookie(Cookie var1);
+
+    boolean containsHeader(String var1);
+
+    String encodeURL(String var1);
+
+    String encodeRedirectURL(String var1);
+
+    /** @deprecated */
+    @Deprecated
+    String encodeUrl(String var1);
+
+    /** @deprecated */
+    @Deprecated
+    String encodeRedirectUrl(String var1);
+
+    void sendError(int var1, String var2) throws IOException;
+
+    void sendError(int var1) throws IOException;
+
+    void sendRedirect(String var1) throws IOException;
+
+    void setDateHeader(String var1, long var2);
+
+    void addDateHeader(String var1, long var2);
+
+    void setHeader(String var1, String var2);
+
+    void addHeader(String var1, String var2);
+
+    void setIntHeader(String var1, int var2);
+
+    void addIntHeader(String var1, int var2);
+
+    void setStatus(int var1);
+
+    /** @deprecated */
+    @Deprecated
+    void setStatus(int var1, String var2);
+
+    int getStatus();
+
+    String getHeader(String var1);
+
+    Collection<String> getHeaders(String var1);
+
+    Collection<String> getHeaderNames();
+
+    default void setTrailerFields(Supplier<Map<String, String>> supplier) {
+    }
+
+    default Supplier<Map<String, String>> getTrailerFields() {
+        return null;
+    }
+}

From 01c13c470350c2784d427c5a47d68a198a503fd1 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 4 Mar 2021 16:14:11 +0300
Subject: [PATCH 029/433] Add files via upload

---
 ...ratorPrecedenceLogicErrorWhenUseBoolType.c | 11 +++++
 ...rPrecedenceLogicErrorWhenUseBoolType.qhelp | 28 +++++++++++
 ...atorPrecedenceLogicErrorWhenUseBoolType.ql | 48 +++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c
new file mode 100644
index 000000000000..8458d82f7ad2
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c
@@ -0,0 +1,11 @@
+if(len=funcReadData()==0) return 1; // BAD: variable `len` will not equal the value returned by function `funcReadData()`
+...
+if((len=funcReadData())==0) return 1; // GOOD: variable `len` equal the value returned by function `funcReadData()`
+...
+bool a=true;
+a++;// BAD: variable `a` does not change its meaning
+bool b;
+b=-a;// BAD: variable `b` equal `true`
+...
+a=false;// GOOD: variable `a` equal `false`
+b=!a;// GOOD: variable `b` equal `false`
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp
new file mode 100644
index 000000000000..8114da831feb
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Finding places of confusing use of boolean type. For example, a unary minus does not work before a boolean type and an increment always gives true.</p>
+
+
+</overview>
+<recommendation>
+
+<p>we recommend making the code simpler.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates erroneous and fixed methods for using a boolean data type.</p>
+<sample src="OperatorPrecedenceLogicErrorWhenUseBoolType.c" />
+
+</example>
+<references>
+
+<li>
+  CERT C Coding Standard:
+  <a href="https://wiki.sei.cmu.edu/confluence/display/c/EXP00-C.+Use+parentheses+for+precedence+of+operation">EXP00-C. Use parentheses for precedence of operation</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
new file mode 100644
index 000000000000..1a116a83dbf7
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
@@ -0,0 +1,48 @@
+/**
+ * @name Operator Precedence Logic Error When Use Bool Type
+ * @description --Finding places of confusing use of boolean type.
+ *              --For example, a unary minus does not work before a boolean type and an increment always gives true.
+ * @kind problem
+ * @id cpp/operator-precedence-logic-error-when-use-bool-type
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-783
+ *       external/cwe/cwe-480
+ */
+
+import cpp
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+/** Holds, if it is an expression, a boolean increment. */
+predicate incrementBoolType(Expr exp) {
+  exp.(IncrementOperation).getOperand().getType() instanceof BoolType
+}
+
+/** Holds, if this is an expression, applies a minus to a boolean type. */
+predicate revertSignBoolType(Expr exp) {
+  exp.(AssignExpr).getRValue().(UnaryMinusExpr).getAnOperand().getType() instanceof BoolType and
+  exp.(AssignExpr).getLValue().getType() instanceof BoolType
+}
+
+/** Holds, if this is an expression, uses comparison and assignment outside of execution precedence. */
+predicate assignBoolType(Expr exp) {
+  exists(ComparisonOperation co |
+    exp.(AssignExpr).getRValue() = co and
+    exp.isCondition() and
+    not co.isParenthesised() and
+    not exp.(AssignExpr).getLValue().getType() instanceof BoolType and
+    co.getLeftOperand() instanceof FunctionCall and
+    not co.getRightOperand().getType() instanceof BoolType and
+    not co.getRightOperand().getValue() = "0" and
+    not co.getRightOperand().getValue() = "1"
+  )
+}
+
+from Expr exp
+where
+  incrementBoolType(exp) or
+  revertSignBoolType(exp) or
+  assignBoolType(exp)
+select exp, "this expression needs attention"

From 10cc57428907c41e08786242051028c996935ef3 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 4 Mar 2021 16:15:26 +0300
Subject: [PATCH 030/433] Add files via upload

---
 ...ecedenceLogicErrorWhenUseBoolType.expected |  5 ++++
 ...rPrecedenceLogicErrorWhenUseBoolType.qlref |  1 +
 .../CWE/CWE-788/semmle/tests/test.cpp         | 26 +++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
new file mode 100644
index 000000000000..76062fc360a3
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
@@ -0,0 +1,5 @@
+| test.cpp:10:3:10:10 | ... = ... | this expression needs attention |
+| test.cpp:12:3:12:6 | ... ++ | this expression needs attention |
+| test.cpp:13:3:13:6 | ++ ... | this expression needs attention |
+| test.cpp:14:6:14:21 | ... = ... | this expression needs attention |
+| test.cpp:16:6:16:21 | ... = ... | this expression needs attention |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
new file mode 100644
index 000000000000..5189abcce5d1
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp
new file mode 100644
index 000000000000..f08d2a45757f
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp
@@ -0,0 +1,26 @@
+int tmpFunc()
+{
+  return 12;
+}
+void testFunction()
+{
+  int i1,i2,i3;
+  bool b1,b2,b3;
+  char c1,c2,c3;
+  b1 = -b2; //BAD
+  b1 = !b2; //GOOD
+  b1++; //BAD
+  ++b1; //BAD
+  if(i1=tmpFunc()!=i2) //BAD
+    return;
+  if(i1=tmpFunc()!=11) //BAD
+    return;
+  if((i1=tmpFunc())!=i2) //GOOD
+    return;
+  if((i1=tmpFunc())!=11) //GOOD
+    return;
+  if(i1=tmpFunc()!=1) //GOOD
+    return;
+  if(i1=tmpFunc()==b1) //GOOD
+    return;
+}

From 919c6b4b0aae6053a1b4b4d1e3657ac50e4a94f5 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 5 Mar 2021 02:50:54 +0000
Subject: [PATCH 031/433] Optimize flow steps

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 36 ++++++++++---------
 .../SensitiveCookieNotHttpOnly.expected       | 10 ++++--
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  | 13 +++++--
 3 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index d9104cbad970..f22e99e567c8 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -8,6 +8,7 @@
  */
 
 import java
+import semmle.code.java.dataflow.FlowSteps
 import semmle.code.java.frameworks.Servlets
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow::PathGraph
@@ -41,18 +42,31 @@ class SetCookieMethodAccess extends MethodAccess {
   }
 }
 
+/** The cookie class of Java EE. */
+class CookieClass extends RefType {
+  CookieClass() {
+    this.getASupertype*()
+        .hasQualifiedName(["javax.servlet.http", "javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
+  }
+}
+
+/** The method call `toString` to get a stringified cookie representation. */
+class CookieInstanceExpr extends TaintPreservingCallable {
+  CookieInstanceExpr() {
+    this.getDeclaringType() instanceof CookieClass and
+    this.hasName("toString")
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+}
+
 /** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() {
     exists(
       ClassInstanceExpr cie // new Cookie("jwt_token", token)
     |
-      (
-        cie.getConstructedType().hasQualifiedName("javax.servlet.http", "Cookie") or
-        cie.getConstructedType()
-            .getASupertype*()
-            .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
-      ) and
+      cie.getConstructedType() instanceof CookieClass and
       this = cie and
       isSensitiveCookieNameExpr(cie.getArgument(0))
     )
@@ -169,16 +183,6 @@ class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
     // Test class or method
     isTestMethod(node)
   }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(
-      MethodAccess ma // `toString` call on a cookie object
-    |
-      ma.getQualifier() = pred.asExpr() and
-      ma.getMethod().hasName("toString") and
-      ma = succ.asExpr()
-    )
-  }
 }
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, MissingHttpOnlyConfiguration c
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index e2d05a9b24d8..5ccd2bb19f92 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -1,13 +1,17 @@
 edges
-| SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
 | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) |
+| SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr |
 nodes
-| SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | semmle.label | jwtCookie |
 | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | semmle.label | ... + ... |
 | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
 | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | semmle.label | toString(...) |
+| SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
+| SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | semmle.label | keyStr |
 #select
-| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:27:22:60 | new Cookie(...) | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 5e4f349f7c88..1d1e6986b44a 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -10,7 +10,7 @@
 class SensitiveCookieNotHttpOnly {
     // GOOD - Tests adding a sensitive cookie with the `HttpOnly` flag set.
     public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
-        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        Cookie jwtCookie = new Cookie("jwt_token", jwt_token);
         jwtCookie.setPath("/");
         jwtCookie.setMaxAge(3600*24*7);
         jwtCookie.setHttpOnly(true);
@@ -19,8 +19,8 @@ public void addCookie(String jwt_token, HttpServletRequest request, HttpServletR
 
     // BAD - Tests adding a sensitive cookie without the `HttpOnly` flag set.
     public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
-        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
-        Cookie userIdCookie =new Cookie("user_id", userId.toString());
+        Cookie jwtCookie = new Cookie("jwt_token", jwt_token);
+        Cookie userIdCookie = new Cookie("user_id", userId);
         jwtCookie.setPath("/");
         userIdCookie.setPath("/");
         jwtCookie.setMaxAge(3600*24*7);
@@ -54,4 +54,11 @@ public void addCookie7(String accessKey, HttpServletRequest request, HttpServlet
         NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true);
         response.setHeader("Set-Cookie", accessKeyCookie.toString());
     }
+
+    // BAD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie8(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, 0, null, 86400, true);
+        String keyStr = accessKeyCookie.toString();
+        response.setHeader("Set-Cookie", keyStr);
+    }
 }

From a93aabab408442a96a9ae8e46718f94291b269b8 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 5 Mar 2021 03:05:49 +0000
Subject: [PATCH 032/433] Add the toString() method

---
 .../jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java  | 11 +++++++++++
 .../servlet-api-2.4/javax/servlet/http/Cookie.java    | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
index 7f2e3ec05351..26279d7fe0a9 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
@@ -320,4 +320,15 @@ public boolean isHttpOnly() {
     public Cookie toCookie() {
         return null;
     }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }    
 }
\ No newline at end of file
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
index a93fec853e06..47b1d883e474 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
@@ -114,4 +114,15 @@ public void setHttpOnly(boolean isHttpOnly) {
     public boolean isHttpOnly() {
         return isHttpOnly;
     }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }    
 }

From 7d556b354de8cec425caab93fcdd9db0a1ac5ffc Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 5 Mar 2021 09:16:35 +0100
Subject: [PATCH 033/433] Python: Update test annotation and expectation

---
 .../test/query-tests/Security/CWE-327/InsecureProtocol.expected | 2 ++
 python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py       | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index afd9cc15d9f4..f4202a4634d5 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -38,3 +38,5 @@
 | ssl_fluent.py:124:14:124:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:122:5:122:11 | ControlFlowNode for context | context modification |
 | ssl_fluent.py:173:14:173:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:170:5:170:11 | ControlFlowNode for context | context modification |
 | ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:189:5:189:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index ab65e3bd2068..577f342765ee 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -189,5 +189,5 @@ def test_fluent_explicitly_unsafe():
     context.options &= ~ssl.OP_NO_SSLv3
 
     with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:  # SSLv3 not flagged here
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
             print(ssock.version())

From 31eaa80f5b881531bc66551e568fed1ffc380325 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Sat, 6 Mar 2021 00:56:15 +0000
Subject: [PATCH 034/433] Revamp the source

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 24 ++++------
 .../SensitiveCookieNotHttpOnly.expected       | 44 +++++++++++++------
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  |  9 +++-
 3 files changed, 46 insertions(+), 31 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index f22e99e567c8..229a9d503253 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -60,24 +60,16 @@ class CookieInstanceExpr extends TaintPreservingCallable {
   override predicate returnsTaintFrom(int arg) { arg = -1 }
 }
 
+/** The cookie constructor. */
+class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
+  CookieTaintPreservingConstructor() { this.getDeclaringType() instanceof CookieClass }
+
+  override predicate returnsTaintFrom(int arg) { arg = 0 }
+}
+
 /** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
 class SensitiveCookieNameExpr extends Expr {
-  SensitiveCookieNameExpr() {
-    exists(
-      ClassInstanceExpr cie // new Cookie("jwt_token", token)
-    |
-      cie.getConstructedType() instanceof CookieClass and
-      this = cie and
-      isSensitiveCookieNameExpr(cie.getArgument(0))
-    )
-    or
-    exists(
-      SetCookieMethodAccess ma // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
-    |
-      this = ma.getArgument(1) and
-      isSensitiveCookieNameExpr(this)
-    )
-  }
+  SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
 }
 
 /** Sink of adding a cookie to the HTTP response. */
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index 5ccd2bb19f92..c9fe15d4082c 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -1,17 +1,33 @@
 edges
-| SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie |
-| SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) |
-| SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr |
+| SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) |
+| SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr |
+| SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
+| SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
+| SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
 nodes
-| SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
-| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | semmle.label | jwtCookie |
-| SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | semmle.label | ... + ... |
-| SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
-| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | semmle.label | toString(...) |
-| SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
-| SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | semmle.label | keyStr |
+| SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | semmle.label | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | semmle.label | ... + ... |
+| SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | semmle.label | toString(...) |
+| SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | semmle.label | keyStr |
+| SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | semmle.label | secString |
 #select
-| SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:28:28:28:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:28:22:61 | new Cookie(...) | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:39:42:39:69 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:49:42:49:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:49:42:49:113 | new NewCookie(...) | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:62:42:62:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:60:37:60:115 | new NewCookie(...) | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 1d1e6986b44a..6572577a6976 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -19,7 +19,8 @@ public void addCookie(String jwt_token, HttpServletRequest request, HttpServletR
 
     // BAD - Tests adding a sensitive cookie without the `HttpOnly` flag set.
     public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
-        Cookie jwtCookie = new Cookie("jwt_token", jwt_token);
+        String tokenCookieStr = "jwt_token";
+        Cookie jwtCookie = new Cookie(tokenCookieStr, jwt_token);
         Cookie userIdCookie = new Cookie("user_id", userId);
         jwtCookie.setPath("/");
         userIdCookie.setPath("/");
@@ -61,4 +62,10 @@ public void addCookie8(String accessKey, HttpServletRequest request, HttpServlet
         String keyStr = accessKeyCookie.toString();
         response.setHeader("Set-Cookie", keyStr);
     }
+
+    // BAD - Tests set a sensitive cookie header using a variable without the `HttpOnly` flag set.
+    public void addCookie9(String authId, HttpServletRequest request, HttpServletResponse response) {
+        String secString = "token=" +authId + ";Secure";
+        response.addHeader("Set-Cookie", secString);
+    }    
 }

From 48975fa7d220b7debe5d0c8a0b84c8ec64351435 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 10 Mar 2021 00:17:26 +0000
Subject: [PATCH 035/433] Replace sanitizers

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 105 +++++++-----------
 1 file changed, 41 insertions(+), 64 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 229a9d503253..716975d0486b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -50,23 +50,6 @@ class CookieClass extends RefType {
   }
 }
 
-/** The method call `toString` to get a stringified cookie representation. */
-class CookieInstanceExpr extends TaintPreservingCallable {
-  CookieInstanceExpr() {
-    this.getDeclaringType() instanceof CookieClass and
-    this.hasName("toString")
-  }
-
-  override predicate returnsTaintFrom(int arg) { arg = -1 }
-}
-
-/** The cookie constructor. */
-class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
-  CookieTaintPreservingConstructor() { this.getDeclaringType() instanceof CookieClass }
-
-  override predicate returnsTaintFrom(int arg) { arg = 0 }
-}
-
 /** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
@@ -78,55 +61,58 @@ class CookieResponseSink extends DataFlow::ExprNode {
     exists(MethodAccess ma |
       (
         ma.getMethod() instanceof ResponseAddCookieMethod and
-        this.getExpr() = ma.getArgument(0)
+        this.getExpr() = ma.getArgument(0) and
+        not exists(
+          MethodAccess ma2 // cookie.setHttpOnly(true)
+        |
+          ma2.getMethod().getName() = "setHttpOnly" and
+          ma2.getArgument(0).(BooleanLiteral).getBooleanValue() = true and
+          DataFlow::localExprFlow(ma2.getQualifier(), this.getExpr())
+        )
         or
         ma instanceof SetCookieMethodAccess and
-        this.getExpr() = ma.getArgument(1)
+        this.getExpr() = ma.getArgument(1) and
+        not hasHttpOnlyExpr(this.getExpr()) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
       )
     )
   }
 }
 
-/**
- * Holds if `node` is an access to a variable which has `setHttpOnly(true)` called on it and is also
- * the first argument to a call to the method `addCookie` of `javax.servlet.http.HttpServletResponse`.
- */
-predicate setHttpOnlyMethodAccess(DataFlow::Node node) {
-  exists(
-    MethodAccess addCookie, Variable cookie, MethodAccess m // jwtCookie.setHttpOnly(true)
-  |
-    addCookie.getMethod() instanceof ResponseAddCookieMethod and
-    addCookie.getArgument(0) = cookie.getAnAccess() and
-    m.getMethod().getName() = "setHttpOnly" and
-    m.getArgument(0).(BooleanLiteral).getBooleanValue() = true and
-    m.getQualifier() = cookie.getAnAccess() and
-    node.asExpr() = cookie.getAnAccess()
-  )
+/** A JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+class HttpOnlyNewCookie extends ClassInstanceExpr {
+  HttpOnlyNewCookie() {
+    this.getConstructedType()
+        .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
+    (
+      this.getNumArgument() = 6 and this.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+      or
+      this.getNumArgument() = 8 and
+      this.getArgument(6).getType() instanceof BooleanType and
+      this.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+      or
+      this.getNumArgument() = 10 and this.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    )
+  }
 }
 
-/**
- * Holds if `node` is a string that contains `httponly` and which flows to the second argument
- * of a method to set a cookie.
- */
-predicate setHttpOnlyInSetCookie(DataFlow::Node node) {
-  exists(SetCookieMethodAccess sa |
-    hasHttpOnlyExpr(node.asExpr()) and
-    DataFlow::localExprFlow(node.asExpr(), sa.getArgument(1))
-  )
+/** The cookie constructor. */
+class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
+  CookieTaintPreservingConstructor() {
+    this.getDeclaringType() instanceof CookieClass and
+    not exists(HttpOnlyNewCookie hie | hie.getConstructor() = this)
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = 0 }
 }
 
-/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
-predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
-  cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
-  (
-    cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-    or
-    cie.getNumArgument() = 8 and
-    cie.getArgument(6).getType() instanceof BooleanType and
-    cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
-    or
-    cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-  )
+/** The method call `toString` to get a stringified cookie representation. */
+class CookieInstanceExpr extends TaintPreservingCallable {
+  CookieInstanceExpr() {
+    this.getDeclaringType() instanceof CookieClass and
+    this.hasName("toString")
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
 }
 
 /**
@@ -163,15 +149,6 @@ class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof CookieResponseSink }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    // cookie.setHttpOnly(true)
-    setHttpOnlyMethodAccess(node)
-    or
-    // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
-    setHttpOnlyInSetCookie(node)
-    or
-    // new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)
-    setHttpOnlyInNewCookie(node.asExpr())
-    or
     // Test class or method
     isTestMethod(node)
   }

From 72f28513eb6478024cb184f9affe71490c8217d3 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 10 Mar 2021 12:12:27 +0000
Subject: [PATCH 036/433] Move test check to the sink

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 44 ++++++++-----------
 1 file changed, 19 insertions(+), 25 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 716975d0486b..eee4d8c89d17 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -73,34 +73,29 @@ class CookieResponseSink extends DataFlow::ExprNode {
         ma instanceof SetCookieMethodAccess and
         this.getExpr() = ma.getArgument(1) and
         not hasHttpOnlyExpr(this.getExpr()) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
-      )
+      ) and
+      not isTestMethod(ma) // Test class or method
     )
   }
 }
 
-/** A JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
-class HttpOnlyNewCookie extends ClassInstanceExpr {
-  HttpOnlyNewCookie() {
-    this.getConstructedType()
-        .hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
-    (
-      this.getNumArgument() = 6 and this.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-      or
-      this.getNumArgument() = 8 and
-      this.getArgument(6).getType() instanceof BooleanType and
-      this.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
-      or
-      this.getNumArgument() = 10 and this.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
-    )
-  }
+/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
+  cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
+  (
+    cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 8 and
+    cie.getArgument(6).getType() instanceof BooleanType and
+    cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+  )
 }
 
 /** The cookie constructor. */
 class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
-  CookieTaintPreservingConstructor() {
-    this.getDeclaringType() instanceof CookieClass and
-    not exists(HttpOnlyNewCookie hie | hie.getConstructor() = this)
-  }
+  CookieTaintPreservingConstructor() { this.getDeclaringType() instanceof CookieClass }
 
   override predicate returnsTaintFrom(int arg) { arg = 0 }
 }
@@ -122,9 +117,8 @@ class CookieInstanceExpr extends TaintPreservingCallable {
  *    c) in a test class whose name has the word `test`
  *    d) in a test class implementing a test framework such as JUnit or TestNG
  */
-predicate isTestMethod(DataFlow::Node node) {
-  exists(MethodAccess ma, Method m |
-    node.asExpr() = ma.getAnArgument() and
+predicate isTestMethod(MethodAccess ma) {
+  exists(Method m |
     m = ma.getEnclosingCallable() and
     (
       m.getDeclaringType().getName().toLowerCase().matches("%test%") or // Simple check to exclude test classes to reduce FPs
@@ -149,8 +143,8 @@ class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof CookieResponseSink }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    // Test class or method
-    isTestMethod(node)
+    // new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)
+    setHttpOnlyInNewCookie(node.asExpr())
   }
 }
 

From f0ddfc9283607f01603a93e6a05357aa27a579ce Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 10 Mar 2021 12:18:55 +0000
Subject: [PATCH 037/433] Minor qldoc changes

---
 .../Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql    | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index eee4d8c89d17..c3f9349dbc8b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -79,7 +79,10 @@ class CookieResponseSink extends DataFlow::ExprNode {
   }
 }
 
-/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+/**
+ * Holds if `ClassInstanceExpr` cie is an invocation of a JAX-RS `NewCookie` constructor
+ * that sets `HttpOnly` to true.
+ */
 predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
   cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
   (
@@ -111,7 +114,7 @@ class CookieInstanceExpr extends TaintPreservingCallable {
 }
 
 /**
- * Holds if the node is a test method indicated by:
+ * Holds if the MethodAccess `ma` is a test method call indicated by:
  *    a) in a test directory such as `src/test/java`
  *    b) in a test package whose name has the word `test`
  *    c) in a test class whose name has the word `test`

From a0a1ddee86382c183b774e9cb88509a1b4aac1d9 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Wed, 10 Mar 2021 17:07:31 +0000
Subject: [PATCH 038/433] Update class name

---
 .../Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index c3f9349dbc8b..985c546b5552 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -104,8 +104,8 @@ class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCalla
 }
 
 /** The method call `toString` to get a stringified cookie representation. */
-class CookieInstanceExpr extends TaintPreservingCallable {
-  CookieInstanceExpr() {
+class CookieToString extends TaintPreservingCallable {
+  CookieToString() {
     this.getDeclaringType() instanceof CookieClass and
     this.hasName("toString")
   }

From eeac7e322ad0d450f8dac1f0dad9195e4d3b8c33 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Thu, 11 Mar 2021 13:46:32 +0000
Subject: [PATCH 039/433] Query to detect insecure configuration of Spring Boot
 Actuator

---
 .../InsecureSpringActuatorConfig.qhelp        |  47 ++++++++
 .../CWE-016/InsecureSpringActuatorConfig.ql   | 112 ++++++++++++++++++
 .../CWE/CWE-016/application.properties        |  22 ++++
 .../Security/CWE/CWE-016/pom_bad.xml          |  50 ++++++++
 .../Security/CWE/CWE-016/pom_good.xml         |  50 ++++++++
 .../InsecureSpringActuatorConfig.expected     |   1 +
 .../InsecureSpringActuatorConfig.qlref        |   1 +
 .../security/CWE-016/SensitiveInfo.java       |  13 ++
 .../security/CWE-016/application.properties   |  14 +++
 .../query-tests/security/CWE-016/pom.xml      |  47 ++++++++
 10 files changed, 357 insertions(+)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-016/application.properties
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-016/application.properties
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-016/pom.xml

diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
new file mode 100644
index 000000000000..e201156728a4
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
@@ -0,0 +1,47 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>Spring Boot is a popular framework that facilitates the development of stand-alone applications
+and micro services. Spring Boot Actuator helps to expose production-ready support features against 
+Spring Boot applications.</p>
+
+    <p>Endpoints of Spring Boot Actuator allow to monitor and interact with a Spring Boot application. 
+Exposing unprotected actuator endpoints through configuration files can lead to information disclosure 
+or even remote code execution vulnerability.</p>
+
+    <p>Rather than programmatically permitting endpoint requests or enforcing access control, frequently
+developers simply leave management endpoints publicly accessible in the application configuration file 
+<code>application.properties</code> without enforcing access control through Spring Security.</p>
+  </overview>
+
+  <recommendation>
+    <p>Declare the Spring Boot Starter Security module in XML configuration or programmatically enforce 
+security checks on management endpoints using Spring Security. Otherwise accessing management endpoints 
+on a different HTTP port other than the port that the web application is listening on also helps to 
+improve the security.</p>
+  </recommendation>
+
+  <example>
+    <p>The following examples show both 'BAD' and 'GOOD' configurations. In the 'BAD' configuration, 
+no security module is declared and sensitive management endpoints are exposed. In the 'GOOD' configuration, 
+security is enforced and only endpoints requiring exposure are exposed.</p>
+    <sample src="pom_good.xml" />
+    <sample src="pom_bad.xml" />
+    <sample src="application.properties" />
+  </example>
+
+  <references>
+    <li>
+      Spring Boot documentation:
+      <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html">Spring Boot Actuator: Production-ready Features</a>
+    </li>
+    <li>
+      VERACODE Blog:
+      <a href="https://www.veracode.com/blog/research/exploiting-spring-boot-actuators">Exploiting Spring Boot Actuators</a>
+    </li>
+    <li>
+      HackerOne Report:
+      <a href="https://hackerone.com/reports/862589">Spring Actuator endpoints publicly available, leading to account takeover</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
new file mode 100644
index 000000000000..2dc11e8e38ef
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -0,0 +1,112 @@
+/**
+ * @name Insecure Spring Boot Actuator Configuration
+ * @description Exposed Spring Boot Actuator through configuration files without declarative or procedural security enforcement leads to information leak or even remote code execution.
+ * @kind problem
+ * @id java/insecure-spring-actuator-config
+ * @tags security
+ *       external/cwe-016
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+import semmle.code.java.security.SensitiveActions
+import semmle.code.xml.MavenPom
+
+/** The parent node of the `org.springframework.boot` group. */
+class SpringBootParent extends Parent {
+  SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
+}
+
+/** Class of Spring Boot dependencies. */
+class SpringBootPom extends Pom {
+  SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
+
+  /** Holds if the Spring Boot Actuator module `spring-boot-starter-actuator` is used in the project. */
+  predicate isSpringBootActuatorUsed() {
+    this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
+  }
+
+  /** Holds if the Spring Boot Security module is used in the project, which brings in other security related libraries. */
+  predicate isSpringBootSecurityUsed() {
+    this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
+  }
+}
+
+/** The properties file `application.properties`. */
+class ApplicationProperties extends ConfigPair {
+  ApplicationProperties() { this.getFile().getBaseName() = "application.properties" }
+}
+
+/** The configuration property `management.security.enabled`. */
+class ManagementSecurityEnabled extends ApplicationProperties {
+  ManagementSecurityEnabled() { this.getNameElement().getName() = "management.security.enabled" }
+
+  string getManagementSecurityEnabled() { result = this.getValueElement().getValue() }
+
+  predicate hasSecurityDisabled() { getManagementSecurityEnabled() = "false" }
+
+  predicate hasSecurityEnabled() { getManagementSecurityEnabled() = "true" }
+}
+
+/** The configuration property `management.endpoints.web.exposure.include`. */
+class ManagementEndPointInclude extends ApplicationProperties {
+  ManagementEndPointInclude() {
+    this.getNameElement().getName() = "management.endpoints.web.exposure.include"
+  }
+
+  string getManagementEndPointInclude() { result = this.getValueElement().getValue().trim() }
+}
+
+/** The configuration property `management.endpoints.web.exposure.exclude`. */
+class ManagementEndPointExclude extends ApplicationProperties {
+  ManagementEndPointExclude() {
+    this.getNameElement().getName() = "management.endpoints.web.exposure.exclude"
+  }
+
+  string getManagementEndPointExclude() { result = this.getValueElement().getValue().trim() }
+}
+
+/** Holds if an application handles sensitive information judging by its variable names. */
+predicate isProtectedApp() {
+  exists(VarAccess va | va.getVariable().getName().regexpMatch(getCommonSensitiveInfoRegex()))
+}
+
+from SpringBootPom pom, ApplicationProperties ap, Dependency d
+where
+  isProtectedApp() and
+  pom.isSpringBootActuatorUsed() and
+  not pom.isSpringBootSecurityUsed() and
+  ap.getFile()
+      .getParentContainer()
+      .getAbsolutePath()
+      .matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
+  exists(string s | s = pom.getParentElement().getVersionString() |
+    s.regexpMatch("1\\.[0|1|2|3|4].*") and
+    not exists(ManagementSecurityEnabled me |
+      me.hasSecurityEnabled() and me.getFile() = ap.getFile()
+    )
+    or
+    s.regexpMatch("1\\.5.*") and
+    exists(ManagementSecurityEnabled me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
+    or
+    s.regexpMatch("2.*") and
+    exists(ManagementEndPointInclude mi |
+      mi.getFile() = ap.getFile() and
+      (
+        mi.getManagementEndPointInclude() = "*" // all endpoints are enabled
+        or
+        mi.getManagementEndPointInclude()
+            .matches([
+                "%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
+                "%beans%", "%sessions%"
+              ]) // all endpoints apart from '/health' and '/info' are considered sensitive
+      ) and
+      not exists(ManagementEndPointExclude mx |
+        mx.getFile() = ap.getFile() and
+        mx.getManagementEndPointExclude() = mi.getManagementEndPointInclude()
+      )
+    )
+  ) and
+  d = pom.getADependency() and
+  d.getArtifact().getValue() = "spring-boot-starter-actuator"
+select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
new file mode 100644
index 000000000000..aa489435a12b
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
@@ -0,0 +1,22 @@
+#management.endpoints.web.base-path=/admin
+
+
+#### BAD: All management endpoints are accessible #### 
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
+
+# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=false
+
+# vulnerable configuration (spring boot 2+): exposes health and info only by default
+management.endpoints.web.exposure.include=*
+
+
+#### GOOD: All management endpoints have access control #### 
+# safe configuration (spring boot 1.0 - 1.4): exposes actuators by default
+management.security.enabled=true
+
+# safe configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=true
+
+# safe configuration (spring boot 2+): exposes health and info only by default
+management.endpoints.web.exposure.include=beans,info,health
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml b/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
new file mode 100644
index 000000000000..9dd5c9c188b4
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+
+        <!-- BAD: No Spring Security enabled -->
+        <!-- dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency -->
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml b/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
new file mode 100644
index 000000000000..89f577f21e59
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+
+        <!-- GOOD: Enable Spring Security -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
new file mode 100644
index 000000000000..486302939857
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
@@ -0,0 +1 @@
+| pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
new file mode 100644
index 000000000000..9cd12d5e4fb1
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java b/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
new file mode 100644
index 000000000000..a3ff69c1b817
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
@@ -0,0 +1,13 @@
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class SensitiveInfo {
+	@RequestMapping
+	public void handleLogin(@RequestParam String username, @RequestParam String password) throws Exception {
+		if (!username.equals("") && password.equals("")) {
+			//Blank processing
+		}
+	}
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
new file mode 100644
index 000000000000..95e704f3a1a5
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
@@ -0,0 +1,14 @@
+#management.endpoints.web.base-path=/admin
+
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
+
+# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=false
+
+# vulnerable configuration (spring boot 2+): exposes health and info only by default
+management.endpoints.web.exposure.include=*
+management.endpoints.web.exposure.exclude=beans
+
+management.endpoint.shutdown.enabled=true
+
+management.endpoint.health.show-details=when_authorized
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml b/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
new file mode 100644
index 000000000000..a9d5fa920c84
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+        <!-- dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file

From 0a35feef766249b88abfc78f8a9dd552664ab083 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Thu, 11 Mar 2021 17:28:07 +0000
Subject: [PATCH 040/433] Exclude CSRF cookies to reduce FPs

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 16 +++--
 .../SensitiveCookieNotHttpOnly.expected       | 60 +++++++++----------
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  | 22 ++++++-
 .../query-tests/security/CWE-1004/options     |  2 +-
 .../security/web/csrf/CsrfToken.java          | 50 ++++++++++++++++
 5 files changed, 113 insertions(+), 37 deletions(-)
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 985c546b5552..693dad68082c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -16,12 +16,18 @@ import DataFlow::PathGraph
 /** Gets a regular expression for matching common names of sensitive cookies. */
 string getSensitiveCookieNameRegex() { result = "(?i).*(auth|session|token|key|credential).*" }
 
-/** Holds if a string is concatenated with the name of a sensitive cookie. */
+/** Gets a regular expression for matching CSRF cookies. */
+string getCsrfCookieNameRegex() { result = "(?i).*(csrf).*" }
+
+/**
+ * Holds if a string is concatenated with the name of a sensitive cookie. Excludes CSRF cookies since
+ * they are special cookies implementing the Synchronizer Token Pattern that can be used in JavaScript.
+ */
 predicate isSensitiveCookieNameExpr(Expr expr) {
-  expr.(CompileTimeConstantExpr)
-      .getStringValue()
-      .toLowerCase()
-      .regexpMatch(getSensitiveCookieNameRegex()) or
+  exists(string s | s = expr.(CompileTimeConstantExpr).getStringValue().toLowerCase() |
+    s.regexpMatch(getSensitiveCookieNameRegex()) and not s.regexpMatch(getCsrfCookieNameRegex())
+  )
+  or
   isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
 }
 
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index c9fe15d4082c..8fa688bef2a6 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -1,33 +1,33 @@
 edges
-| SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie |
-| SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... |
-| SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... |
-| SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) |
-| SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr |
-| SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
-| SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
-| SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString |
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) |
+| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr |
+| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 nodes
-| SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
-| SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | semmle.label | jwtCookie |
-| SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | semmle.label | "token=" : String |
-| SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | semmle.label | ... + ... : String |
-| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | semmle.label | ... + ... |
-| SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | semmle.label | toString(...) |
-| SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
-| SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | semmle.label | "session-access-key" : String |
-| SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | semmle.label | keyStr |
-| SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | semmle.label | "token=" : String |
-| SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | semmle.label | ... + ... : String |
-| SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | semmle.label | ... + ... : String |
-| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | semmle.label | secString |
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | semmle.label | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | semmle.label | ... + ... |
+| SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | semmle.label | toString(...) |
+| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | semmle.label | keyStr |
+| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | semmle.label | secString |
 #select
-| SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:29:28:29:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:22:33:22:43 | "jwt_token" | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:49 | "token=" | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:57 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:40:42:40:69 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:50:42:50:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:50:56:50:75 | "session-access-key" | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:63:42:63:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:61:51:61:70 | "session-access-key" | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:35 | "token=" | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:43 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:69:42:69:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:68:28:68:55 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 6572577a6976..337a99cc096d 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -7,6 +7,8 @@
 
 import javax.ws.rs.core.NewCookie;
 
+import org.springframework.security.web.csrf.CsrfToken;
+
 class SensitiveCookieNotHttpOnly {
     // GOOD - Tests adding a sensitive cookie with the `HttpOnly` flag set.
     public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
@@ -67,5 +69,23 @@ public void addCookie8(String accessKey, HttpServletRequest request, HttpServlet
     public void addCookie9(String authId, HttpServletRequest request, HttpServletResponse response) {
         String secString = "token=" +authId + ";Secure";
         response.addHeader("Set-Cookie", secString);
-    }    
+    }
+
+    // GOOD - CSRF token doesn't need to have the `HttpOnly` flag set.
+    public void addCsrfCookie(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        // Spring put the CSRF token in session attribute "_csrf"
+        CsrfToken csrfToken = (CsrfToken) request.getAttribute("_csrf");
+    
+        // Send the cookie only if the token has changed
+        String actualToken = request.getHeader("X-CSRF-TOKEN");
+        if (actualToken == null || !actualToken.equals(csrfToken.getToken())) {
+            // Session cookie that can be used by AngularJS
+            String pCookieName = "CSRF-TOKEN";
+            Cookie cookie = new Cookie(pCookieName, csrfToken.getToken());
+            cookie.setMaxAge(-1);
+            cookie.setHttpOnly(false);
+            cookie.setPath("/");
+            response.addCookie(cookie);
+        }
+    }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/options b/java/ql/test/experimental/query-tests/security/CWE-1004/options
index 7f2b253fb20d..d61a358d97f0 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/options
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/options
@@ -1 +1 @@
-// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jsr311-api-1.1.1
\ No newline at end of file
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jsr311-api-1.1.1:${testdir}/../../../../stubs/springframework-5.2.3
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java
new file mode 100644
index 000000000000..bc59a2e496a5
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.csrf;
+
+import java.io.Serializable;
+
+/**
+ * Provides the information about an expected CSRF token.
+ *
+ * @author Rob Winch
+ * @since 3.2
+ * @see DefaultCsrfToken
+ */
+public interface CsrfToken extends Serializable {
+
+	/**
+	 * Gets the HTTP header that the CSRF is populated on the response and can be placed
+	 * on requests instead of the parameter. Cannot be null.
+	 * @return the HTTP header that the CSRF is populated on the response and can be
+	 * placed on requests instead of the parameter
+	 */
+	String getHeaderName();
+
+	/**
+	 * Gets the HTTP parameter name that should contain the token. Cannot be null.
+	 * @return the HTTP parameter name that should contain the token.
+	 */
+	String getParameterName();
+
+	/**
+	 * Gets the token value. Cannot be null.
+	 * @return the token value
+	 */
+	String getToken();
+
+}

From c8b1bc3a89b6f0c6b006449f38f4966899f0bc3d Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Thu, 11 Mar 2021 21:41:34 +0000
Subject: [PATCH 041/433] Enhance the query

---
 .../CWE-016/InsecureSpringActuatorConfig.ql   | 58 +++++++------------
 .../CWE/CWE-016/application.properties        |  4 +-
 .../security/CWE-016/application.properties   |  2 +-
 3 files changed, 24 insertions(+), 40 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
index 2dc11e8e38ef..06ba0d8a288e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -1,6 +1,7 @@
 /**
  * @name Insecure Spring Boot Actuator Configuration
- * @description Exposed Spring Boot Actuator through configuration files without declarative or procedural security enforcement leads to information leak or even remote code execution.
+ * @description Exposed Spring Boot Actuator through configuration files without declarative or procedural
+ *              security enforcement leads to information leak or even remote code execution.
  * @kind problem
  * @id java/insecure-spring-actuator-config
  * @tags security
@@ -9,7 +10,6 @@
 
 import java
 import semmle.code.configfiles.ConfigFiles
-import semmle.code.java.security.SensitiveActions
 import semmle.code.xml.MavenPom
 
 /** The parent node of the `org.springframework.boot` group. */
@@ -26,7 +26,10 @@ class SpringBootPom extends Pom {
     this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
   }
 
-  /** Holds if the Spring Boot Security module is used in the project, which brings in other security related libraries. */
+  /**
+   * Holds if the Spring Boot Security module is used in the project, which brings in other security
+   * related libraries.
+   */
   predicate isSpringBootSecurityUsed() {
     this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
   }
@@ -38,14 +41,14 @@ class ApplicationProperties extends ConfigPair {
 }
 
 /** The configuration property `management.security.enabled`. */
-class ManagementSecurityEnabled extends ApplicationProperties {
-  ManagementSecurityEnabled() { this.getNameElement().getName() = "management.security.enabled" }
+class ManagementSecurityConfig extends ApplicationProperties {
+  ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
 
-  string getManagementSecurityEnabled() { result = this.getValueElement().getValue() }
+  string getValue() { result = this.getValueElement().getValue().trim() }
 
-  predicate hasSecurityDisabled() { getManagementSecurityEnabled() = "false" }
+  predicate hasSecurityDisabled() { getValue() = "false" }
 
-  predicate hasSecurityEnabled() { getManagementSecurityEnabled() = "true" }
+  predicate hasSecurityEnabled() { getValue() = "true" }
 }
 
 /** The configuration property `management.endpoints.web.exposure.include`. */
@@ -54,56 +57,37 @@ class ManagementEndPointInclude extends ApplicationProperties {
     this.getNameElement().getName() = "management.endpoints.web.exposure.include"
   }
 
-  string getManagementEndPointInclude() { result = this.getValueElement().getValue().trim() }
-}
-
-/** The configuration property `management.endpoints.web.exposure.exclude`. */
-class ManagementEndPointExclude extends ApplicationProperties {
-  ManagementEndPointExclude() {
-    this.getNameElement().getName() = "management.endpoints.web.exposure.exclude"
-  }
-
-  string getManagementEndPointExclude() { result = this.getValueElement().getValue().trim() }
-}
-
-/** Holds if an application handles sensitive information judging by its variable names. */
-predicate isProtectedApp() {
-  exists(VarAccess va | va.getVariable().getName().regexpMatch(getCommonSensitiveInfoRegex()))
+  string getValue() { result = this.getValueElement().getValue().trim() }
 }
 
 from SpringBootPom pom, ApplicationProperties ap, Dependency d
 where
-  isProtectedApp() and
   pom.isSpringBootActuatorUsed() and
   not pom.isSpringBootSecurityUsed() and
   ap.getFile()
       .getParentContainer()
       .getAbsolutePath()
       .matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
-  exists(string s | s = pom.getParentElement().getVersionString() |
-    s.regexpMatch("1\\.[0|1|2|3|4].*") and
-    not exists(ManagementSecurityEnabled me |
+  exists(string springBootVersion | springBootVersion = pom.getParentElement().getVersionString() |
+    springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
+    not exists(ManagementSecurityConfig me |
       me.hasSecurityEnabled() and me.getFile() = ap.getFile()
     )
     or
-    s.regexpMatch("1\\.5.*") and
-    exists(ManagementSecurityEnabled me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
+    springBootVersion.matches("1.5%") and // version 1.5
+    exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
     or
-    s.regexpMatch("2.*") and
+    springBootVersion.matches("2.%") and //version 2.x
     exists(ManagementEndPointInclude mi |
       mi.getFile() = ap.getFile() and
       (
-        mi.getManagementEndPointInclude() = "*" // all endpoints are enabled
+        mi.getValue() = "*" // all endpoints are enabled
         or
-        mi.getManagementEndPointInclude()
+        mi.getValue()
             .matches([
                 "%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
                 "%beans%", "%sessions%"
-              ]) // all endpoints apart from '/health' and '/info' are considered sensitive
-      ) and
-      not exists(ManagementEndPointExclude mx |
-        mx.getFile() = ap.getFile() and
-        mx.getManagementEndPointExclude() = mi.getManagementEndPointInclude()
+              ]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
       )
     )
   ) and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
index aa489435a12b..4f5defdd948e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
@@ -7,7 +7,7 @@
 # vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
 management.security.enabled=false
 
-# vulnerable configuration (spring boot 2+): exposes health and info only by default
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
 management.endpoints.web.exposure.include=*
 
 
@@ -18,5 +18,5 @@ management.security.enabled=true
 # safe configuration (spring boot 1.5+): requires value false to expose sensitive actuators
 management.security.enabled=true
 
-# safe configuration (spring boot 2+): exposes health and info only by default
+# safe configuration (spring boot 2+): exposes health and info only by default, here overridden to expose one additional endpoint which we assume is intentional and safe.
 management.endpoints.web.exposure.include=beans,info,health
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
index 95e704f3a1a5..797906a3ca3b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
@@ -5,7 +5,7 @@
 # vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
 management.security.enabled=false
 
-# vulnerable configuration (spring boot 2+): exposes health and info only by default
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
 management.endpoints.web.exposure.include=*
 management.endpoints.web.exposure.exclude=beans
 

From 1a2e341b7c767fc4b6e21e9dc38d25110aa8b50e Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 12 Mar 2021 12:19:37 +0000
Subject: [PATCH 042/433] Refactor the business logic of the query into a
 separate predicate

---
 .../CWE/CWE-016/InsecureSpringActuatorConfig.ql    | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
index 06ba0d8a288e..3acd22e767a3 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -60,8 +60,11 @@ class ManagementEndPointInclude extends ApplicationProperties {
   string getValue() { result = this.getValueElement().getValue().trim() }
 }
 
-from SpringBootPom pom, ApplicationProperties ap, Dependency d
-where
+/**
+ * Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
+ * has a vulnerable configuration of Spring Boot Actuator management endpoints.
+ */
+predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationProperties ap) {
   pom.isSpringBootActuatorUsed() and
   not pom.isSpringBootSecurityUsed() and
   ap.getFile()
@@ -90,7 +93,12 @@ where
               ]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
       )
     )
-  ) and
+  )
+}
+
+from SpringBootPom pom, ApplicationProperties ap, Dependency d
+where
+  hasConfidentialEndPointExposed(pom, ap) and
   d = pom.getADependency() and
   d.getArtifact().getValue() = "spring-boot-starter-actuator"
 select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."

From 41c9394b4bd12063e133222310a9facac689b330 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 14 Mar 2021 09:22:47 +0100
Subject: [PATCH 043/433] Python: update qhelp and example

---
 .../Security/CWE-327/InsecureProtocol.qhelp   | 21 +++++++++++++++++++
 .../examples/secure_default_protocol.py       | 16 ++++++--------
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
index 4a7364ca14e2..cfcebd0930d3 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
@@ -38,12 +38,33 @@
             <code>ssl.SSLContext</code>, which is supported in Python 2.7.9 and
             3.2 and later versions.
           </p>
+          <p>
+            Note that <code>ssl.wrap_socket</code> has been deprecated in
+            Python 3.7. The recommended alternatives are:
+          </p>
+          <ul>
+            <li><code>ssl.SSLContext</code> - supported in Python 2.7.9,
+                  3.2, and later versions</li>
+            <li><code>ssl.create_default_context</code> - a convenience function,
+                  supported in Python 3.4 and later versions.</li>
+          </ul>
+          <p>
+            Even when you use these alternatives, you should
+            ensure that a safe protocol is used. The following code illustrates
+            how to use flags (available since Python 3.2) or the `minimum_version`
+            field (favored since Python 3.7) to restrict the protocols accepted when
+            creating a connection.
+          </p>
+
+          <sample src="examples/secure_default_protocol.py" />
      </example>
 
      <references>
        <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security"> Transport Layer Security</a>.</li>
        <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.SSLContext"> class ssl.SSLContext</a>.</li>
        <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.wrap_socket"> ssl.wrap_socket</a>.</li>
+       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#functions-constants-and-exceptions"> notes on context creation</a>.</li>
+       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl-security"> notes on security considerations</a>.</li>
        <li>pyOpenSSL documentation: <a href="https://pyopenssl.org/en/stable/api/ssl.html"> An interface to the SSL-specific parts of OpenSSL</a>.</li>
      </references>
 
diff --git a/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py b/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
index 83c6dbbba0e0..535a97f0b934 100644
--- a/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
+++ b/python/ql/src/Security/CWE-327/examples/secure_default_protocol.py
@@ -1,13 +1,9 @@
-# taken from https://docs.python.org/3/library/ssl.html?highlight=ssl#ssl.SSLContext
-
-import socket
 import ssl
 
-hostname = 'www.python.org'
-context = ssl.create_default_context()
-context.options |= ssl.OP_NO_TLSv1 # This added by me
-context.options |= ssl.OP_NO_TLSv1_1 # This added by me
+# Using flags to restrict the protocol
+context = ssl.SSLContext()
+context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
 
-with socket.create_connection((hostname, 443)) as sock:
-    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-        print(ssock.version())
+# Declaring a minimum version to restrict the protocol
+context = ssl.create_default_context()
+context.minimum_version = ssl.TLSVersion.TLSv1_2

From 4094b184074ca1c4b20e4ad599bef6d536f518c3 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 15 Mar 2021 16:28:08 +0100
Subject: [PATCH 044/433] Python: Clean up tests

---
 .../CWE-327/InsecureProtocol.expected         | 10 ++---
 .../Security/CWE-327/InsecureProtocol.py      | 39 ++++++-------------
 2 files changed, 17 insertions(+), 32 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index f4202a4634d5..db30e41b4809 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -5,11 +5,11 @@
 | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | call to SSLContext |
 | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | call to SSLContext |
 | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | call to SSL.Context |
-| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
-| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | call to SSLContext |
+| InsecureProtocol.py:15:1:15:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@  | InsecureProtocol.py:15:1:15:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@  | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:19:1:19:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:19:1:19:19 | ControlFlowNode for Attribute() | call to SSL.Context |
+| InsecureProtocol.py:23:1:23:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:23:1:23:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
+| InsecureProtocol.py:24:1:24:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@  | InsecureProtocol.py:24:1:24:35 | ControlFlowNode for SSLContext() | call to SSLContext |
 | pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
 | pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
 | pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
index cb21a6623c9e..3ff1207b527f 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
@@ -2,7 +2,7 @@
 from OpenSSL import SSL
 from ssl import SSLContext
 
-# true positives
+# insecure versions specified
 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3)
 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
@@ -12,41 +12,26 @@
 SSLContext(protocol=ssl.PROTOCOL_TLSv1)
 
 SSL.Context(SSL.SSLv2_METHOD)
-SSL.Context(SSL.SSLv23_METHOD)
 SSL.Context(SSL.SSLv3_METHOD)
 SSL.Context(SSL.TLSv1_METHOD)
 
-# not relevant
-wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3)
-wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
-wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
-
-Context(SSL.SSLv3_METHOD)
-Context(SSL.TLSv1_METHOD)
-Context(SSL.SSLv2_METHOD)
-Context(SSL.SSLv23_METHOD)
-
-# true positive using flow
-
 METHOD = SSL.SSLv2_METHOD
 SSL.Context(METHOD)
 
-# secure versions
+# importing the protocol constant directly
+from ssl import PROTOCOL_SSLv2
+ssl.wrap_socket(ssl_version=PROTOCOL_SSLv2)
+SSLContext(protocol=PROTOCOL_SSLv2)
 
+# secure versions specified
 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_2)
 SSLContext(protocol=ssl.PROTOCOL_TLSv1_2)
 SSL.Context(SSL.TLSv1_2_METHOD)
 
-# possibly insecure default
-ssl.wrap_socket()
-context = SSLContext()
+# possibly secure versions specified
+SSLContext(protocol=ssl.PROTOCOL_SSLv23)
+SSLContext(protocol=ssl.PROTOCOL_TLS)
+SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)
+SSLContext(protocol=ssl.PROTOCOL_TLS_SERVER)
 
-# importing the protocol constant directly
-
-from ssl import PROTOCOL_SSLv2
-
-ssl.wrap_socket(ssl_version=PROTOCOL_SSLv2)
-SSLContext(protocol=PROTOCOL_SSLv2)
-
-# FP for insecure default
-ssl.SSLContext(ssl.SSLv23_METHOD)
+SSL.Context(SSL.SSLv23_METHOD)

From 731f4559b415dce07d8118707a42081bcba42c08 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 15 Mar 2021 17:23:58 +0100
Subject: [PATCH 045/433] Python: update test expectations

---
 .../Security/CWE-327/InsecureDefaultProtocol.expected           | 2 --
 1 file changed, 2 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected
index 1e389aefdc1e..e69de29bb2d1 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureDefaultProtocol.expected
@@ -1,2 +0,0 @@
-| InsecureProtocol.py:41:1:41:17 | ControlFlowNode for Attribute() | Call to deprecated method ssl.wrap_socket does not specify a protocol, which may result in an insecure default being used. |
-| InsecureProtocol.py:42:11:42:22 | ControlFlowNode for SSLContext() | Call to ssl.SSLContext does not specify a protocol, which may result in an insecure default being used. |

From 87f3ba26843b8f861df47b9ca03226926aa58b5b Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 15 Mar 2021 17:24:39 +0100
Subject: [PATCH 046/433] Python: add tests for `ssl.PROTOCOL_TLS_SERVER` and
 `ssl.PROTOCOL_TLS_CLIENT`

---
 .../CWE-327/InsecureProtocol.expected         | 36 +++++++++----------
 .../Security/CWE-327/ssl_fluent.py            | 18 ++++++++++
 2 files changed, 36 insertions(+), 18 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index db30e41b4809..3f383ea52978 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -22,21 +22,21 @@
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:34:15:34:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:47:14:47:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:43:15:43:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:71:15:71:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:128:15:128:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:144:5:144:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:98:14:98:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:104:14:104:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:12:89:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:124:14:124:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:122:5:122:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:173:14:173:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:170:5:170:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:189:5:189:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
-| ssl_fluent.py:192:14:192:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:188:15:188:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:65:14:65:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:61:15:61:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:93:14:93:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:15:89:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:93:14:93:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:15:89:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:146:15:146:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:146:15:146:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:180:5:180:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:122:14:122:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:122:14:122:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:142:14:142:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:140:5:140:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:191:14:191:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:188:5:188:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:207:5:207:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:206:15:206:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:206:15:206:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index 577f342765ee..ceddaa32f091 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -19,6 +19,24 @@ def test_fluent_tls_no_TLSv1():
         with context.wrap_socket(sock, server_hostname=hostname) as ssock:
             print(ssock.version())
 
+def test_fluent_tls_client_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_tls_server_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_server((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
 def test_fluent_tls_safe():
     hostname = 'www.python.org'
     context = ssl.SSLContext(ssl.PROTOCOL_TLS)

From 514a69c47ad79318883483f159662503bc7358b0 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 15 Mar 2021 17:30:01 +0100
Subject: [PATCH 047/433] Python: Support `ssl.PROTOCOL_TLS_SERVER` and
 `ssl.PROTOCOL_TLS_CLIENT`

---
 python/ql/src/Security/CWE-327/Ssl.qll                      | 6 +++++-
 .../query-tests/Security/CWE-327/InsecureProtocol.expected  | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index d4886219d084..be16138b9612 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -146,7 +146,11 @@ class Ssl extends TlsLibrary {
 
   override string specific_version_name(ProtocolVersion version) { result = "PROTOCOL_" + version }
 
-  override string unspecific_version_name(ProtocolFamily family) { result = "PROTOCOL_" + family }
+  override string unspecific_version_name(ProtocolFamily family) {
+    family = "SSLv23" and result = "PROTOCOL_" + family
+    or
+    family = "TLS" and result = "PROTOCOL_" + family + ["", "_CLIENT", "_SERVER"]
+  }
 
   override API::Node version_constants() { result = API::moduleImport("ssl") }
 
diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index 3f383ea52978..e578a335d846 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -22,6 +22,8 @@
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:28:14:28:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:24:15:24:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:33:15:33:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:65:14:65:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:61:15:61:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |

From 9a962305236c194d18d80d6321bf11ddc6eabe8b Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 15 Mar 2021 17:35:30 +0100
Subject: [PATCH 048/433] Python: Add changenote

---
 python/change-notes/2021-03-15-port-insecure-protocol.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 python/change-notes/2021-03-15-port-insecure-protocol.md

diff --git a/python/change-notes/2021-03-15-port-insecure-protocol.md b/python/change-notes/2021-03-15-port-insecure-protocol.md
new file mode 100644
index 000000000000..c92f387b29a0
--- /dev/null
+++ b/python/change-notes/2021-03-15-port-insecure-protocol.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Ported use of insecure SSL/TLS version (`py/insecure-protocol`) query to use new data-flow library. This might result in different results, but overall a more robust and accurate analysis.

From 98204a15a6ad8c8dd5dfb42269bfdd153cfc1827 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 17 Mar 2021 15:28:04 +0800
Subject: [PATCH 049/433] Fix the problem

---
 .../Security/CWE/CWE-352/JsonStringLib.qll    |   2 +-
 .../Security/CWE/CWE-352/JsonpInjection.java  | 113 ++++++----
 .../Security/CWE/CWE-352/JsonpInjection.qhelp |  11 +-
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  24 ++-
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  66 +++---
 .../Security/CWE/CWE-598/SensitiveGetQuery.ql |  10 -
 .../semmle/code/java/frameworks/Servlets.qll  |  11 +
 .../security/CWE-352/JsonpInjection.qlref     |   1 -
 .../JsonpController.java                      | 105 +++++++--
 .../JsonpInjection.expected                   |  87 ++++++++
 .../JsonpInjection.qlref                      |   1 +
 .../JsonpInjectionServlet1.java               |   0
 .../JsonpInjectionServlet2.java               |   0
 .../RefererFilter.java                        |   0
 .../CWE-352/JsonpInjectionWithFilter/options  |   1 +
 .../JsonpController.java                      | 107 +++++++--
 .../JsonpInjection.expected                   |  76 +++++++
 .../JsonpInjection.qlref                      |   1 +
 .../options                                   |   1 +
 .../JsonpController.java                      | 203 ++++++++++++++++++
 .../JsonpInjection.expected                   |  92 ++++++++
 .../JsonpInjection.qlref                      |   1 +
 .../JsonpInjectionServlet1.java               |   0
 .../JsonpInjectionServlet2.java               |   0
 .../options                                   |   1 +
 .../CWE-352/JsonpInjection_1.expected         |  60 ------
 .../CWE-352/JsonpInjection_2.expected         |  78 -------
 .../CWE-352/JsonpInjection_3.expected         |  66 ------
 .../query-tests/security/CWE-352/Readme       |   3 -
 .../security/CWE-352/RefererFilter.java       |  43 ----
 .../query-tests/security/CWE-352/options      |   1 -
 .../core/annotation/AliasFor.java             |  13 +-
 .../core/io/InputStreamSource.java            |   8 +
 .../org/springframework/core/io/Resource.java |  46 ++++
 .../org/springframework/lang/Nullable.java    |  13 ++
 .../springframework/util/FileCopyUtils.java   |  53 +++++
 .../org/springframework/util/StringUtils.java |   2 +-
 .../web/bind/annotation/GetMapping.java       |  36 +++-
 .../web/bind/annotation/Mapping.java          |   4 +
 .../web/bind/annotation/RequestMapping.java   |  19 +-
 .../web/bind/annotation/RequestParam.java     |  23 ++
 .../web/bind/annotation/ResponseBody.java     |   9 +
 .../web/multipart/MultipartFile.java          |  38 ++++
 .../javax/servlet/annotation/WebServlet.java  |  30 +++
 44 files changed, 1073 insertions(+), 386 deletions(-)
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
 rename java/ql/test/experimental/query-tests/security/CWE-352/{ => JsonpInjectionWithFilter}/JsonpController.java (54%)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
 rename java/ql/{src/experimental/Security/CWE/CWE-352 => test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter}/JsonpInjectionServlet1.java (100%)
 rename java/ql/{src/experimental/Security/CWE/CWE-352 => test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter}/JsonpInjectionServlet2.java (100%)
 rename java/ql/{src/experimental/Security/CWE/CWE-352 => test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter}/RefererFilter.java (100%)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options
 rename java/ql/{src/experimental/Security/CWE/CWE-352 => test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController}/JsonpController.java (54%)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
 rename java/ql/test/experimental/query-tests/security/CWE-352/{ => JsonpInjectionWithSpringControllerAndServlet}/JsonpInjectionServlet1.java (100%)
 rename java/ql/test/experimental/query-tests/security/CWE-352/{ => JsonpInjectionWithSpringControllerAndServlet}/JsonpInjectionServlet2.java (100%)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/Readme
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/options
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
 create mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
 create mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
 create mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
index 0da8bc860d11..5cc52e97e338 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
@@ -3,7 +3,7 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
 import DataFlow::PathGraph
 
-/** Json string type data */
+/** Json string type data. */
 abstract class JsonpStringSource extends DataFlow::Node { }
 
 /** Convert to String using Gson library. */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
index 8b4e7cc005ef..7f479a8c0230 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
@@ -1,31 +1,39 @@
 import com.alibaba.fastjson.JSONObject;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
 import java.io.PrintWriter;
 import java.util.HashMap;
-import java.util.Random;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
 
 @Controller
 public class JsonpInjection {
-private static HashMap hashMap = new HashMap();
+
+    private static HashMap hashMap = new HashMap();
 
     static {
         hashMap.put("username","admin");
         hashMap.put("password","123456");
     }
 
+    private String name = null;
+
 
     @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
         resultStr = jsonpCallback + "(" + result + ")";
@@ -37,9 +45,7 @@ public String bad1(HttpServletRequest request) {
     public String bad2(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-
         return resultStr;
     }
 
@@ -67,7 +73,6 @@ public String bad4(HttpServletRequest request) {
     @ResponseBody
     public void bad5(HttpServletRequest request,
             HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
         String jsonpCallback = request.getParameter("jsonpCallback");
         PrintWriter pw = null;
         Gson gson = new Gson();
@@ -83,7 +88,6 @@ public void bad5(HttpServletRequest request,
     @ResponseBody
     public void bad6(HttpServletRequest request,
             HttpServletResponse response) throws Exception {
-        response.setContentType("application/json");
         String jsonpCallback = request.getParameter("jsonpCallback");
         PrintWriter pw = null;
         ObjectMapper mapper = new ObjectMapper();
@@ -94,60 +98,96 @@ public void bad6(HttpServletRequest request,
         pw.println(resultStr);
     }
 
-    @GetMapping(value = "jsonp7")
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
     @ResponseBody
-    public String good(HttpServletRequest request) {
+    public String bad7(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
-        String val = "";
-        Random random = new Random();
-        for (int i = 0; i < 10; i++) {
-            val += String.valueOf(random.nextInt(10));
-        }
-        // good
-        jsonpCallback = jsonpCallback + "_" + val;
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
         return resultStr;
     }
 
+
     @GetMapping(value = "jsonp8")
     @ResponseBody
     public String good1(HttpServletRequest request) {
         String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-
         String token = request.getParameter("token");
-
-        // good
         if (verifToken(token)){
-            System.out.println(token);
+            String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
             return resultStr;
         }
-
         return "error";
     }
 
+
     @GetMapping(value = "jsonp9")
     @ResponseBody
     public String good2(HttpServletRequest request) {
         String resultStr = null;
+        String token = request.getParameter("token");
+        boolean result = verifToken(token);
+        if (result){
+            return "";
+        }
         String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
 
-        String referer = request.getHeader("Referer");
+    @RequestMapping(value = "jsonp10")
+    @ResponseBody
+    public String good3(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
 
-        boolean result = verifReferer(referer);
-        // good
-        if (result){
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
         }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
 
-        return "error";
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
     }
 
     public static String getJsonStr(Object result) {
@@ -160,11 +200,4 @@ public static boolean verifToken(String token){
         }
         return true;
     }
-
-    public static boolean verifReferer(String referer){
-        if (!referer.startsWith("http://test.com/")){
-            return false;
-        }
-        return true;
-    }
 }
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index bb5d628ac0b7..93c167d6c2ca 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -3,18 +3,21 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>The software uses external input as the function name to wrap JSON data and return it to the client as a request response. When there is a cross-domain problem, 
-there is a problem of sensitive information leakage.</p>
+<p>The software uses external input as the function name to wrap JSON data and returns it to the client as a request response. 
+When there is a cross-domain problem, the problem of sensitive information leakage may occur.</p>
 
 </overview>
 <recommendation>
 
-<p>Adding `Referer` or random `token` verification processing can effectively prevent the leakage of sensitive information.</p>
+<p>Adding <code>Referer</code>/<code>Origin</code> or random <code>token</code> verification processing can effectively prevent the leakage of sensitive information.</p>
 
 </recommendation>
 <example>
 
-<p>The following example shows the case of no verification processing and verification processing for the external input function name.</p>
+<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad7</code>, 
+will cause information leakage problems when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
+method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can 
+solve the problem of information leakage caused by cross-domain.</p>
 
 <sample src="JsonpInjection.java" />
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index f3ae25daa034..068469328eae 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -14,25 +14,25 @@ import java
 import JsonpInjectionLib
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.deadcode.WebEntryPoints
-import semmle.code.java.security.XSS
 import DataFlow::PathGraph
 
 /** Determine whether there is a verification method for the remote streaming source data flow path method. */
 predicate existsFilterVerificationMethod() {
-  exists(MethodAccess ma,Node existsNode, Method m|
+  exists(MethodAccess ma, Node existsNode, Method m |
     ma.getMethod() instanceof VerificationMethodClass and
     existsNode.asExpr() = ma and
-    m = getAnMethod(existsNode.getEnclosingCallable()) and
+    m = getACallingCallableOrSelf(existsNode.getEnclosingCallable()) and
     isDoFilterMethod(m)
   )
 }
 
 /** Determine whether there is a verification method for the remote streaming source data flow path method. */
 predicate existsServletVerificationMethod(Node checkNode) {
-  exists(MethodAccess ma,Node existsNode|
+  exists(MethodAccess ma, Node existsNode |
     ma.getMethod() instanceof VerificationMethodClass and
     existsNode.asExpr() = ma and
-    getAnMethod(existsNode.getEnclosingCallable()) = getAnMethod(checkNode.getEnclosingCallable())
+    getACallingCallableOrSelf(existsNode.getEnclosingCallable()) =
+      getACallingCallableOrSelf(checkNode.getEnclosingCallable())
   )
 }
 
@@ -40,13 +40,15 @@ predicate existsServletVerificationMethod(Node checkNode) {
 class RequestResponseFlowConfig extends TaintTracking::Configuration {
   RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
 
-  override predicate isSource(DataFlow::Node source) {
-    source instanceof RemoteFlowSource and
-    getAnMethod(source.getEnclosingCallable()) instanceof RequestGetMethod
-  }
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
 
+  /** Eliminate the method of calling the node is not the get method. */
+  override predicate isSanitizer(DataFlow::Node node) {
+    not getACallingCallableOrSelf(node.getEnclosingCallable()) instanceof RequestGetMethod 
+  }
+
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
     exists(MethodAccess ma |
       isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
@@ -60,5 +62,5 @@ where
   not existsFilterVerificationMethod() and
   conf.hasFlowPath(source, sink) and
   exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
-select sink.getNode(), source, sink, "Jsonp Injection query might include code from $@.",
-  source.getNode(), "this user input"
\ No newline at end of file
+select sink.getNode(), source, sink, "Jsonp response might include code from $@.", source.getNode(),
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index b8964524a9f8..d0e00bcb634f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -6,28 +6,25 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
 class VerificationMethodFlowConfig extends TaintTracking::Configuration {
   VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma, BarrierGuard bg |
+    exists(MethodAccess ma |
       ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      bg = ma and
-      sink.asExpr() = ma.getAnArgument()
+      ma.getAnArgument() = sink.asExpr()
     )
   }
 }
 
-/** The parameter name of the method is `token`, `auth`, `referer`, `origin`. */
+/** The parameter names of this method are token/auth/referer/origin. */
 class VerificationMethodClass extends Method {
   VerificationMethodClass() {
-    exists(MethodAccess ma, BarrierGuard bg, VerificationMethodFlowConfig vmfc, Node node |
+    exists(MethodAccess ma, VerificationMethodFlowConfig vmfc, Node node |
       this = ma.getMethod() and
-      this.getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      bg = ma and
       node.asExpr() = ma.getAnArgument() and
       vmfc.hasFlowTo(node)
     )
@@ -35,38 +32,43 @@ class VerificationMethodClass extends Method {
 }
 
 /** Get Callable by recursive method. */
-Callable getAnMethod(Callable call) {
+Callable getACallingCallableOrSelf(Callable call) {
   result = call
   or
-  result = getAnMethod(call.getAReference().getEnclosingCallable())
+  result = getACallingCallableOrSelf(call.getAReference().getEnclosingCallable())
 }
 
 abstract class RequestGetMethod extends Method { }
 
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+/** Override method of `doGet` of `Servlet` subclass. */
 private class ServletGetMethod extends RequestGetMethod {
-  ServletGetMethod() {
-    exists(Method m |
-      m = this and
-      isServletRequestMethod(m) and
-      m.getName() = "doGet"
-    )
+  ServletGetMethod() { this instanceof DoGetServletMethod }
+}
+
+/** The method of SpringController class processing `get` request. */
+abstract class SpringControllerGetMethod extends RequestGetMethod { }
+
+/** Method using `GetMapping` annotation in SpringController class. */
+class SpringControllerGetMappingGetMethod extends SpringControllerGetMethod {
+  SpringControllerGetMappingGetMethod() {
+    this.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
   }
 }
 
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
-private class SpringControllerGetMethod extends RequestGetMethod {
-  SpringControllerGetMethod() {
-    exists(Annotation a |
-      a = this.getAnAnnotation() and
-      a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
-    )
-    or
-    exists(Annotation a |
-      a = this.getAnAnnotation() and
-      a.getType().hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
-      a.getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}")
-    )
+/** The method that uses the `RequestMapping` annotation in the SpringController class and only handles the get request. */
+class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod {
+  SpringControllerRequestMappingGetMethod() {
+    this.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
+    this.getAnAnnotation().getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}") and
+    not exists(MethodAccess ma |
+      ma.getMethod() instanceof ServletRequestGetBodyMethod and
+      this = getACallingCallableOrSelf(ma.getEnclosingCallable())
+    ) and
+    not this.getAParamType().getName() = "MultipartFile"
   }
 }
 
@@ -83,12 +85,12 @@ class JsonpInjectionExpr extends AddExpr {
         .regexpMatch("\"\\(\"")
   }
 
-  /** Get the jsonp function name of this expression */
+  /** Get the jsonp function name of this expression. */
   Expr getFunctionName() {
     result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
   }
 
-  /** Get the json data of this expression */
+  /** Get the json data of this expression. */
   Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
index bc9850cfddb9..c381595af14b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -23,16 +23,6 @@ class SensitiveInfoExpr extends Expr {
   }
 }
 
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
-private predicate isGetServletMethod(Method m) {
-  isServletRequestMethod(m) and m.getName() = "doGet"
-}
-
-/** The `doGet` method of `HttpServlet`. */
-class DoGetServletMethod extends Method {
-  DoGetServletMethod() { isGetServletMethod(this) }
-}
-
 /** Holds if `ma` is (perhaps indirectly) called from the `doGet` method of `HttpServlet`. */
 predicate isReachableFromServletDoGet(MethodAccess ma) {
   ma.getEnclosingCallable() instanceof DoGetServletMethod
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index 5cccf62122ff..7ac452affa99 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -354,9 +354,20 @@ class FilterChain extends Interface {
 
 /** Holds if `m` is a filter handler method (for example `doFilter`). */
 predicate isDoFilterMethod(Method m) {
+  m.getName().matches("doFilter") and
   m.getDeclaringType() instanceof FilterClass and
   m.getNumberOfParameters() = 3 and
   m.getParameter(0).getType() instanceof ServletRequest and
   m.getParameter(1).getType() instanceof ServletResponse and
   m.getParameter(2).getType() instanceof FilterChain
 }
+
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+predicate isGetServletMethod(Method m) {
+  isServletRequestMethod(m) and m.getName() = "doGet"
+}
+
+/** The `doGet` method of `HttpServlet`. */
+class DoGetServletMethod extends Method {
+  DoGetServletMethod() { isGetServletMethod(this) }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
deleted file mode 100644
index 6ad4b8acda76..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
similarity index 54%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
index cf860c756409..e5b5e70a38d7 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
@@ -1,16 +1,24 @@
 import com.alibaba.fastjson.JSONObject;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
 import java.io.PrintWriter;
 import java.util.HashMap;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
 
 @Controller
 public class JsonpController {
+
     private static HashMap hashMap = new HashMap();
 
     static {
@@ -18,13 +26,14 @@ public class JsonpController {
         hashMap.put("password","123456");
     }
 
+    private String name = null;
+
 
-    @GetMapping(value = "jsonp1", produces="text/javascript")
+    @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
         resultStr = jsonpCallback + "(" + result + ")";
@@ -36,9 +45,7 @@ public String bad1(HttpServletRequest request) {
     public String bad2(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-
         return resultStr;
     }
 
@@ -91,23 +98,98 @@ public void bad6(HttpServletRequest request,
         pw.println(resultStr);
     }
 
-    @GetMapping(value = "jsonp7")
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad7(HttpServletRequest request) {
         String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
 
-        String token = request.getParameter("token");
 
+    @GetMapping(value = "jsonp8")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
         if (verifToken(token)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
             return resultStr;
         }
-
         return "error";
     }
 
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good2(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
+        boolean result = verifToken(token);
+        if (result){
+            return "";
+        }
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp10")
+    @ResponseBody
+    public String good3(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
+        }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
+    }
+
     public static String getJsonStr(Object result) {
         return JSONObject.toJSONString(result);
     }
@@ -118,11 +200,4 @@ public static boolean verifToken(String token){
         }
         return true;
     }
-
-    public static boolean verifReferer(String referer){
-        if (!referer.startsWith("http://test.com/")){
-            return false;
-        }
-        return true;
-    }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
new file mode 100644
index 000000000000..501565f2b4ec
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
@@ -0,0 +1,87 @@
+edges
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| RefererFilter.java:22:26:22:53 | getHeader(...) : String | RefererFilter.java:23:39:23:45 | refefer |
+nodes
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:118:24:118:28 | token | semmle.label | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:133:37:133:41 | token | semmle.label | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| RefererFilter.java:22:26:22:53 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| RefererFilter.java:23:39:23:45 | refefer | semmle.label | refefer |
+#select
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
new file mode 100644
index 000000000000..3f5fc4506696
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet1.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java
similarity index 100%
rename from java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet1.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet2.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java
similarity index 100%
rename from java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionServlet2.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java
similarity index 100%
rename from java/ql/src/experimental/Security/CWE/CWE-352/RefererFilter.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options
new file mode 100644
index 000000000000..c53e31e467fa
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
similarity index 54%
rename from java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
index 84a172a7aebd..e5b5e70a38d7 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
@@ -1,16 +1,24 @@
 import com.alibaba.fastjson.JSONObject;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
 import java.io.PrintWriter;
 import java.util.HashMap;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
 
 @Controller
 public class JsonpController {
+
     private static HashMap hashMap = new HashMap();
 
     static {
@@ -18,13 +26,14 @@ public class JsonpController {
         hashMap.put("password","123456");
     }
 
+    private String name = null;
+
 
-    @GetMapping(value = "jsonp1", produces="text/javascript")
+    @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
         resultStr = jsonpCallback + "(" + result + ")";
@@ -36,9 +45,7 @@ public String bad1(HttpServletRequest request) {
     public String bad2(HttpServletRequest request) {
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
-
         resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-
         return resultStr;
     }
 
@@ -91,23 +98,98 @@ public void bad6(HttpServletRequest request,
         pw.println(resultStr);
     }
 
-    @GetMapping(value = "jsonp7")
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad7(HttpServletRequest request) {
         String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
 
-        String token = request.getParameter("token");
 
+    @GetMapping(value = "jsonp8")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
         if (verifToken(token)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
             return resultStr;
         }
-
         return "error";
     }
 
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good2(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
+        boolean result = verifToken(token);
+        if (result){
+            return "";
+        }
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp10")
+    @ResponseBody
+    public String good3(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
+        }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
+    }
+
     public static String getJsonStr(Object result) {
         return JSONObject.toJSONString(result);
     }
@@ -118,11 +200,4 @@ public static boolean verifToken(String token){
         }
         return true;
     }
-
-    public static boolean verifReferer(String referer){
-        if (!referer.startsWith("http://test.com/")){
-            return false;
-        }
-        return true;
-    }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
new file mode 100644
index 000000000000..91d23cebbdac
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
@@ -0,0 +1,76 @@
+edges
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+nodes
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:118:24:118:28 | token | semmle.label | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:133:37:133:41 | token | semmle.label | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+#select
+| JsonpController.java:40:16:40:24 | resultStr | JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:36:32:36:68 | getParameter(...) | this user input |
+| JsonpController.java:49:16:49:24 | resultStr | JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:47:32:47:68 | getParameter(...) | this user input |
+| JsonpController.java:59:16:59:24 | resultStr | JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:56:32:56:68 | getParameter(...) | this user input |
+| JsonpController.java:69:16:69:24 | resultStr | JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:66:32:66:68 | getParameter(...) | this user input |
+| JsonpController.java:84:20:84:28 | resultStr | JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:76:32:76:68 | getParameter(...) | this user input |
+| JsonpController.java:98:20:98:28 | resultStr | JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:91:32:91:68 | getParameter(...) | this user input |
+| JsonpController.java:109:16:109:24 | resultStr | JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:105:32:105:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref
new file mode 100644
index 000000000000..3f5fc4506696
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
new file mode 100644
index 000000000000..c53e31e467fa
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
new file mode 100644
index 000000000000..e5b5e70a38d7
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
@@ -0,0 +1,203 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
+
+@Controller
+public class JsonpController {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    private String name = null;
+
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
+    @ResponseBody
+    public String bad7(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+
+    @GetMapping(value = "jsonp8")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
+        if (verifToken(token)){
+            String jsonpCallback = request.getParameter("jsonpCallback");
+            String jsonStr = getJsonStr(hashMap);
+            resultStr = jsonpCallback + "(" + jsonStr + ")";
+            return resultStr;
+        }
+        return "error";
+    }
+
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good2(HttpServletRequest request) {
+        String resultStr = null;
+        String token = request.getParameter("token");
+        boolean result = verifToken(token);
+        if (result){
+            return "";
+        }
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp10")
+    @ResponseBody
+    public String good3(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
+        }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+
+    public static boolean verifToken(String token){
+        if (token != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
new file mode 100644
index 000000000000..c2bcab77d4d4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
@@ -0,0 +1,92 @@
+edges
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
+nodes
+| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:118:24:118:28 | token | semmle.label | token |
+| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:133:37:133:41 | token | semmle.label | token |
+| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
+| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
+#select
+| JsonpController.java:40:16:40:24 | resultStr | JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:36:32:36:68 | getParameter(...) | this user input |
+| JsonpController.java:49:16:49:24 | resultStr | JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:47:32:47:68 | getParameter(...) | this user input |
+| JsonpController.java:59:16:59:24 | resultStr | JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:56:32:56:68 | getParameter(...) | this user input |
+| JsonpController.java:69:16:69:24 | resultStr | JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:66:32:66:68 | getParameter(...) | this user input |
+| JsonpController.java:84:20:84:28 | resultStr | JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:76:32:76:68 | getParameter(...) | this user input |
+| JsonpController.java:98:20:98:28 | resultStr | JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:91:32:91:68 | getParameter(...) | this user input |
+| JsonpController.java:109:16:109:24 | resultStr | JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:105:32:105:68 | getParameter(...) | this user input |
+| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | Jsonp response might include code from $@. | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
new file mode 100644
index 000000000000..3f5fc4506696
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java
similarity index 100%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet1.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java
similarity index 100%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionServlet2.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
new file mode 100644
index 000000000000..c53e31e467fa
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
deleted file mode 100644
index a89d03b67a7b..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_1.expected
+++ /dev/null
@@ -1,60 +0,0 @@
-edges
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
-| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
-nodes
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:101:24:101:28 | token | semmle.label | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-#select
-| JsonpController.java:31:16:31:24 | resultStr | JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:26:32:26:68 | getParameter(...) | this user input |
-| JsonpController.java:42:16:42:24 | resultStr | JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:38:32:38:68 | getParameter(...) | this user input |
-| JsonpController.java:52:16:52:24 | resultStr | JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:49:32:49:68 | getParameter(...) | this user input |
-| JsonpController.java:62:16:62:24 | resultStr | JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:59:32:59:68 | getParameter(...) | this user input |
-| JsonpController.java:77:20:77:28 | resultStr | JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:69:32:69:68 | getParameter(...) | this user input |
-| JsonpController.java:91:20:91:28 | resultStr | JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:84:32:84:68 | getParameter(...) | this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
deleted file mode 100644
index 4b12308a212d..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_2.expected
+++ /dev/null
@@ -1,78 +0,0 @@
-edges
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
-| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-nodes
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:101:24:101:28 | token | semmle.label | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-#select
-| JsonpController.java:31:16:31:24 | resultStr | JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:26:32:26:68 | getParameter(...) | this user input |
-| JsonpController.java:42:16:42:24 | resultStr | JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:38:32:38:68 | getParameter(...) | this user input |
-| JsonpController.java:52:16:52:24 | resultStr | JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:49:32:49:68 | getParameter(...) | this user input |
-| JsonpController.java:62:16:62:24 | resultStr | JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:59:32:59:68 | getParameter(...) | this user input |
-| JsonpController.java:77:20:77:28 | resultStr | JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:69:32:69:68 | getParameter(...) | this user input |
-| JsonpController.java:91:20:91:28 | resultStr | JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 |
- resultStr | Jsonp Injection query might include code from $@. | JsonpController.java:84:32:84:68 | getParameter(...) | this user input |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServle
-t2.java:39:20:39:28 | resultStr | Jsonp Injection query might include code from $@. | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) |
- this user input |
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
deleted file mode 100644
index 8e33ca6984c6..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection_3.expected
+++ /dev/null
@@ -1,66 +0,0 @@
-edges
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:30:21:30:54 | ... + ... : String | JsonpController.java:31:16:31:24 | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:40:21:40:80 | ... + ... : String | JsonpController.java:42:16:42:24 | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:51:21:51:55 | ... + ... : String | JsonpController.java:52:16:52:24 | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:61:21:61:54 | ... + ... : String | JsonpController.java:62:16:62:24 | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:76:21:76:54 | ... + ... : String | JsonpController.java:77:20:77:28 | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:90:21:90:54 | ... + ... : String | JsonpController.java:91:20:91:28 | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | JsonpController.java:101:24:101:28 | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | JsonpController.java:105:20:105:28 | resultStr |
-| JsonpController.java:104:25:104:59 | ... + ... : String | JsonpController.java:105:20:105:28 | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| RefererFilter.java:22:26:22:53 | getHeader(...) : String | RefererFilter.java:23:39:23:45 | refefer |
-nodes
-| JsonpController.java:26:32:26:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:30:21:30:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:31:16:31:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:38:32:38:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:40:21:40:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:42:16:42:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:32:49:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:51:21:51:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:52:16:52:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:32:59:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:61:21:61:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:62:16:62:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:32:69:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:76:21:76:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:77:20:77:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:32:84:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:90:21:90:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:20:91:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:99:24:99:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:101:24:101:28 | token | semmle.label | token |
-| JsonpController.java:102:36:102:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:104:25:104:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:20:105:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| RefererFilter.java:22:26:22:53 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| RefererFilter.java:23:39:23:45 | refefer | semmle.label | refefer |
-#select
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/Readme b/java/ql/test/experimental/query-tests/security/CWE-352/Readme
deleted file mode 100644
index 15715d6187c9..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/Readme
+++ /dev/null
@@ -1,3 +0,0 @@
-1. The JsonpInjection_1.expected result is obtained through the test of `JsonpController.java`.
-2. The JsonpInjection_2.expected result is obtained through the test of `JsonpController.java`, `JsonpInjectionServlet1.java`, `JsonpInjectionServlet2.java`.
-3. The JsonpInjection_3.expected result is obtained through the test of `JsonpController.java`, `JsonpInjectionServlet1.java`, `JsonpInjectionServlet2.java`, `RefererFilter.java`.
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java b/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
deleted file mode 100644
index 97444932ae17..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/RefererFilter.java
+++ /dev/null
@@ -1,43 +0,0 @@
-import java.io.IOException;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.util.StringUtils;
-
-public class RefererFilter implements Filter {
-
-    @Override
-    public void init(FilterConfig filterConfig) throws ServletException {
-    }
-
-    @Override
-    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
-        HttpServletRequest request = (HttpServletRequest) servletRequest;
-        HttpServletResponse response = (HttpServletResponse) servletResponse;
-        String refefer = request.getHeader("Referer");
-        boolean result = verifReferer(refefer);
-        if (result){
-            filterChain.doFilter(servletRequest, servletResponse);
-        }
-        response.sendError(444, "Referer xxx.");
-    }
-
-    @Override
-    public void destroy() {
-    }
-
-    public static boolean verifReferer(String referer){
-        if (StringUtils.isEmpty(referer)){
-            return false;
-        }
-        if (referer.startsWith("http://www.baidu.com/")){
-            return true;
-        }
-        return false;
-    }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/options b/java/ql/test/experimental/query-tests/security/CWE-352/options
deleted file mode 100644
index 3676b8e38b69..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../stubs/gson-2.8.6/:${testdir}/../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../stubs/springframework-5.2.3/:${testdir}/../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../stubs/spring-core-5.3.2/
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
index 3a823fade5b0..edfe917400b7 100644
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
@@ -1,10 +1,21 @@
 package org.springframework.core.annotation;
 
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD})
+@Documented
 public @interface AliasFor {
     @AliasFor("attribute")
     String value() default "";
 
     @AliasFor("value")
     String attribute() default "";
-
+ 
+    Class<? extends Annotation> annotation() default Annotation.class;
 }
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
new file mode 100644
index 000000000000..372d06cc7383
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
@@ -0,0 +1,8 @@
+package org.springframework.core.io;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+public interface InputStreamSource {
+    InputStream getInputStream() throws IOException;
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
new file mode 100644
index 000000000000..6bd357f2228e
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
@@ -0,0 +1,46 @@
+package org.springframework.core.io;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.channels.Channels;
+import java.nio.channels.ReadableByteChannel;
+import org.springframework.lang.Nullable;
+
+public interface Resource extends InputStreamSource {
+    boolean exists();
+
+    default boolean isReadable() {
+        return this.exists();
+    }
+
+    default boolean isOpen() {
+        return false;
+    }
+
+    default boolean isFile() {
+        return false;
+    }
+
+    URL getURL() throws IOException;
+
+    URI getURI() throws IOException;
+
+    File getFile() throws IOException;
+
+    default ReadableByteChannel readableChannel() throws IOException {
+        return null;
+    }
+
+    long contentLength() throws IOException;
+
+    long lastModified() throws IOException;
+
+    Resource createRelative(String var1) throws IOException;
+
+    @Nullable
+    String getFilename();
+
+    String getDescription();
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
new file mode 100644
index 000000000000..44bdae10fda5
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
@@ -0,0 +1,13 @@
+package org.springframework.lang;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.PARAMETER, ElementType.FIELD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface Nullable {
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
new file mode 100644
index 000000000000..78d384d72660
--- /dev/null
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
@@ -0,0 +1,53 @@
+package org.springframework.util;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Reader;
+import java.io.StringWriter;
+import java.io.Writer;
+import java.nio.file.Files;
+import org.springframework.lang.Nullable;
+
+public abstract class FileCopyUtils {
+    public static final int BUFFER_SIZE = 4096;
+
+    public FileCopyUtils() {
+    }
+
+    public static int copy(File in, File out) throws IOException {
+        return 1;
+    }
+
+    public static void copy(byte[] in, File out) throws IOException {}
+
+    public static byte[] copyToByteArray(File in) throws IOException {
+        return null;
+    }
+
+    public static int copy(InputStream in, OutputStream out) throws IOException {
+        return 1;
+    }
+
+    public static void copy(byte[] in, OutputStream out) throws IOException {}
+
+    public static byte[] copyToByteArray(@Nullable InputStream in) throws IOException {
+        return null;    
+    }
+
+    public static int copy(Reader in, Writer out) throws IOException {
+        return 1;
+    }
+
+    public static void copy(String in, Writer out) throws IOException {}
+
+    public static String copyToString(@Nullable Reader in) throws IOException {
+        return null;
+    }
+
+    private static void close(Closeable closeable) {}
+}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
index 6ee07f84593f..6ea27bbffa2f 100644
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
+++ b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
@@ -5,4 +5,4 @@ public abstract class StringUtils {
     public static boolean isEmpty(Object str) {
         return str == null || "".equals(str);
     }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
index 1190be7b879b..541c7cd4e217 100644
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
@@ -1,19 +1,51 @@
 package org.springframework.web.bind.annotation;
 
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
 import org.springframework.core.annotation.AliasFor;
 
-@RequestMapping
+@Target({ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+@RequestMapping(
+    method = {RequestMethod.GET}
+)
 public @interface GetMapping {
-   
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String name() default "";
 
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String[] value() default {};
 
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String[] path() default {};
 
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String[] params() default {};
 
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] headers() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String[] consumes() default {};
 
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
     String[] produces() default {};
 }
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java
new file mode 100644
index 000000000000..5f269bbcbb87
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java
@@ -0,0 +1,4 @@
+package org.springframework.web.bind.annotation;
+
+public @interface Mapping {
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
index ddb36bce4c00..ed692a03063c 100644
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
@@ -1,15 +1,32 @@
 package org.springframework.web.bind.annotation;
 
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
 import org.springframework.core.annotation.AliasFor;
 
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+@Mapping
 public @interface RequestMapping {
     String name() default "";
 
     @AliasFor("path")
     String[] value() default {};
-
+    
     @AliasFor("value")
     String[] path() default {};
 
     RequestMethod[] method() default {};
+
+    String[] params() default {};
+
+    String[] headers() default {};
+
+    String[] consumes() default {};
+
+    String[] produces() default {};
 }
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
new file mode 100644
index 000000000000..56094811c376
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
@@ -0,0 +1,23 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
+
+@Target({ElementType.PARAMETER})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface RequestParam {
+    @AliasFor("name")
+    String value() default "";
+
+    @AliasFor("value")
+    String name() default "";
+
+    boolean required() default true;
+
+    String defaultValue() default "\n\t\t\n\t\t\n\ue000\ue001\ue002\n\t\t\t\t\n";
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
index b2134009968b..4f21b6daaaf0 100644
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
@@ -1,4 +1,13 @@
 package org.springframework.web.bind.annotation;
 
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
 public @interface ResponseBody {
 }
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
new file mode 100644
index 000000000000..93ea3439fede
--- /dev/null
+++ b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
@@ -0,0 +1,38 @@
+package org.springframework.web.multipart;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.springframework.core.io.InputStreamSource;
+import org.springframework.core.io.Resource;
+import org.springframework.lang.Nullable;
+import org.springframework.util.FileCopyUtils;
+
+public interface MultipartFile extends InputStreamSource {
+    String getName();
+
+    @Nullable
+    String getOriginalFilename();
+
+    @Nullable
+    String getContentType();
+
+    boolean isEmpty();
+
+    long getSize();
+
+    byte[] getBytes() throws IOException;
+
+    InputStream getInputStream() throws IOException;
+
+    default Resource getResource() {
+        return null;
+    }
+
+    void transferTo(File var1) throws IOException, IllegalStateException;
+
+    default void transferTo(Path dest) throws IOException, IllegalStateException {
+    }
+}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java
new file mode 100644
index 000000000000..cc255efc00ff
--- /dev/null
+++ b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java
@@ -0,0 +1,30 @@
+package javax.servlet.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface WebServlet {
+    String name() default "";
+
+    String[] value() default {};
+
+    String[] urlPatterns() default {};
+
+    int loadOnStartup() default -1;
+
+    boolean asyncSupported() default false;
+
+    String smallIcon() default "";
+
+    String largeIcon() default "";
+
+    String description() default "";
+
+    String displayName() default "";
+}

From 15206fd2ce3d53168caa2d0250c2b9036dccfca9 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 17 Mar 2021 15:52:05 +0800
Subject: [PATCH 050/433] JsonpInjection.ql autoformatted

---
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index 068469328eae..eb4fe4e5b66a 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -46,7 +46,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   /** Eliminate the method of calling the node is not the get method. */
   override predicate isSanitizer(DataFlow::Node node) {
-    not getACallingCallableOrSelf(node.getEnclosingCallable()) instanceof RequestGetMethod 
+    not getACallingCallableOrSelf(node.getEnclosingCallable()) instanceof RequestGetMethod
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {

From 164b383fda25be40906e216a53581c5fec4da4df Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Fri, 19 Mar 2021 19:12:13 +0100
Subject: [PATCH 051/433] Update
 python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 .../test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
index 028c318be668..e4205c498244 100644
--- a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
@@ -29,3 +29,11 @@ def test_fluent_safe():
     conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
     r = conn.connect((hostname, 443))
     print(r, conn.get_protocol_version_name())
+    
+def test_safe_by_construction():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.TLSv1_2_METHOD)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(conn.get_protocol_version_name())

From 1385b2264234bc6fa3deaaeb7537ee47d89c47fe Mon Sep 17 00:00:00 2001
From: Dilan <dbhalla21@berkeley.edu>
Date: Fri, 19 Mar 2021 16:43:29 -0700
Subject: [PATCH 052/433] pr fixes, typo in qhelp file and helper method for
 queries

---
 .../Classes/NamingConventionsClasses.qhelp    |  2 +-
 .../Classes/NamingConventionsClasses.ql       | 17 ++++++++-----
 .../NamingConventionsFunctions.qhelp          |  2 +-
 .../Functions/NamingConventionsFunctions.ql   | 25 +++++++++++--------
 4 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
index 1a7f4bc45a4f..a928668dc6f7 100644
--- a/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
@@ -21,7 +21,7 @@ Write the class name beginning with an uppercase letter. For example, <code>clas
 <references>
 
 <li>
-  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code</em>
   <a href="https://www.python.org/dev/peps/pep-0008/#class-names">Python Class Names</a>
 </li>
 
diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
index d4919c3ece8d..f16d242eadf3 100644
--- a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
@@ -9,15 +9,20 @@
 
 import python
 
-from Class c, string first_char
+predicate lower_case_class(Class c) {
+  exists(string first_char | 
+    first_char = c.getName().prefix(1) and
+    not first_char = first_char.toUpperCase()
+  )
+}
+
+from Class c
 where
   c.inSource() and
-  first_char = c.getName().prefix(1) and
-  not first_char = first_char.toUpperCase() and
-  not exists(Class c1, string first_char1 |
+  lower_case_class(c) and
+  not exists(Class c1 |
     c1 != c and
     c1.getLocation().getFile() = c.getLocation().getFile() and
-    first_char1 = c1.getName().prefix(1) and
-    not first_char1 = first_char1.toUpperCase()
+    lower_case_class(c1)
   )
 select c, "Class names should start in uppercase."
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
index 46d948592ff2..b4ff738782c9 100644
--- a/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
@@ -21,7 +21,7 @@ Write the function name beginning with an lowercase letter. For example, <code>j
 <references>
 
 <li>
-  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code<em>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code</em>
   <a href="https://www.python.org/dev/peps/pep-0008/#function-and-variable-names">Python Function and Variable Names</a>
 </li>
 
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
index 80dc0e99cd8e..d2868af22c99 100644
--- a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
@@ -9,15 +9,20 @@
 
 import python
 
-from Function f, string first_char
+predicate upper_case_function(Function func) {
+  exists(string first_char | 
+    first_char = func.getName().prefix(1) and
+    not first_char = first_char.toLowerCase()
+  )
+}
+
+from Function func
 where
-  f.inSource() and
-  first_char = f.getName().prefix(1) and
-  not first_char = first_char.toLowerCase() and
-  not exists(Function f1, string first_char1 |
-    f1 != f and
-    f1.getLocation().getFile() = f.getLocation().getFile() and
-    first_char1 = f1.getName().prefix(1) and
-    not first_char1 = first_char1.toLowerCase()
+  func.inSource() and
+  upper_case_function(func) and
+  not exists(Function func1 |
+    func1 != func and
+    func1.getLocation().getFile() = func.getLocation().getFile() and
+    upper_case_function(func1)
   )
-select f, "Function names should start in lowercase."
+select func, "Function names should start in lowercase."

From 26bac9f425c2ecab54759797da19bcc1586ed95d Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Sun, 21 Mar 2021 15:25:29 +0300
Subject: [PATCH 053/433] Apply suggestions from code review

Co-authored-by: Robert Marsh <rdmarsh2@gmail.com>
---
 .../CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
index 1a116a83dbf7..034df703bc30 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
@@ -15,12 +15,12 @@
 import cpp
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
-/** Holds, if it is an expression, a boolean increment. */
+/** Holds if `exp` increments a boolean value. */
 predicate incrementBoolType(Expr exp) {
   exp.(IncrementOperation).getOperand().getType() instanceof BoolType
 }
 
-/** Holds, if this is an expression, applies a minus to a boolean type. */
+/** Holds if `exp` applies the unary minus operator to a boolean type. */
 predicate revertSignBoolType(Expr exp) {
   exp.(AssignExpr).getRValue().(UnaryMinusExpr).getAnOperand().getType() instanceof BoolType and
   exp.(AssignExpr).getLValue().getType() instanceof BoolType

From 0200aedc2efc939b96170951d848d440fcbb8e4a Mon Sep 17 00:00:00 2001
From: yo-h <55373593+yo-h@users.noreply.github.com>
Date: Sun, 21 Mar 2021 12:55:25 -0400
Subject: [PATCH 054/433] Java 16: adjust test `options`

---
 java/ql/test/library-tests/dataflow/records/options      | 2 +-
 java/ql/test/library-tests/dataflow/taint-format/options | 1 -
 java/ql/test/library-tests/printAst/options              | 2 +-
 java/ql/test/library-tests/ssa/options                   | 2 +-
 java/ql/test/query-tests/StringFormat/options            | 1 -
 5 files changed, 3 insertions(+), 5 deletions(-)
 delete mode 100644 java/ql/test/library-tests/dataflow/taint-format/options
 delete mode 100644 java/ql/test/query-tests/StringFormat/options

diff --git a/java/ql/test/library-tests/dataflow/records/options b/java/ql/test/library-tests/dataflow/records/options
index 81817b377852..fc57fe025b9a 100644
--- a/java/ql/test/library-tests/dataflow/records/options
+++ b/java/ql/test/library-tests/dataflow/records/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args -source 16 -target 16
diff --git a/java/ql/test/library-tests/dataflow/taint-format/options b/java/ql/test/library-tests/dataflow/taint-format/options
deleted file mode 100644
index 81817b377852..000000000000
--- a/java/ql/test/library-tests/dataflow/taint-format/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
diff --git a/java/ql/test/library-tests/printAst/options b/java/ql/test/library-tests/printAst/options
index 81817b377852..e41003a6e3cf 100644
--- a/java/ql/test/library-tests/printAst/options
+++ b/java/ql/test/library-tests/printAst/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args --enable-preview -source 16 -target 16
diff --git a/java/ql/test/library-tests/ssa/options b/java/ql/test/library-tests/ssa/options
index 81817b377852..e41003a6e3cf 100644
--- a/java/ql/test/library-tests/ssa/options
+++ b/java/ql/test/library-tests/ssa/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args --enable-preview -source 16 -target 16
diff --git a/java/ql/test/query-tests/StringFormat/options b/java/ql/test/query-tests/StringFormat/options
deleted file mode 100644
index 81817b377852..000000000000
--- a/java/ql/test/query-tests/StringFormat/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15

From 73e940de74bb326664db451b97fa58e67e683400 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Tue, 2 Feb 2021 17:37:14 +0100
Subject: [PATCH 055/433] Added query for Jakarta EL injections

- Added JakartaExpressionInjection.ql
- Added a qhelp file with examples
---
 .../Security/CWE/CWE-094/InjectionLib.qll     | 14 +++
 .../CWE-094/JakartaExpressionInjection.qhelp  | 65 ++++++++++++
 .../CWE/CWE-094/JakartaExpressionInjection.ql | 20 ++++
 .../CWE-094/JakartaExpressionInjectionLib.qll | 98 +++++++++++++++++++
 .../Security/CWE/CWE-094/JexlInjectionLib.qll | 13 +--
 .../SaferExpressionEvaluationWithJuel.java    | 10 ++
 .../UnsafeExpressionEvaluationWithJuel.java   |  5 +
 7 files changed, 213 insertions(+), 12 deletions(-)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll
new file mode 100644
index 000000000000..adab79d6f5c3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll
@@ -0,0 +1,14 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+
+/**
+ * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
+ * a bean by calling one of its getters.
+ */
+predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node toNode) {
+  exists(MethodAccess ma, Method m | ma.getMethod() = m |
+    m instanceof GetterMethod and
+    ma.getQualifier() = fromNode.asExpr() and
+    ma = toNode.asExpr()
+  )
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
new file mode 100644
index 000000000000..6e6b5f633947
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
@@ -0,0 +1,65 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+Jakarta Expression Language (EL) is an expression language for Java applications.
+There are a single language specification and multiple implementations
+such as Glassfish, Juel, Apache Commons EL, etc.
+The language allows invocation of methods available in the JVM.
+If an expression is built using attacker-controlled data,
+and then evaluated, then it may allow the attacker to run arbitrary code.
+</p>
+</overview>
+
+<recommendation>
+<p>
+It is generally recommended to avoid using untrusted data in an EL expression.
+Before using untrusted data to build an EL expressoin, the data should be validated
+to ensure it is not evaluated as expression language. If the EL implementaion offers
+configuring a sandbox for EL expression, they should be run in a restircitive sandbox
+that allows accessing only explicitly allowed classes. If the EL implementation
+does not allow sandboxing, consider using other expressiong language implementations
+with sandboxing capabilities such as Apache Commons JEXL or the Spring Expression Language.
+</p>
+</recommendation>
+
+<example>
+<p>
+The following example shows how untrusted data is used to build and run an expression
+using the JUEL interpreter:
+</p>
+<sample src="UnsafeExpressionEvaluationWithJUEL.java" />
+
+<p>
+JUEL does not allow to run expression in a sandbox. To prevent running arbitrary code,
+incoming data has to be checked before including to an expression. The next example
+uses a Regex pattern to check whether a user tries to run an allowed exression or not:
+</p>
+<sample src="SaferExpressionEvaluationWithJUEL.java" />
+
+</example>
+
+<references>
+<li>
+  Eclipse Foundation:
+  <a href="https://projects.eclipse.org/projects/ee4j.el">Jakarta Expression Language</a>.
+</li>
+<li>
+  Jakarta EE documentation:
+  <a href="https://javadoc.io/doc/jakarta.el/jakarta.el-api/latest/index.html">Jakarta Expression Language API</a>
+</li>
+<li>
+  OWASP:
+  <a href="https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection">Expression Language Injection</a>.
+</li>
+<li>
+  JUEL:
+  <a href="http://juel.sourceforge.net">Home page</a>
+</li>
+<li>
+  Apache Foundation:
+  <a href="https://commons.apache.org/dormant/commons-el/">Apache Commons EL</a>
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
new file mode 100644
index 000000000000..b94c98201dea
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Java EE Expression Language injection
+ * @description Evaluation of a user-controlled Jave EE expression
+ *              may lead to arbitrary code execution.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/javaee-expression-injection
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import JavaEEExpressionInjectionLib
+import DataFlow::PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, JavaEEExpressionInjectionConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Java EE Expression Language injection from $@.",
+  source.getNode(), "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
new file mode 100644
index 000000000000..d43b31c98881
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -0,0 +1,98 @@
+import java
+import InjectionLib
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+
+/**
+ * A taint-tracking configuration for unsafe user input
+ * that is used to construct and evaluate a Java EE expression.
+ */
+class JavaEEExpressionInjectionConfig extends TaintTracking::Configuration {
+  JavaEEExpressionInjectionConfig() { this = "JavaEEExpressionInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof ExpressionEvaluationSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    any(TaintPropagatingCall c).taintFlow(fromNode, toNode) or
+    returnsDataFromBean(fromNode, toNode)
+  }
+}
+
+/**
+ * A sink for Expresssion Language injection vulnerabilities,
+ * i.e. method calls that run evaluation of a Java EE expression.
+ */
+private class ExpressionEvaluationSink extends DataFlow::ExprNode {
+  ExpressionEvaluationSink() {
+    exists(MethodAccess ma, Method m, Expr taintFrom |
+      ma.getMethod() = m and taintFrom = this.asExpr()
+    |
+      m.getDeclaringType() instanceof ValueExpression and
+      m.hasName(["getValue", "setValue"]) and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof MethodExpression and
+      m.hasName("invoke") and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof LambdaExpression and
+      m.hasName("invoke") and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof ELProcessor and
+      m.hasName(["eval", "getValue", "setValue"]) and
+      ma.getArgument(0) = taintFrom
+    )
+  }
+}
+
+/**
+ * Defines method calls that propagate tainted expressions.
+ */
+private class TaintPropagatingCall extends Call {
+  Expr taintFromExpr;
+
+  TaintPropagatingCall() {
+    taintFromExpr = this.getArgument(1) and
+    exists(Method m | this.(MethodAccess).getMethod() = m |
+      m.getDeclaringType() instanceof ExpressionFactory and
+      m.hasName(["createValueExpression", "createMethodExpression"]) and
+      taintFromExpr.getType() instanceof TypeString
+    )
+    or
+    exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
+      c.getDeclaringType() instanceof LambdaExpression and
+      taintFromExpr.getType() instanceof ValueExpression
+    )
+  }
+
+  /**
+   * Holds if `fromNode` to `toNode` is a dataflow step that propagates
+   * tainted data.
+   */
+  predicate taintFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    fromNode.asExpr() = taintFromExpr and toNode.asExpr() = this
+  }
+}
+
+private class ELProcessor extends RefType {
+  ELProcessor() { hasQualifiedName("javax.el", "ELProcessor") }
+}
+
+private class ExpressionFactory extends RefType {
+  ExpressionFactory() { hasQualifiedName("javax.el", "ExpressionFactory") }
+}
+
+private class ValueExpression extends RefType {
+  ValueExpression() { hasQualifiedName("javax.el", "ValueExpression") }
+}
+
+private class MethodExpression extends RefType {
+  MethodExpression() { hasQualifiedName("javax.el", "MethodExpression") }
+}
+
+private class LambdaExpression extends RefType {
+  LambdaExpression() { hasQualifiedName("javax.el", "LambdaExpression") }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
index 561d7e46ae90..51084a9862ce 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -1,4 +1,5 @@
 import java
+import InjectionLib
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 
@@ -152,18 +153,6 @@ private predicate createsJexlEngine(DataFlow::Node fromNode, DataFlow::Node toNo
   )
 }
 
-/**
- * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
- * a bean by calling one of its getters.
- */
-private predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node toNode) {
-  exists(MethodAccess ma, Method m | ma.getMethod() = m |
-    m instanceof GetterMethod and
-    ma.getQualifier() = fromNode.asExpr() and
-    ma = toNode.asExpr()
-  )
-}
-
 /**
  * A methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
  */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
new file mode 100644
index 000000000000..54fb9a0ed36c
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
@@ -0,0 +1,10 @@
+String input = getRemoteUserInput();
+String pattern = "(inside|outside)\\.(temperature|humidity)";
+if (!input.matches(pattern)) {
+    throw new IllegalArgumentException("Unexpected exression");
+}
+String expression = "${" + input + "}";
+ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+SimpleContext context = getContext();
+Object result = e.getValue(context);
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java b/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java
new file mode 100644
index 000000000000..27afa0fcb497
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java
@@ -0,0 +1,5 @@
+String expression = "${" + getRemoteUserInput() + "}";
+ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+SimpleContext context = getContext();
+Object result = e.getValue(context);
\ No newline at end of file

From adb1ed380ac4736860eac8ea6cfadb8f38497db5 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Sun, 21 Mar 2021 20:36:47 +0300
Subject: [PATCH 056/433] Added tests for Jakarta expression injection

---
 .../CWE/CWE-094/JakartaExpressionInjection.ql | 10 +--
 .../CWE-094/JakartaExpressionInjectionLib.qll |  8 +-
 .../JakartaExpressionInjection.expected       | 59 +++++++++++++
 .../CWE-094/JakartaExpressionInjection.java   | 87 +++++++++++++++++++
 .../CWE-094/JakartaExpressionInjection.qlref  |  1 +
 .../query-tests/security/CWE-094/options      |  3 +-
 .../stubs/java-ee-el/javax/el/ELContext.java  |  3 +
 .../stubs/java-ee-el/javax/el/ELManager.java  |  5 ++
 .../java-ee-el/javax/el/ELProcessor.java      |  7 ++
 .../javax/el/ExpressionFactory.java           | 17 ++++
 .../java-ee-el/javax/el/LambdaExpression.java |  8 ++
 .../java-ee-el/javax/el/MethodExpression.java |  5 ++
 .../javax/el/StandardELContext.java           |  5 ++
 .../java-ee-el/javax/el/ValueExpression.java  |  6 ++
 .../de/odysseus/el/ExpressionFactoryImpl.java |  5 ++
 .../de/odysseus/el/util/SimpleContext.java    |  5 ++
 16 files changed, 223 insertions(+), 11 deletions(-)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/ELContext.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/ELManager.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java
 create mode 100644 java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java
 create mode 100644 java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java
 create mode 100644 java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
index b94c98201dea..8190ec3d61f1 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
@@ -1,6 +1,6 @@
 /**
- * @name Java EE Expression Language injection
- * @description Evaluation of a user-controlled Jave EE expression
+ * @name Jakarta Expression Language injection
+ * @description Evaluation of a user-controlled expression
  *              may lead to arbitrary code execution.
  * @kind path-problem
  * @problem.severity error
@@ -11,10 +11,10 @@
  */
 
 import java
-import JavaEEExpressionInjectionLib
+import JakartaExpressionInjectionLib
 import DataFlow::PathGraph
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, JavaEEExpressionInjectionConfig conf
+from DataFlow::PathNode source, DataFlow::PathNode sink, JakartaExpressionInjectionConfig conf
 where conf.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Java EE Expression Language injection from $@.",
+select sink.getNode(), source, sink, "Jakarta Expression Language injection from $@.",
   source.getNode(), "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index d43b31c98881..bc22f7c32572 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -5,10 +5,10 @@ import semmle.code.java.dataflow.TaintTracking
 
 /**
  * A taint-tracking configuration for unsafe user input
- * that is used to construct and evaluate a Java EE expression.
+ * that is used to construct and evaluate an expression.
  */
-class JavaEEExpressionInjectionConfig extends TaintTracking::Configuration {
-  JavaEEExpressionInjectionConfig() { this = "JavaEEExpressionInjectionConfig" }
+class JakartaExpressionInjectionConfig extends TaintTracking::Configuration {
+  JakartaExpressionInjectionConfig() { this = "JakartaExpressionInjectionConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
@@ -22,7 +22,7 @@ class JavaEEExpressionInjectionConfig extends TaintTracking::Configuration {
 
 /**
  * A sink for Expresssion Language injection vulnerabilities,
- * i.e. method calls that run evaluation of a Java EE expression.
+ * i.e. method calls that run evaluation of an expression.
  */
 private class ExpressionEvaluationSink extends DataFlow::ExprNode {
   ExpressionEvaluationSink() {
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
new file mode 100644
index 000000000000..111cc81541c2
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -0,0 +1,59 @@
+edges
+| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:24:31:24:40 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:30:24:30:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:37:24:37:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:44:24:44:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:54:24:54:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:61:24:61:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:70:24:70:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:79:24:79:33 | expression : String |
+| JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
+| JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
+| JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
+| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
+| JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
+| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression |
+| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e |
+| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
+| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
+| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e |
+| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
+| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
+| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression |
+| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e |
+| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
+| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
+| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e |
+| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
+| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
+| JakartaExpressionInjection.java:79:24:79:33 | expression : String | JakartaExpressionInjection.java:83:13:83:13 | e |
+nodes
+| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:30:24:30:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:32:28:32:37 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:37:24:37:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:39:32:39:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:44:24:44:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | semmle.label | new LambdaExpression(...) : LambdaExpression |
+| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | semmle.label | lambdaExpression |
+| JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
+| JakartaExpressionInjection.java:65:13:65:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | semmle.label | e : ValueExpression |
+| JakartaExpressionInjection.java:70:24:70:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
+| JakartaExpressionInjection.java:74:13:74:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | semmle.label | e : ValueExpression |
+| JakartaExpressionInjection.java:79:24:79:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:83:13:83:13 | e | semmle.label | e |
+#select
+| JakartaExpressionInjection.java:32:28:32:37 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:32:28:32:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:39:32:39:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:39:32:39:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:56:32:56:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:56:32:56:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:65:13:65:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:65:13:65:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:74:13:74:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:74:13:74:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:83:13:83:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:83:13:83:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
new file mode 100644
index 000000000000..a9fb2d45d6f4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
@@ -0,0 +1,87 @@
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.util.ArrayList;
+import java.util.function.Consumer;
+
+import javax.el.ELContext;
+import javax.el.ELManager;
+import javax.el.ELProcessor;
+import javax.el.ExpressionFactory;
+import javax.el.LambdaExpression;
+import javax.el.MethodExpression;
+import javax.el.StandardELContext;
+import javax.el.ValueExpression;
+
+public class JakartaExpressionInjection {
+    
+    private static void testWithSocket(Consumer<String> action) throws IOException {
+        try (ServerSocket serverSocket = new ServerSocket(0)) {
+            try (Socket socket = serverSocket.accept()) {
+                byte[] bytes = new byte[1024];
+                int n = socket.getInputStream().read(bytes);
+                String expression = new String(bytes, 0, n);
+                action.accept(expression);
+            }
+        }
+    }
+
+    private static void testWithELProcessorEval() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.eval(expression);
+        });
+    }
+
+    private static void testWithELProcessorGetValue() throws IOException {
+        testWithSocket(expression -> {   
+            ELProcessor processor = new ELProcessor();
+            processor.getValue(expression, Object.class);
+        });
+    }
+
+    private static void testWithLambdaExpressionInvoke() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = ELManager.getExpressionFactory();
+            StandardELContext context = new StandardELContext(factory);
+            ValueExpression valueExpression = factory.createValueExpression(context, expression, Object.class);
+            LambdaExpression lambdaExpression = new LambdaExpression(new ArrayList<>(), valueExpression);
+            lambdaExpression.invoke(context, new Object[0]);
+        });
+    }
+
+    private static void testWithELProcessorSetValue() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.setValue(expression, new Object());
+        });
+    }
+
+    private static void testWithJuelValueExpressionGetValue() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+            e.getValue(context);
+        });
+    }
+
+    private static void testWithJuelValueExpressionSetValue() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+            e.setValue(context, new Object());
+        });
+    }
+
+    private static void testWithJuelMethodExpressionInvoke() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            MethodExpression e = factory.createMethodExpression(context, expression, Object.class, new Class[0]);
+            e.invoke(context, new Object[0]);
+        });
+    }
+
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref
new file mode 100644
index 000000000000..3154ee5ccad4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/options b/java/ql/test/experimental/query-tests/security/CWE-094/options
index a8e30ce30b40..ec3354ea41ce 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/options
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/options
@@ -1,2 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine
-
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2
\ No newline at end of file
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java b/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java
new file mode 100644
index 000000000000..ce3840c69c8d
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java
@@ -0,0 +1,3 @@
+package javax.el;
+
+public class ELContext {}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java b/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java
new file mode 100644
index 000000000000..7d24f739a3f8
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class ELManager {
+    public static ExpressionFactory getExpressionFactory() { return null; }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
new file mode 100644
index 000000000000..3c523e685c5e
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
@@ -0,0 +1,7 @@
+package javax.el;
+
+public class ELProcessor {
+    public Object eval(String expression) { return null; }
+    public Object getValue(String expression, Class<?> expectedType) { return null; }
+    public void setValue(String expression, Object value) {}
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java b/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java
new file mode 100644
index 000000000000..31ff79169acb
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java
@@ -0,0 +1,17 @@
+package javax.el;
+
+public class ExpressionFactory {
+    public MethodExpression createMethodExpression(ELContext context, String expression, Class<?> expectedReturnType,
+            Class<?>[] expectedParamTypes) {
+
+        return null;
+    }
+
+    public ValueExpression createValueExpression(ELContext context, String expression, Class<?> expectedType) {
+        return null;
+    }
+
+    public ValueExpression createValueExpression(Object instance, Class<?> expectedType) {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java
new file mode 100644
index 000000000000..4be01e9d2e4b
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java
@@ -0,0 +1,8 @@
+package javax.el;
+
+import java.util.List;
+
+public class LambdaExpression {
+    public LambdaExpression(List<String> formalParameters, ValueExpression expression) {}
+    public Object invoke(Object... args) { return null; }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java
new file mode 100644
index 000000000000..ac50ece80e36
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class MethodExpression {
+    public Object invoke(ELContext context, Object[] params) { return null; }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java b/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java
new file mode 100644
index 000000000000..22e3f2a9fc13
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class StandardELContext extends ELContext {
+    public StandardELContext(ExpressionFactory factory) {}
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java
new file mode 100644
index 000000000000..9a231215640a
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java
@@ -0,0 +1,6 @@
+package javax.el;
+
+public class ValueExpression {
+    public Object getValue(ELContext context) { return null; }
+    public void setValue(ELContext context, Object value) {}
+}
diff --git a/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java b/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java
new file mode 100644
index 000000000000..a555cf88dee0
--- /dev/null
+++ b/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java
@@ -0,0 +1,5 @@
+package de.odysseus.el;
+
+import javax.el.ExpressionFactory;
+
+public class ExpressionFactoryImpl extends ExpressionFactory {}
diff --git a/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java b/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java
new file mode 100644
index 000000000000..aa4f449e5fa5
--- /dev/null
+++ b/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java
@@ -0,0 +1,5 @@
+package de.odysseus.el.util;
+
+import javax.el.ELContext;
+
+public class SimpleContext extends ELContext {}

From 6c246994035a35925d870f97abc58c04162d53f9 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Sun, 21 Mar 2021 21:16:00 +0300
Subject: [PATCH 057/433] Cover both javax.el and jakarta.el packages

---
 .../CWE-094/JakartaExpressionInjectionLib.qll | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index bc22f7c32572..22f421b8bf8c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -77,22 +77,26 @@ private class TaintPropagatingCall extends Call {
   }
 }
 
-private class ELProcessor extends RefType {
-  ELProcessor() { hasQualifiedName("javax.el", "ELProcessor") }
+private class JakartaType extends RefType {
+  JakartaType() { getPackage().hasName(["javax.el", "jakarta.el"]) }
 }
 
-private class ExpressionFactory extends RefType {
-  ExpressionFactory() { hasQualifiedName("javax.el", "ExpressionFactory") }
+private class ELProcessor extends JakartaType {
+  ELProcessor() { hasName("ELProcessor") }
 }
 
-private class ValueExpression extends RefType {
-  ValueExpression() { hasQualifiedName("javax.el", "ValueExpression") }
+private class ExpressionFactory extends JakartaType {
+  ExpressionFactory() { hasName("ExpressionFactory") }
 }
 
-private class MethodExpression extends RefType {
-  MethodExpression() { hasQualifiedName("javax.el", "MethodExpression") }
+private class ValueExpression extends JakartaType {
+  ValueExpression() { hasName("ValueExpression") }
+}
+
+private class MethodExpression extends JakartaType {
+  MethodExpression() { hasName("MethodExpression") }
 }
 
 private class LambdaExpression extends RefType {
-  LambdaExpression() { hasQualifiedName("javax.el", "LambdaExpression") }
+  LambdaExpression() { hasName("LambdaExpression") }
 }

From 701b935564521d64cc35dc51753493f4dc2782f6 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 22 Mar 2021 00:57:43 +0100
Subject: [PATCH 058/433] Python: Add example of QuerySet chain (django)

---
 python/ql/test/library-tests/frameworks/django/SqlExecution.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/python/ql/test/library-tests/frameworks/django/SqlExecution.py b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
index 67a6ee81a5d1..fba2ccdc73e4 100644
--- a/python/ql/test/library-tests/frameworks/django/SqlExecution.py
+++ b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
@@ -27,3 +27,6 @@ def test_model():
 
     raw = RawSQL("so raw")
     User.objects.annotate(val=raw)  # $getSql="so raw"
+
+    # chaining QuerySet calls
+    User.objects.using("db-name").exclude(username="admin").extra("some sql") # $ MISSING: getSql="some sql"

From c8a6e837b57513df5c8ccd081e193be3443987d1 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 22 Mar 2021 14:36:29 +0100
Subject: [PATCH 059/433] Python: Model QuerySet chains in django

---
 .../2021-03-22-django-queryset-chains.md      |   2 +
 .../src/semmle/python/frameworks/Django.qll   | 120 +++++++-----------
 .../frameworks/django/SqlExecution.py         |   2 +-
 3 files changed, 50 insertions(+), 74 deletions(-)
 create mode 100644 python/change-notes/2021-03-22-django-queryset-chains.md

diff --git a/python/change-notes/2021-03-22-django-queryset-chains.md b/python/change-notes/2021-03-22-django-queryset-chains.md
new file mode 100644
index 000000000000..116a75733609
--- /dev/null
+++ b/python/change-notes/2021-03-22-django-queryset-chains.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of `django` to recognize QuerySet chains such as `User.objects.using("db-name").exclude(username="admin").extra("some sql")`. This can lead to new results for `py/sql-injection`.
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 9f56bd5a2992..384fdf69a15e 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -8,6 +8,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import semmle.python.frameworks.PEP249
 private import semmle.python.regex
 
@@ -104,9 +105,6 @@ private module Django {
       // -------------------------------------------------------------------------
       // django.db.models
       // -------------------------------------------------------------------------
-      // NOTE: The modelling of django models is currently fairly incomplete.
-      // It does not fully take `Model`s, `Manager`s, `and QuerySet`s into account.
-      // It simply identifies some common dangerous cases.
       /** Gets a reference to the `django.db.models` module. */
       private DataFlow::Node models(DataFlow::TypeTracker t) {
         t.start() and
@@ -123,71 +121,51 @@ private module Django {
 
       /** Provides models for the `django.db.models` module. */
       module models {
-        /** Provides models for the `django.db.models.Model` class. */
+        /**
+         * Provides models for the `django.db.models.Model` class and subclasses.
+         *
+         * See https://docs.djangoproject.com/en/3.1/topics/db/models/.
+         */
         module Model {
-          /** Gets a reference to the `django.db.models.Model` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = DataFlow::importNode("django.db.models.Model")
-            or
-            t.startInAttr("Model") and
-            result = models()
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          /** Gets a reference to the `flask.views.View` class or any subclass. */
+          API::Node subclassRef() {
+            result =
+              API::moduleImport("django")
+                  .getMember("db")
+                  .getMember("models")
+                  .getMember("Model")
+                  .getASubclass*()
           }
-
-          /** Gets a reference to the `django.db.models.Model` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-        }
-
-        /** Gets a reference to the `objects` object of a django model. */
-        private DataFlow::Node objects(DataFlow::TypeTracker t) {
-          t.startInAttr("objects") and
-          result = Model::classRef()
-          or
-          exists(DataFlow::TypeTracker t2 | result = objects(t2).track(t2, t))
         }
 
-        /** Gets a reference to the `objects` object of a model. */
-        DataFlow::Node objects() { result = objects(DataFlow::TypeTracker::end()) }
-
         /**
-         * Gets a reference to the attribute `attr_name` of an `objects` object.
-         * WARNING: Only holds for a few predefined attributes.
+         * Gets a reference to the Manager (django.db.models.Manager) for a django Model,
+         * accessed by `<ModelName>.objects`.
          */
-        private DataFlow::Node objects_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["annotate", "extra", "raw"] and
-          t.startInAttr(attr_name) and
-          result = objects()
-          or
-          // Due to bad performance when using normal setup with `objects_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              objects_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
+        API::Node manager() { result = Model::subclassRef().getMember("objects") }
 
-        pragma[nomagic]
-        private predicate objects_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(objects_attr(t2, attr_name), res, summary)
+        /**
+         * Gets a method with `name` that returns a QuerySet.
+         * This method can originate on a QuerySet or a Manager.
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/
+         */
+        API::Node querySetReturningMethod(string name) {
+          name in [
+              "none", "all", "filter", "exclude", "complex_filter", "union", "intersection",
+              "difference", "select_for_update", "select_related", "prefetch_related", "order_by",
+              "distinct", "reverse", "defer", "only", "using", "annotate", "extra", "raw",
+              "datetimes", "dates", "values", "values_list"
+            ] and
+          result = [manager(), querySet()].getMember(name)
         }
 
         /**
-         * Gets a reference to the attribute `attr_name` of an `objects` object.
-         * WARNING: Only holds for a few predefined attributes.
+         * Gets a reference to a QuerySet (django.db.models.query.QuerySet).
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/
          */
-        DataFlow::Node objects_attr(string attr_name) {
-          result = objects_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
+        API::Node querySet() { result = querySetReturningMethod(_).getReturn() }
 
         /** Gets a reference to the `django.db.models.expressions` module. */
         private DataFlow::Node expressions(DataFlow::TypeTracker t) {
@@ -253,14 +231,13 @@ private module Django {
      *
      * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/#annotate
      */
-    private class ObjectsAnnotate extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
+    private class ObjectsAnnotate extends SqlExecution::Range, DataFlow::CallCfgNode {
       ControlFlowNode sql;
 
       ObjectsAnnotate() {
-        node.getFunction() = django::db::models::objects_attr("annotate").asCfgNode() and
-        django::db::models::expressions::RawSQL::instance(sql).asCfgNode() in [
-            node.getArg(_), node.getArgByName(_)
+        this = django::db::models::querySetReturningMethod("annotate").getACall() and
+        django::db::models::expressions::RawSQL::instance(sql) in [
+            this.getArg(_), this.getArgByName(_)
           ]
       }
 
@@ -274,12 +251,10 @@ private module Django {
      * - https://docs.djangoproject.com/en/3.1/topics/db/sql/#django.db.models.Manager.raw
      * - https://docs.djangoproject.com/en/3.1/ref/models/querysets/#raw
      */
-    private class ObjectsRaw extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
-
-      ObjectsRaw() { node.getFunction() = django::db::models::objects_attr("raw").asCfgNode() }
+    private class ObjectsRaw extends SqlExecution::Range, DataFlow::CallCfgNode {
+      ObjectsRaw() { this = django::db::models::querySetReturningMethod("raw").getACall() }
 
-      override DataFlow::Node getSql() { result.asCfgNode() = node.getArg(0) }
+      override DataFlow::Node getSql() { result = this.getArg(0) }
     }
 
     /**
@@ -287,14 +262,13 @@ private module Django {
      *
      * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/#extra
      */
-    private class ObjectsExtra extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
-
-      ObjectsExtra() { node.getFunction() = django::db::models::objects_attr("extra").asCfgNode() }
+    private class ObjectsExtra extends SqlExecution::Range, DataFlow::CallCfgNode {
+      ObjectsExtra() { this = django::db::models::querySetReturningMethod("extra").getACall() }
 
       override DataFlow::Node getSql() {
-        result.asCfgNode() =
-          [node.getArg([0, 1, 3, 4]), node.getArgByName(["select", "where", "tables", "order_by"])]
+        result in [
+            this.getArg([0, 1, 3, 4]), this.getArgByName(["select", "where", "tables", "order_by"])
+          ]
       }
     }
 
diff --git a/python/ql/test/library-tests/frameworks/django/SqlExecution.py b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
index fba2ccdc73e4..449983fc898c 100644
--- a/python/ql/test/library-tests/frameworks/django/SqlExecution.py
+++ b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
@@ -29,4 +29,4 @@ def test_model():
     User.objects.annotate(val=raw)  # $getSql="so raw"
 
     # chaining QuerySet calls
-    User.objects.using("db-name").exclude(username="admin").extra("some sql") # $ MISSING: getSql="some sql"
+    User.objects.using("db-name").exclude(username="admin").extra("some sql") # $ getSql="some sql"

From 08c3bf26d558d1bfaf0504fa1a0ba6837910829a Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Tue, 16 Mar 2021 03:18:26 +0000
Subject: [PATCH 060/433] Update the query to accommodate more cases

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 73 +++++++++++++++++--
 .../SensitiveCookieNotHttpOnly.expected       |  8 ++
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  | 57 +++++++++++++++
 3 files changed, 130 insertions(+), 8 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index 693dad68082c..ac33a6cecb2b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -33,7 +33,23 @@ predicate isSensitiveCookieNameExpr(Expr expr) {
 
 /** Holds if a string is concatenated with the `HttpOnly` flag. */
 predicate hasHttpOnlyExpr(Expr expr) {
-  expr.(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%") or
+  (
+    expr.(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%")
+    or
+    exists(
+      StaticMethodAccess ma // String.format("%s=%s;HttpOnly", "sessionkey", sessionKey)
+    |
+      ma.getType().getName() = "String" and
+      ma.getMethod().getName() = "format" and
+      ma.getArgument(0)
+          .(CompileTimeConstantExpr)
+          .getStringValue()
+          .toLowerCase()
+          .matches("%httponly%") and
+      expr = ma
+    )
+  )
+  or
   hasHttpOnlyExpr(expr.(AddExpr).getAnOperand())
 }
 
@@ -56,6 +72,40 @@ class CookieClass extends RefType {
   }
 }
 
+/** Holds if the `Expr` expr is evaluated to boolean true. */
+predicate isBooleanTrue(Expr expr) {
+  expr.(CompileTimeConstantExpr).getBooleanValue() = true or
+  expr.(VarAccess).getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getBooleanValue() =
+    true
+}
+
+/** Holds if the method or a wrapper method sets the `HttpOnly` flag. */
+predicate setHttpOnlyInCookie(MethodAccess ma) {
+  ma.getMethod().getName() = "setHttpOnly" and
+  (
+    isBooleanTrue(ma.getArgument(0)) // boolean literal true
+    or
+    exists(
+      MethodAccess mpa, int i // runtime assignment of boolean value true
+    |
+      TaintTracking::localTaint(DataFlow::parameterNode(mpa.getMethod().getParameter(i)),
+        DataFlow::exprNode(ma.getArgument(0))) and
+      isBooleanTrue(mpa.getArgument(i))
+    )
+  )
+  or
+  exists(MethodAccess mca |
+    ma.getMethod().calls(mca.getMethod()) and
+    setHttpOnlyInCookie(mca)
+  )
+}
+
+/** Holds if the method or a wrapper method removes a cookie. */
+predicate removeCookie(MethodAccess ma) {
+  ma.getMethod().getName() = "setMaxAge" and
+  ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
+}
+
 /** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
@@ -69,11 +119,16 @@ class CookieResponseSink extends DataFlow::ExprNode {
         ma.getMethod() instanceof ResponseAddCookieMethod and
         this.getExpr() = ma.getArgument(0) and
         not exists(
-          MethodAccess ma2 // cookie.setHttpOnly(true)
+          MethodAccess ma2 // a method or wrapper method that invokes cookie.setHttpOnly(true)
         |
-          ma2.getMethod().getName() = "setHttpOnly" and
-          ma2.getArgument(0).(BooleanLiteral).getBooleanValue() = true and
-          DataFlow::localExprFlow(ma2.getQualifier(), this.getExpr())
+          (
+            setHttpOnlyInCookie(ma2) or
+            removeCookie(ma2)
+          ) and
+          (
+            DataFlow::localExprFlow(ma2.getQualifier(), this.getExpr()) or
+            DataFlow::localExprFlow(ma2, this.getExpr())
+          )
         )
         or
         ma instanceof SetCookieMethodAccess and
@@ -92,13 +147,15 @@ class CookieResponseSink extends DataFlow::ExprNode {
 predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
   cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
   (
-    cie.getNumArgument() = 6 and cie.getArgument(5).(BooleanLiteral).getBooleanValue() = true // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    cie.getNumArgument() = 6 and
+    isBooleanTrue(cie.getArgument(5)) // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
     or
     cie.getNumArgument() = 8 and
     cie.getArgument(6).getType() instanceof BooleanType and
-    cie.getArgument(7).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+    isBooleanTrue(cie.getArgument(7)) // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
     or
-    cie.getNumArgument() = 10 and cie.getArgument(9).(BooleanLiteral).getBooleanValue() = true // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    cie.getNumArgument() = 10 and
+    isBooleanTrue(cie.getArgument(9)) // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
   )
 }
 
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index 8fa688bef2a6..dae98e92e673 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -7,6 +7,9 @@ edges
 | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie |
 nodes
 | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
 | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | semmle.label | jwtCookie |
@@ -21,6 +24,10 @@ nodes
 | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | semmle.label | ... + ... : String |
 | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | semmle.label | ... + ... : String |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | semmle.label | secString |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | semmle.label | "Presto-UI-Token" : String |
+| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | semmle.label | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie | semmle.label | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | semmle.label | cookie |
 #select
 | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" | This sensitive cookie |
@@ -31,3 +38,4 @@ nodes
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 337a99cc096d..fdc831d78366 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -71,6 +71,63 @@ public void addCookie9(String authId, HttpServletRequest request, HttpServletRes
         response.addHeader("Set-Cookie", secString);
     }
 
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set using `String.format(...)`.
+    public void addCookie10(HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("SET-COOKIE", String.format("%s=%s;HttpOnly", "sessionkey", request.getSession().getAttribute("sessionkey")));
+    }
+
+    public Cookie createHttpOnlyAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setHttpOnly(true);
+        cookie.setPath("/ui");
+        return cookie;
+    }
+
+    public Cookie createAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setPath("/ui");
+        return cookie;
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set using a wrapper method.
+    public void addCookie11(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = createHttpOnlyAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
+    // BAD - Tests set a sensitive cookie header without the `HttpOnly` flag set using a wrapper method.
+    public void addCookie12(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = createAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
+    private Cookie createCookie(String name, String value, Boolean httpOnly){
+        Cookie cookie = null;
+        cookie = new Cookie(name, value);
+        cookie.setDomain("/");
+        cookie.setHttpOnly(httpOnly);
+
+        //for production https
+        cookie.setSecure(true);
+
+        cookie.setMaxAge(60*60*24*30);
+        cookie.setPath("/");
+
+        return cookie;
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set through a boolean variable using a wrapper method.
+    public void addCookie13(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+        response.addCookie(createCookie("refresh_token", refreshToken, true));
+    }
+
+    // BAD - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
+    public void addCookie14(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+        response.addCookie(createCookie("refresh_token", refreshToken, false));
+    }
+
     // GOOD - CSRF token doesn't need to have the `HttpOnly` flag set.
     public void addCsrfCookie(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         // Spring put the CSRF token in session attribute "_csrf"

From fe0e7f5eac232e2aae155fe332c57c9e30e61cdf Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Thu, 25 Mar 2021 01:45:13 +0000
Subject: [PATCH 061/433] Change method check to taint flow

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 70 ++++++++++---------
 .../SensitiveCookieNotHttpOnly.expected       | 10 +--
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  | 18 ++++-
 3 files changed, 58 insertions(+), 40 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index ac33a6cecb2b..db9adc2ee09b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -11,6 +11,7 @@ import java
 import semmle.code.java.dataflow.FlowSteps
 import semmle.code.java.frameworks.Servlets
 import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.TaintTracking2
 import DataFlow::PathGraph
 
 /** Gets a regular expression for matching common names of sensitive cookies. */
@@ -31,28 +32,6 @@ predicate isSensitiveCookieNameExpr(Expr expr) {
   isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
 }
 
-/** Holds if a string is concatenated with the `HttpOnly` flag. */
-predicate hasHttpOnlyExpr(Expr expr) {
-  (
-    expr.(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%")
-    or
-    exists(
-      StaticMethodAccess ma // String.format("%s=%s;HttpOnly", "sessionkey", sessionKey)
-    |
-      ma.getType().getName() = "String" and
-      ma.getMethod().getName() = "format" and
-      ma.getArgument(0)
-          .(CompileTimeConstantExpr)
-          .getStringValue()
-          .toLowerCase()
-          .matches("%httponly%") and
-      expr = ma
-    )
-  )
-  or
-  hasHttpOnlyExpr(expr.(AddExpr).getAnOperand())
-}
-
 /** The method call `Set-Cookie` of `addHeader` or `setHeader`. */
 class SetCookieMethodAccess extends MethodAccess {
   SetCookieMethodAccess() {
@@ -64,6 +43,22 @@ class SetCookieMethodAccess extends MethodAccess {
   }
 }
 
+/**
+ * A taint configuration tracking flow from the text `httponly` to argument 1 of
+ * `SetCookieMethodAccess`.
+ */
+class MatchesHttpOnlyConfiguration extends TaintTracking2::Configuration {
+  MatchesHttpOnlyConfiguration() { this = "MatchesHttpOnlyConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%")
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(SetCookieMethodAccess ma).getArgument(1)
+  }
+}
+
 /** The cookie class of Java EE. */
 class CookieClass extends RefType {
   CookieClass() {
@@ -79,7 +74,7 @@ predicate isBooleanTrue(Expr expr) {
     true
 }
 
-/** Holds if the method or a wrapper method sets the `HttpOnly` flag. */
+/** Holds if the method call sets the `HttpOnly` flag. */
 predicate setHttpOnlyInCookie(MethodAccess ma) {
   ma.getMethod().getName() = "setHttpOnly" and
   (
@@ -93,14 +88,24 @@ predicate setHttpOnlyInCookie(MethodAccess ma) {
       isBooleanTrue(mpa.getArgument(i))
     )
   )
-  or
-  exists(MethodAccess mca |
-    ma.getMethod().calls(mca.getMethod()) and
-    setHttpOnlyInCookie(mca)
-  )
 }
 
-/** Holds if the method or a wrapper method removes a cookie. */
+/**
+ * A taint configuration tracking flow of a method or a wrapper method that sets
+ * the `HttpOnly` flag.
+ */
+class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
+  SetHttpOnlyInCookieConfiguration() { this = "SetHttpOnlyInCookieConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) { any() }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() =
+      any(MethodAccess ma | ma.getMethod() instanceof ResponseAddCookieMethod).getArgument(0)
+  }
+}
+
+/** Holds if the method call removes a cookie. */
 predicate removeCookie(MethodAccess ma) {
   ma.getMethod().getName() = "setMaxAge" and
   ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
@@ -125,15 +130,14 @@ class CookieResponseSink extends DataFlow::ExprNode {
             setHttpOnlyInCookie(ma2) or
             removeCookie(ma2)
           ) and
-          (
-            DataFlow::localExprFlow(ma2.getQualifier(), this.getExpr()) or
-            DataFlow::localExprFlow(ma2, this.getExpr())
+          exists(SetHttpOnlyInCookieConfiguration cc |
+            cc.hasFlow(DataFlow::exprNode(ma2.getQualifier()), this)
           )
         )
         or
         ma instanceof SetCookieMethodAccess and
         this.getExpr() = ma.getArgument(1) and
-        not hasHttpOnlyExpr(this.getExpr()) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
+        not exists(MatchesHttpOnlyConfiguration cc | cc.hasFlowToExpr(ma.getArgument(1))) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
       ) and
       not isTestMethod(ma) // Test class or method
     )
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index dae98e92e673..a9d126ca4a97 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -8,8 +8,8 @@ edges
 | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
-| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie |
-| SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie |
+| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie |
 nodes
 | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
 | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | semmle.label | jwtCookie |
@@ -26,8 +26,8 @@ nodes
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | semmle.label | secString |
 | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | semmle.label | "Presto-UI-Token" : String |
 | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | semmle.label | cookie : Cookie |
-| SensitiveCookieNotHttpOnly.java:102:25:102:64 | createAuthenticationCookie(...) : Cookie | semmle.label | createAuthenticationCookie(...) : Cookie |
-| SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | semmle.label | cookie |
+| SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | semmle.label | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | semmle.label | cookie |
 #select
 | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" | This sensitive cookie |
@@ -38,4 +38,4 @@ nodes
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... | This sensitive cookie |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... | This sensitive cookie |
-| SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:103:28:103:33 | cookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index fdc831d78366..0bb912f6ce67 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -91,6 +91,14 @@ public Cookie createAuthenticationCookie(HttpServletRequest request, String jwt)
         return cookie;
     }
 
+    public Cookie removeAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setPath("/ui");
+        cookie.setMaxAge(0);
+        return cookie;
+    }
+
     // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set using a wrapper method.
     public void addCookie11(HttpServletRequest request, HttpServletResponse response, String jwt) {
         Cookie cookie = createHttpOnlyAuthenticationCookie(request, jwt);
@@ -103,6 +111,12 @@ public void addCookie12(HttpServletRequest request, HttpServletResponse response
         response.addCookie(cookie);
     }
 
+    // GOOD - Tests remove a sensitive cookie header without the `HttpOnly` flag set using a wrapper method.
+    public void addCookie13(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = removeAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
     private Cookie createCookie(String name, String value, Boolean httpOnly){
         Cookie cookie = null;
         cookie = new Cookie(name, value);
@@ -119,12 +133,12 @@ private Cookie createCookie(String name, String value, Boolean httpOnly){
     }
 
     // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set through a boolean variable using a wrapper method.
-    public void addCookie13(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+    public void addCookie14(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
         response.addCookie(createCookie("refresh_token", refreshToken, true));
     }
 
     // BAD - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
-    public void addCookie14(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+    public void addCookie15(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
         response.addCookie(createCookie("refresh_token", refreshToken, false));
     }
 

From 57bd3f3c1459c04aa0098a254522bcc405f86d80 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Thu, 25 Mar 2021 10:44:26 +0000
Subject: [PATCH 062/433] Optimize the taint flow source

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index db9adc2ee09b..f1bc7879b8a6 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -97,7 +97,10 @@ predicate setHttpOnlyInCookie(MethodAccess ma) {
 class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
   SetHttpOnlyInCookieConfiguration() { this = "SetHttpOnlyInCookieConfiguration" }
 
-  override predicate isSource(DataFlow::Node source) { any() }
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr() =
+      any(MethodAccess ma | setHttpOnlyInCookie(ma) or removeCookie(ma)).getQualifier()
+  }
 
   override predicate isSink(DataFlow::Node sink) {
     sink.asExpr() =
@@ -123,21 +126,11 @@ class CookieResponseSink extends DataFlow::ExprNode {
       (
         ma.getMethod() instanceof ResponseAddCookieMethod and
         this.getExpr() = ma.getArgument(0) and
-        not exists(
-          MethodAccess ma2 // a method or wrapper method that invokes cookie.setHttpOnly(true)
-        |
-          (
-            setHttpOnlyInCookie(ma2) or
-            removeCookie(ma2)
-          ) and
-          exists(SetHttpOnlyInCookieConfiguration cc |
-            cc.hasFlow(DataFlow::exprNode(ma2.getQualifier()), this)
-          )
-        )
+        not exists(SetHttpOnlyInCookieConfiguration cc | cc.hasFlowTo(this))
         or
         ma instanceof SetCookieMethodAccess and
         this.getExpr() = ma.getArgument(1) and
-        not exists(MatchesHttpOnlyConfiguration cc | cc.hasFlowToExpr(ma.getArgument(1))) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
+        not exists(MatchesHttpOnlyConfiguration cc | cc.hasFlowTo(this)) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
       ) and
       not isTestMethod(ma) // Test class or method
     )

From 2576c86ebf2e8a87a8cbe5165ae2ab95a7bec155 Mon Sep 17 00:00:00 2001
From: alexet <alexet@semmle.com>
Date: Thu, 25 Mar 2021 16:16:16 +0000
Subject: [PATCH 063/433] Docs: Update the language specification for changes
 to super.

---
 .../ql-language-reference/ql-language-specification.rst  | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/codeql/ql-language-reference/ql-language-specification.rst b/docs/codeql/ql-language-reference/ql-language-specification.rst
index 0fe542105046..ad88b791019e 100644
--- a/docs/codeql/ql-language-reference/ql-language-specification.rst
+++ b/docs/codeql/ql-language-reference/ql-language-specification.rst
@@ -1116,8 +1116,6 @@ A super expression may only occur in a QL program as the receiver expression for
 
 If a super expression includes a ``type``, then that type must be a class that the enclosing class inherits from.
 
-If the super expression does not include a type, then the enclosing class must have a single declared base type, and that base type must be a class.
-
 The value of a super expression is the same as the value of ``this`` in the named tuple.
 
 Casts
@@ -1169,7 +1167,12 @@ A valid call with results *resolves* to a set of predicates. The ways a call can
 
 -  If the call has no receiver and the predicate name is a selection identifier, then the qualifier is resolved as a module (see "`Module resolution <#module-resolution>`__"). The identifier is then resolved in the exported predicate environment of the qualifier module.
 
--  If the call has a super expression as the receiver, then it resolves to a member predicate in a class the enclosing class inherits from. If the super expression is unqualified, then the super-class is the single class that the current class inherits from. If there is not exactly one such class, then the program is invalid. Otherwise the super-class is the class named by the qualifier of the super expression. The predicate is resolved by looking up its name and arity in the exported predicate environment of the super-class. 
+-  If the call has a super expression as the receiver, then it resolves to a member predicate in a class that the enclosing class inherits from:
+    -  If the super expression is unqualified and there is a single class that the current class inherits from then the super-class is that class. 
+    -  If the super expression is unqualified and there is are multiple classes that the current class inherits from then the super-class is the domain type.
+    -  Otherwise the super-class is the class named by the qualifier of the super expression. 
+
+   The predicate is resolved by looking up its name and arity in the exported predicate environment of the super-class. 
 
 -  If the type of the receiver is the same as the enclosing class, the predicate is resolved by looking up its name and arity in the visible predicate environment of the class.
 

From 2ca95166d916cc89bf2d7086aa664ef3757c95e4 Mon Sep 17 00:00:00 2001
From: Porcuiney Hairs <porcupiney.hairs@protonmail.com>
Date: Wed, 13 Jan 2021 01:32:54 +0530
Subject: [PATCH 064/433] Java : add query to detect insecure loading of Dex
 File

---
 .../CWE/CWE-094/InsecureDexLoading.qhelp      |  44 ++++++++
 .../CWE/CWE-094/InsecureDexLoading.ql         |  20 ++++
 .../CWE/CWE-094/InsecureDexLoading.qll        | 100 ++++++++++++++++++
 .../CWE/CWE-094/InsecureDexLoadingBad.java    |  32 ++++++
 .../CWE/CWE-094/InsecureDexLoadingGood.java   |  23 ++++
 5 files changed, 219 insertions(+)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
new file mode 100644
index 000000000000..feda3af3fc26
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
@@ -0,0 +1,44 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+Shared world writable storage spaces are not secure to load Dex libraries from. A malicious actor can replace a dex file with a maliciously crafted file 
+which when loaded by the app can lead to code execution. 
+</p>
+  </overview>
+
+  <recommendation>
+    <p>
+      Loading a file from private storage instead of a world writable one can prevent this issue.
+      As the attacker cannot access files stored by the app in its private storage. 
+    </p>
+  </recommendation>
+
+  <example>
+    <p>
+      The following example loads a Dex file from a shared world writable location. in this case, 
+      since the `/sdcard` directory is on external storage, any one can read/write to the location. 
+      bypassing all Android security policies. Hence, this is insecure.
+    </p>
+    <sample src="InsecureDexLoadingBad.java" />
+
+    <p>
+    The next example loads a Dex file stored inside the app's private storage. 
+    This is not exploitable as nobody else except the app can access the data stored here.
+    </p>
+    <sample src="InsecureDexLoadingGood.java" />
+  </example>
+
+  <references>
+    <li>
+      Android Documentation:
+      <a href="https://developer.android.com/training/data-storage/">Data and file storage overview</a>
+      .
+    </li>
+    <li>
+      Android Documentation:
+      <a href="https://developer.android.com/reference/dalvik/system/DexClassLoader">DexClassLoader</a>
+      .
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
new file mode 100644
index 000000000000..58d9844d38aa
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Insecure loading of an Android Dex File
+ * @description Loading a DEX library located in a world-readable/ writable location such as
+ * a SD card can cause arbitary code execution vulnerabilities.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/android-insecure-dex-loading
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import InsecureDexLoading
+import DataFlow::PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureDexConfiguration conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Potential arbitary code execution due to $@.",
+  source.getNode(), "a value loaded from a world readable/writable source."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
new file mode 100644
index 000000000000..2a4b387be7e3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
@@ -0,0 +1,100 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+
+/**
+ * A taint-tracking configuration fordetecting unsafe use of a
+ * `DexClassLoader` by an Android app.
+ */
+class InsecureDexConfiguration extends TaintTracking::Configuration {
+  InsecureDexConfiguration() { this = "Insecure Dex File Load" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof InsecureDexSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof InsecureDexSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    flowStep(pred, succ)
+  }
+}
+
+/** A data flow source for insecure Dex class loading vulnerabilities. */
+abstract class InsecureDexSource extends DataFlow::Node { }
+
+/** A data flow sink for insecure Dex class loading vulnerabilities. */
+abstract class InsecureDexSink extends DataFlow::Node { }
+
+private predicate flowStep(DataFlow::Node pred, DataFlow::Node succ) {
+  // propagate from a `java.io.File` via the `File.getAbsolutePath` call.
+  exists(MethodAccess m |
+    m.getMethod().getDeclaringType() instanceof TypeFile and
+    m.getMethod().hasName("getAbsolutePath") and
+    m.getQualifier() = pred.asExpr() and
+    m = succ.asExpr()
+  )
+  or
+  // propagate from a `java.io.File` via the `File.toString` call.
+  exists(MethodAccess m |
+    m.getMethod().getDeclaringType() instanceof TypeFile and
+    m.getMethod().hasName("toString") and
+    m.getQualifier() = pred.asExpr() and
+    m = succ.asExpr()
+  )
+  or
+  // propagate to newly created `File` if the parent directory of the new `File` is tainted
+  exists(ConstructorCall cc |
+    cc.getConstructedType() instanceof TypeFile and
+    cc.getArgument(0) = pred.asExpr() and
+    cc = succ.asExpr()
+  )
+}
+
+/**
+ * An argument to a `DexClassLoader` call taken as a sink for
+ * insecure Dex class loading vulnerabilities.
+ */
+private class DexClassLoader extends InsecureDexSink {
+  DexClassLoader() {
+    exists(ConstructorCall cc |
+      cc.getConstructedType().hasQualifiedName("dalvik.system", "DexClassLoader")
+    |
+      this.asExpr() = cc.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An `File` instance which reads from an SD card
+ * taken as a source for insecure Dex class loading vulnerabilities.
+ */
+private class ExternalFile extends InsecureDexSource {
+  ExternalFile() {
+    exists(ConstructorCall cc, Argument a |
+      cc.getConstructedType() instanceof TypeFile and
+      a = cc.getArgument(0) and
+      a.(CompileTimeConstantExpr).getStringValue().matches("%sdcard%")
+    |
+      this.asExpr() = a
+    )
+  }
+}
+
+/**
+ * A directory or file which may be stored in an world writable directory
+ * taken as a source for insecure Dex class loading vulnerabilities.
+ */
+private class ExternalStorageDirSource extends InsecureDexSource {
+  ExternalStorageDirSource() {
+    exists(Method m |
+      m.getDeclaringType().hasQualifiedName("android.os", "Environment") and
+      m.hasName("getExternalStorageDirectory")
+      or
+      m.getDeclaringType().hasQualifiedName("android.content", "Context") and
+      m.hasName([
+          "getExternalFilesDir", "getExternalFilesDirs", "getExternalMediaDirs",
+          "getExternalCacheDir", "getExternalCacheDirs"
+        ])
+    |
+      this.asExpr() = m.getAReference()
+    )
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
new file mode 100644
index 000000000000..d8fdd828f4fb
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
@@ -0,0 +1,32 @@
+
+import android.app.Application;
+import android.content.Context;
+import android.content.pm.PackageInfo;
+import android.os.Bundle;
+
+import dalvik.system.DexClassLoader;
+import dalvik.system.DexFile;
+
+public class InsecureDexLoading extends Application {
+	@Override
+	public void onCreate() {
+		super.onCreate();
+		updateChecker();
+	}
+
+	private void updateChecker() {
+		try {
+			File file = new File("/sdcard/updater.apk");
+			if (file.exists() && file.isFile() && file.length() <= 1000) {
+				DexClassLoader cl = new DexClassLoader(file.getAbsolutePath(), getCacheDir().getAbsolutePath(), null,
+						getClassLoader());
+				int version = (int) cl.loadClass("my.package.class").getDeclaredMethod("myMethod").invoke(null);
+				if (Build.VERSION.SDK_INT < version) {
+					Toast.makeText(this, "Securely loaded Dex!", Toast.LENGTH_LONG).show();
+				}
+			}
+		} catch (Exception e) {
+			// ignore
+		}
+	}
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java
new file mode 100644
index 000000000000..e45e3938f7b8
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java
@@ -0,0 +1,23 @@
+public class SecureDexLoading extends Application {
+	@Override
+	public void onCreate() {
+		super.onCreate();
+		updateChecker();
+	}
+
+	private void updateChecker() {
+		try {
+			File file = new File(getCacheDir() + "/updater.apk");
+			if (file.exists() && file.isFile() && file.length() <= 1000) {
+				DexClassLoader cl = new DexClassLoader(file.getAbsolutePath(), getCacheDir().getAbsolutePath(), null,
+						getClassLoader());
+				int version = (int) cl.loadClass("my.package.class").getDeclaredMethod("myMethod").invoke(null);
+				if (Build.VERSION.SDK_INT < version) {
+					Toast.makeText(this, "Securely loaded Dex!", Toast.LENGTH_LONG).show();
+				}
+			}
+		} catch (Exception e) {
+			// ignore
+		}
+	}
+}
\ No newline at end of file

From 62a0775cf69c8bda45aeb9b0cdf60f28dafd9c72 Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Thu, 25 Mar 2021 23:09:11 +0100
Subject: [PATCH 065/433] Update
 python/ql/src/Security/CWE-327/examples/secure_protocol.py

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/Security/CWE-327/examples/secure_protocol.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/Security/CWE-327/examples/secure_protocol.py b/python/ql/src/Security/CWE-327/examples/secure_protocol.py
index 94b3557d0172..e349bdae832d 100644
--- a/python/ql/src/Security/CWE-327/examples/secure_protocol.py
+++ b/python/ql/src/Security/CWE-327/examples/secure_protocol.py
@@ -4,7 +4,7 @@
 hostname = 'www.python.org'
 context = ssl.SSLContext(ssl.PROTOCOL_TLS)
 context.options |= ssl.OP_NO_TLSv1
-context.options |= ssl.OP_NO_TLSv1_1 # This added by me
+context.options |= ssl.OP_NO_TLSv1_1
 
 with socket.create_connection((hostname, 443)) as sock:
     with context.wrap_socket(sock, server_hostname=hostname) as ssock:

From 2b257318f1c9e1d4a27f9022d94a08fc3e4cc3da Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 25 Mar 2021 23:22:24 +0100
Subject: [PATCH 066/433] Python: more precise comment

---
 python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
index 3ff1207b527f..ab80ed47dacd 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
@@ -28,7 +28,7 @@
 SSLContext(protocol=ssl.PROTOCOL_TLSv1_2)
 SSL.Context(SSL.TLSv1_2_METHOD)
 
-# possibly secure versions specified
+# insecure versions allowed by specified range
 SSLContext(protocol=ssl.PROTOCOL_SSLv23)
 SSLContext(protocol=ssl.PROTOCOL_TLS)
 SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)

From 54dad57cf4a22a9d01a434d0633606fa8adf7c8f Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Fri, 26 Mar 2021 00:25:40 +0100
Subject: [PATCH 067/433] Update
 python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
index e4205c498244..fa7714118828 100644
--- a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
@@ -23,6 +23,8 @@ def test_fluent_no_TLSv1():
 def test_fluent_safe():
     hostname = 'www.python.org'
     context = SSL.Context(SSL.SSLv23_METHOD)
+    context.set_options(SSL.OP_NO_SSLv2)
+    context.set_options(SSL.OP_NO_SSLv3)
     context.set_options(SSL.OP_NO_TLSv1)
     context.set_options(SSL.OP_NO_TLSv1_1)
 

From 554404575d243ffdff19559e8cbbf4c300019d32 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 00:29:40 +0100
Subject: [PATCH 068/433] Python: fix typo and name.

---
 python/ql/src/Security/CWE-327/ReadMe.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/Security/CWE-327/ReadMe.md b/python/ql/src/Security/CWE-327/ReadMe.md
index c5330a78fda9..680ae56f4934 100644
--- a/python/ql/src/Security/CWE-327/ReadMe.md
+++ b/python/ql/src/Security/CWE-327/ReadMe.md
@@ -12,7 +12,7 @@ This should be kept up to date; the world is moving fast and protocols are being
 
 - `ssl.wrap_socket` is creating insecure connections, use `SSLContext.wrap_socket` instead. [link](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)
     > Deprecated since version 3.7: Since Python 3.2 and 2.7.9, it is recommended to use the `SSLContext.wrap_socket()` instead of `wrap_socket()`. The top-level function is limited and creates an insecure client socket without server name indication or hostname matching.
-- Default consteructors are fine, a sluent api is used to constrain possible protocols later.
+- Default consteructors are fine, a fluent api is used to constrain possible protocols later.
 
 ## Current recomendation
 

From 9488b8bb18fa89614480024700f51c3500f96725 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 00:31:56 +0100
Subject: [PATCH 069/433] Python: actually rename

---
 python/ql/src/Security/CWE-327/{ReadMe.md => README.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename python/ql/src/Security/CWE-327/{ReadMe.md => README.md} (100%)

diff --git a/python/ql/src/Security/CWE-327/ReadMe.md b/python/ql/src/Security/CWE-327/README.md
similarity index 100%
rename from python/ql/src/Security/CWE-327/ReadMe.md
rename to python/ql/src/Security/CWE-327/README.md

From d33b04cd965de99180434c998f96a15f98c1f5fa Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 26 Mar 2021 02:33:40 +0000
Subject: [PATCH 070/433] Query to detect plaintext credentials in Java
 properties files

---
 .../CWE-555/CredentialsInPropertiesFile.qhelp | 45 ++++++++++
 .../CWE-555/CredentialsInPropertiesFile.ql    | 87 +++++++++++++++++++
 .../CWE/CWE-555/configuration.properties      | 26 ++++++
 .../CredentialsInPropertiesFile.expected      |  5 ++
 .../CWE-555/CredentialsInPropertiesFile.qlref |  1 +
 .../security/CWE-555/configuration.properties | 37 ++++++++
 .../security/CWE-555/messages.properties      |  8 ++
 7 files changed, 209 insertions(+)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/messages.properties

diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
new file mode 100644
index 000000000000..afbd40685bad
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
@@ -0,0 +1,45 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+      Credentials management issues occur when credentials are stored in plaintext in 
+      an application’s properties file. Common credentials include but are not limited 
+      to LDAP, mail, database, proxy account, and so on. Storing plaintext credentials 
+      in a properties file allows anyone who can read the file access to the protected 
+      resource. Good credentials management guidelines require that credentials never 
+      be stored in plaintext.
+    </p>
+  </overview>
+
+  <recommendation>
+    <p>
+      Credentials stored in properties files should be encrypted and recycled regularly. 
+      In a Java EE deployment scenario, utilities provided by application servers like 
+      keystore and password vault can be used to encrypt and manage credentials.
+    </p>
+  </recommendation>
+
+  <example>
+    <p>
+      In the first example, the credentials of a LDAP and datasource properties are stored 
+      in cleartext in the properties file.
+    </p>
+
+    <p>
+      In the second example, the credentials of a LDAP and datasource properties are stored
+      in the encrypted format.
+    </p>
+    <sample src="configuration.properties" />
+  </example>
+
+  <references>
+    <li>
+      OWASP:
+      <a href="https://owasp.org/www-community/vulnerabilities/Password_Plaintext_Storage">Password Plaintext Storage</a>
+    </li>
+    <li>
+      Medium (Rajeev Shukla):
+      <a href="https://medium.com/@mail2rajeevshukla/hiding-encrypting-database-password-in-the-application-properties-34d59fe104eb">Encrypting database password in the application.properties file</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
new file mode 100644
index 000000000000..2ab074e56d85
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
@@ -0,0 +1,87 @@
+/**
+ * @name Cleartext Credentials in Properties File
+ * @description Finds cleartext credentials in Java properties files.
+ * @kind problem
+ * @id java/credentials-in-properties
+ * @tags security
+ *       external/cwe/cwe-555
+ *       external/cwe/cwe-256
+ *       external/cwe/cwe-260
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+
+private string suspicious() {
+  result = "%password%" or
+  result = "%passwd%" or
+  result = "%account%" or
+  result = "%accnt%" or
+  result = "%credential%" or
+  result = "%token%" or
+  result = "%secret%" or
+  result = "%access%key%"
+}
+
+private string nonSuspicious() {
+  result = "%hashed%" or
+  result = "%encrypted%" or
+  result = "%crypt%"
+}
+
+/** Holds if the value is not cleartext credentials. */
+bindingset[value]
+predicate isNotCleartextCredentials(string value) {
+  value = "" // Empty string
+  or
+  value.length() < 7 // Typical credentials are no less than 6 characters
+  or
+  value.matches("% %") // Sentences containing spaces
+  or
+  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
+  or
+  value.matches("@%") // Starts with the "@" sign
+  or
+  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
+  or
+  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
+  or
+  value.matches("ENC(%)") // Encrypted value
+  or
+  value.toLowerCase().matches(suspicious()) // Could be message properties or fake passwords
+}
+
+/**
+ * Holds if the credentials are in a non-production properties file indicated by:
+ *    a) in a non-production directory
+ *    b) with a non-production file name
+ */
+predicate isNonProdCredentials(CredentialsConfig cc) {
+  cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"]) and
+  not cc.getFile().getAbsolutePath().matches("%codeql%") // CodeQL test cases
+}
+
+/** The properties file with configuration key/value pairs. */
+class ConfigProperties extends ConfigPair {
+  ConfigProperties() { this.getFile().getBaseName().toLowerCase().matches("%.properties") }
+}
+
+/** The credentials configuration property. */
+class CredentialsConfig extends ConfigProperties {
+  CredentialsConfig() {
+    this.getNameElement().getName().trim().toLowerCase().matches(suspicious()) and
+    not this.getNameElement().getName().trim().toLowerCase().matches(nonSuspicious())
+  }
+
+  string getName() { result = this.getNameElement().getName().trim() }
+
+  string getValue() { result = this.getValueElement().getValue().trim() }
+}
+
+from CredentialsConfig cc
+where
+  not isNotCleartextCredentials(cc.getValue()) and
+  not isNonProdCredentials(cc)
+select cc,
+  "Plaintext credentials " + cc.getName() + " have cleartext value " + cc.getValue() +
+    " in properties file."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties b/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties
new file mode 100644
index 000000000000..55e8b0d86da2
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties
@@ -0,0 +1,26 @@
+#***************************** LDAP Credentials *****************************************#
+ 
+ldap.ldapHost = ldap.example.com
+ldap.ldapPort = 636
+ldap.loginDN = cn=Directory Manager
+
+#### BAD: LDAP credentials are stored in cleartext #### 
+ldap.password = mysecpass
+
+#### GOOD: LDAP credentials are stored in the encrypted format #### 
+ldap.password = eFRZ3Cqo5zDJWMYLiaEupw==
+
+ldap.domain1 = example
+ldap.domain2 = com
+ldap.url= ldaps://ldap.example.com:636/dc=example,dc=com
+
+#*************************** MS SQL Database Connection **********************************# 
+datasource1.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver
+datasource1.url = jdbc:sqlserver://ms.example.com\\exampledb:1433;
+datasource1.username = sa
+
+#### BAD: Datasource credentials are stored in cleartext #### 
+datasource1.password = Passw0rd@123
+
+#### GOOD: Datasource credentials are stored in the encrypted format #### 
+datasource1.password = VvOgflYS1EUzJdVNDoBcnA==
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
new file mode 100644
index 000000000000..0ce339139324
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
@@ -0,0 +1,5 @@
+| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password have cleartext value mysecpass in properties file. |
+| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password have cleartext value Passw0rd@123 in properties file. |
+| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password have cleartext value MysecPWxWa@1993 in properties file. |
+| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key have cleartext value AKMAMQPBYMCD6YSAYCBA in properties file. |
+| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key have cleartext value 8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k in properties file. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref
new file mode 100644
index 000000000000..e2536bfe8835
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties b/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties
new file mode 100644
index 000000000000..a044161f0971
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties
@@ -0,0 +1,37 @@
+#***************************** LDAP Credentials *****************************************#
+ldap.ldapHost = ldap.example.com
+ldap.ldapPort = 636
+ldap.loginDN = cn=Directory Manager
+#### BAD: LDAP credentials are stored in cleartext #### 
+ldap.password = mysecpass
+#### GOOD: LDAP credentials are stored in the encrypted format #### 
+ldap.password = eFRZ3Cqo5zDJWMYLiaEupw==
+ldap.domain1 = example
+ldap.domain2 = com
+ldap.url= ldaps://ldap.example.com:636/dc=example,dc=com
+
+#*************************** MS SQL Database Connection **********************************# 
+datasource1.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver
+datasource1.url = jdbc:sqlserver://ms.example.com\\exampledb:1433;
+datasource1.username = sa
+#### BAD: Datasource credentials are stored in cleartext #### 
+datasource1.password = Passw0rd@123
+#### GOOD: Datasource credentials are stored in the encrypted format #### 
+datasource1.password = VvOgflYS1EUzJdVNDoBcnA==
+
+#*************************** Mail Connection **********************************# 
+mail.username = test@example.com
+#### BAD: Mail credentials are stored in cleartext #### 
+mail.password = MysecPWxWa@1993
+#### GOOD: Mail credentials are stored in the encrypted format #### 
+mail.password = M*********@1993
+
+#*************************** AWS S3 Connection **********************************# 
+com.example.aws.s3.bucket_name=com-bucket-1
+com.example.aws.s3.directory_name=com-directory-1
+#### BAD: Access keys are stored in properties file in cleartext #### 
+com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA
+com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k
+#### GOOD: Access keys are not stored in properties file #### 
+com.example.aws.s3.access_key=${ENV:AWS_ACCESS_KEY_ID}
+com.example.aws.s3.secret_key=${ENV:AWS_SECRET_ACCESS_KEY}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
new file mode 100644
index 000000000000..fac63ec23e85
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
@@ -0,0 +1,8 @@
+prompt.username=Username
+prompt.password=Password
+
+forgot_password.error=Please enter a valid email address.
+reset_password.error=Passwords must match and not be empty.
+
+login.password_expired=Your current password has expired. Please reset your password.
+login.login_failure=Unable to verify username or password. Please try again.

From 936757b4bf385addba174a37c24f029781110553 Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Fri, 26 Mar 2021 08:05:51 +0100
Subject: [PATCH 071/433] Update
 python/ql/src/Security/CWE-327/FluentApiModel.qll

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/Security/CWE-327/FluentApiModel.qll | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index d222af704997..4d63a14bdbc9 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -39,13 +39,7 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
     )
   }
 
-  override predicate isBarrierIn(DataFlow::Node node) {
-    exists(ProtocolUnrestriction r |
-      r = library.protocol_unrestriction() and
-      node = r.getContext() and
-      r.getUnrestriction() = tracked_version
-    )
-  }
+  override predicate isBarrierIn(DataFlow::Node node) { this.isSource(node) }
 }
 
 /**

From f1619f1ee8f6c5df2aa4d4b862deb46626bed2db Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 08:18:11 +0100
Subject: [PATCH 072/433] Python: "source" -> "contextOrigin"

---
 .../ql/src/Security/CWE-327/InsecureProtocol.ql | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 194cc1f5ec1d..b945f2e609b7 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -18,11 +18,11 @@ string callName(AstNode call) {
   exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())
 }
 
-string sourceName(DataFlow::Node source) {
-  result = "call to " + callName(source.asCfgNode().(CallNode).getFunction().getNode())
+string originName(DataFlow::Node contextOrigin) {
+  result = "call to " + callName(contextOrigin.asCfgNode().(CallNode).getFunction().getNode())
   or
-  not source.asCfgNode() instanceof CallNode and
-  not source instanceof ContextCreation and
+  not contextOrigin.asCfgNode() instanceof CallNode and
+  not contextOrigin instanceof ContextCreation and
   result = "context modification"
 }
 
@@ -32,11 +32,12 @@ string verb(boolean specific) {
   specific = false and result = "allowed"
 }
 
-from DataFlow::Node creation, string insecure_version, DataFlow::Node source, boolean specific
+from
+  DataFlow::Node creation, string insecure_version, DataFlow::Node contextOrigin, boolean specific
 where
-  unsafe_connection_creation(creation, insecure_version, source, specific)
+  unsafe_connection_creation(creation, insecure_version, contextOrigin, specific)
   or
-  unsafe_context_creation(creation, insecure_version, source.asCfgNode()) and specific = true
+  unsafe_context_creation(creation, insecure_version, contextOrigin.asCfgNode()) and specific = true
 select creation,
   "Insecure SSL/TLS protocol version " + insecure_version + " " + verb(specific) + " by $@ ",
-  source, sourceName(source)
+  contextOrigin, originName(contextOrigin)

From e936540863385a7ff8437f890bc7bba24b00c547 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 08:22:09 +0100
Subject: [PATCH 073/433] Python: remove internal import

---
 python/ql/src/Security/CWE-327/Ssl.qll | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index be16138b9612..88aaebf67baf 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -1,6 +1,5 @@
 import python
 import semmle.python.ApiGraphs
-import semmle.python.dataflow.new.internal.Attributes as Attributes
 import TlsLibraryModel
 
 class SSLContextCreation extends ContextCreation {
@@ -104,7 +103,7 @@ class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction {
   ProtocolVersion restriction;
 
   ContextSetVersion() {
-    exists(Attributes::AttrWrite aw |
+    exists(DataFlow::AttrWrite aw |
       aw.getObject().asCfgNode() = node and
       aw.getAttributeName() = "minimum_version" and
       aw.getValue() =

From b21672c81cbc9a82f56e54093652b6a741dbe3e6 Mon Sep 17 00:00:00 2001
From: Alexander Eyers-Taylor <alexet@semmle.com>
Date: Fri, 26 Mar 2021 11:14:09 +0000
Subject: [PATCH 074/433] Apply suggestions from code review

Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
---
 .../ql-language-reference/ql-language-specification.rst     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/codeql/ql-language-reference/ql-language-specification.rst b/docs/codeql/ql-language-reference/ql-language-specification.rst
index ad88b791019e..fb89100b4018 100644
--- a/docs/codeql/ql-language-reference/ql-language-specification.rst
+++ b/docs/codeql/ql-language-reference/ql-language-specification.rst
@@ -1168,9 +1168,9 @@ A valid call with results *resolves* to a set of predicates. The ways a call can
 -  If the call has no receiver and the predicate name is a selection identifier, then the qualifier is resolved as a module (see "`Module resolution <#module-resolution>`__"). The identifier is then resolved in the exported predicate environment of the qualifier module.
 
 -  If the call has a super expression as the receiver, then it resolves to a member predicate in a class that the enclosing class inherits from:
-    -  If the super expression is unqualified and there is a single class that the current class inherits from then the super-class is that class. 
-    -  If the super expression is unqualified and there is are multiple classes that the current class inherits from then the super-class is the domain type.
-    -  Otherwise the super-class is the class named by the qualifier of the super expression. 
+    -  If the super expression is unqualified and there is a single class that the current class inherits from, then the super-class is that class. 
+    -  If the super expression is unqualified and there are multiple classes that the current class inherits from, then the super-class is the domain type.
+    -  Otherwise, the super-class is the class named by the qualifier of the super expression. 
 
    The predicate is resolved by looking up its name and arity in the exported predicate environment of the super-class. 
 

From 1be2be843dd4a0afca316598e227d4a89aea5433 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 13:08:23 +0100
Subject: [PATCH 075/433] Python: update test expectations

---
 .../test/query-tests/Security/CWE-327/InsecureProtocol.expected | 2 --
 1 file changed, 2 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index e578a335d846..f4cd96eb82e2 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -17,8 +17,6 @@
 | pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
 | pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
 | pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
-| pyOpenSSL_fluent.py:29:27:29:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@  | pyOpenSSL_fluent.py:25:15:25:44 | ControlFlowNode for Attribute() | call to SSL.Context |
-| pyOpenSSL_fluent.py:29:27:29:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | pyOpenSSL_fluent.py:25:15:25:44 | ControlFlowNode for Attribute() | call to SSL.Context |
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |

From 2e948da3b4a5de3e0bc56d4ad0d19f4f787d5473 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 13:08:45 +0100
Subject: [PATCH 076/433] Python: suggested refactor

---
 python/ql/src/Security/CWE-327/FluentApiModel.qll  | 5 ++---
 python/ql/src/Security/CWE-327/InsecureProtocol.ql | 4 +++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 4d63a14bdbc9..543c32799bc9 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -67,9 +67,8 @@ predicate unsafe_connection_creation(
 }
 
 /** A connection is created insecurely without reference to a context. */
-predicate unsafe_context_creation(DataFlow::Node node, string insecure_version, CallNode call) {
+predicate unsafe_context_creation(DataFlow::CallCfgNode call, string insecure_version) {
   exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
-    cc = node and
-    cc.getNode() = call
+    cc = call
   )
 }
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index b945f2e609b7..a716b8948807 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -37,7 +37,9 @@ from
 where
   unsafe_connection_creation(creation, insecure_version, contextOrigin, specific)
   or
-  unsafe_context_creation(creation, insecure_version, contextOrigin.asCfgNode()) and specific = true
+  unsafe_context_creation(creation, insecure_version) and
+  contextOrigin = creation and
+  specific = true
 select creation,
   "Insecure SSL/TLS protocol version " + insecure_version + " " + verb(specific) + " by $@ ",
   contextOrigin, originName(contextOrigin)

From 7d7cbc49db35d0b05f12594984ac36ef529699a1 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 14:20:38 +0100
Subject: [PATCH 077/433] Fix comments. This induced fixing the code, since
 things were wired up wrongly. Currently the only implementation of
 `insecure_connection_creation` is `ssl.wrap_socket`, which is also the sole
 target of  py/insecure-default-protocol`, so perhaps this part should be
 turned off?

---
 .../src/Security/CWE-327/FluentApiModel.qll   | 39 +++++++++++++------
 .../src/Security/CWE-327/InsecureProtocol.ql  | 18 ++++++---
 2 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 543c32799bc9..169996081dce 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -43,16 +43,21 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
 }
 
 /**
- * A connection is created from a context allowing an insecure protocol,
- * and that protocol has not been restricted appropriately.
+ * Holds if `conectionCreation` marks the creation of a connetion based on the contex
+ * found at `contextOrigin` and allowing `insecure_version`.
+ * `specific` is true iff the context if configured for a specific protocol version rather
+ * than for a family of protocols.
  */
-predicate unsafe_connection_creation(
-  DataFlow::Node creation, ProtocolVersion insecure_version, DataFlow::Node source, boolean specific
+predicate unsafe_connection_creation_with_context(
+  DataFlow::Node connectionCreation, ProtocolVersion insecure_version, DataFlow::Node contextOrigin,
+  boolean specific
 ) {
   // Connection created from a context allowing `insecure_version`.
-  exists(InsecureContextConfiguration c, ProtocolUnrestriction cc | c.hasFlow(cc, creation) |
+  exists(InsecureContextConfiguration c, ProtocolUnrestriction co |
+    c.hasFlow(co, connectionCreation)
+  |
     insecure_version = c.getTrackedVersion() and
-    source = cc and
+    contextOrigin = co and
     specific = false
   )
   or
@@ -60,15 +65,27 @@ predicate unsafe_connection_creation(
   exists(TlsLibrary l, DataFlow::CfgNode cc |
     cc = l.insecure_connection_creation(insecure_version)
   |
-    creation = cc and
-    source = cc and
+    connectionCreation = cc and
+    contextOrigin = cc and
     specific = true
   )
 }
 
-/** A connection is created insecurely without reference to a context. */
-predicate unsafe_context_creation(DataFlow::CallCfgNode call, string insecure_version) {
+/**
+ * Holds if `conectionCreation` marks the creation of a connetion witout reference to a context
+ * and allowing `insecure_version`.
+ * `specific` is true iff the context if configured for a specific protocol version rather
+ * than for a family of protocols.
+ */
+predicate unsafe_connection_creation_without_context(
+  DataFlow::CallCfgNode connectionCreation, string insecure_version
+) {
+  exists(TlsLibrary l | connectionCreation = l.insecure_connection_creation(insecure_version))
+}
+
+/** Holds if `contextCreation` is creating a context ties to a specific insecure version. */
+predicate unsafe_context_creation(DataFlow::CallCfgNode contextCreation, string insecure_version) {
   exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
-    cc = call
+    contextCreation = cc
   )
 }
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index a716b8948807..974c36ddb0cb 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -33,13 +33,19 @@ string verb(boolean specific) {
 }
 
 from
-  DataFlow::Node creation, string insecure_version, DataFlow::Node contextOrigin, boolean specific
+  DataFlow::Node connectionCreation, string insecure_version, DataFlow::Node protocolConfiguration,
+  boolean specific
 where
-  unsafe_connection_creation(creation, insecure_version, contextOrigin, specific)
+  unsafe_connection_creation_with_context(connectionCreation, insecure_version,
+    protocolConfiguration, specific)
   or
-  unsafe_context_creation(creation, insecure_version) and
-  contextOrigin = creation and
+  unsafe_connection_creation_without_context(connectionCreation, insecure_version) and
+  protocolConfiguration = connectionCreation and
   specific = true
-select creation,
+  or
+  unsafe_context_creation(protocolConfiguration, insecure_version) and
+  connectionCreation = protocolConfiguration and
+  specific = true
+select connectionCreation,
   "Insecure SSL/TLS protocol version " + insecure_version + " " + verb(specific) + " by $@ ",
-  contextOrigin, originName(contextOrigin)
+  protocolConfiguration, originName(protocolConfiguration)

From 8155334fa7b4b72015e1b75bf2563b0b96c699bb Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 15:57:07 +0100
Subject: [PATCH 078/433] Python: More elaborate qldoc also refactor code to
 match

---
 .../src/Security/CWE-327/FluentApiModel.qll   | 48 +++++++++++++------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 169996081dce..d4eb13a133d3 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -2,9 +2,21 @@ import python
 import TlsLibraryModel
 
 /**
- * Configuration to track flow from the creation of a context to
- * that context being used to create a connection.
- * Flow is broken if the insecure protocol of interest is being restricted.
+ * Configuration to determine the state of a context being used to create
+ * a conection.
+ *
+ * The state is in terms of whether a specific protocol is allowed. This is
+ * either true or false when the context is created and can then be modified
+ * later by either restricting or unrestricting the protocol (see the predicates
+ * `isRestriction` and `isUnrestriction`).
+ *
+ * Since we are interested in the final state, we want the flow to start from
+ * the last unrestriction, so we disallow flow into unrestrictions. We also
+ * model the creation as an unrestriction of everything it allows, to account
+ * for the common case where the creation plays the role of "last unrestriction".
+ *
+ * Since we really want "the last unrestriction, not nullified by a restriction",
+ * we also disallow flow into restrictions.
  */
 class InsecureContextConfiguration extends DataFlow::Configuration {
   TlsLibrary library;
@@ -17,29 +29,35 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
 
   ProtocolVersion getTrackedVersion() { result = tracked_version }
 
-  override predicate isSource(DataFlow::Node source) {
-    // source = library.unspecific_context_creation()
-    exists(ProtocolUnrestriction pu |
-      pu = library.protocol_unrestriction() and
-      pu.getUnrestriction() = tracked_version
-    |
-      source = pu.getContext()
-    )
-  }
+  override predicate isSource(DataFlow::Node source) { this.isUnrestriction(source) }
 
   override predicate isSink(DataFlow::Node sink) {
     sink = library.connection_creation().getContext()
   }
 
-  override predicate isBarrierOut(DataFlow::Node node) {
+  override predicate isBarrierIn(DataFlow::Node node) {
+    this.isRestriction(node)
+    or
+    this.isUnrestriction(node)
+  }
+
+  private predicate isRestriction(DataFlow::Node node) {
     exists(ProtocolRestriction r |
       r = library.protocol_restriction() and
-      node = r.getContext() and
       r.getRestriction() = tracked_version
+    |
+      node = r.getContext()
     )
   }
 
-  override predicate isBarrierIn(DataFlow::Node node) { this.isSource(node) }
+  private predicate isUnrestriction(DataFlow::Node node) {
+    exists(ProtocolUnrestriction pu |
+      pu = library.protocol_unrestriction() and
+      pu.getUnrestriction() = tracked_version
+    |
+      node = pu.getContext()
+    )
+  }
 }
 
 /**

From 98dfe1a00a14e6dfc8c27d84cfeb2ee363515f56 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 17:27:43 +0100
Subject: [PATCH 079/433] Python: Elaborate qldoc and renames to match

---
 python/ql/src/Security/CWE-327/Ssl.qll | 34 ++++++++++++++++++--------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 88aaebf67baf..110b4bf185a1 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -45,7 +45,7 @@ class OptionsAugOr extends ProtocolRestriction {
       (
         aa.getValue() = flag
         or
-        impliesValue(aa.getValue(), flag, false, false)
+        impliesBitSet(aa.getValue(), flag, false, false)
       )
     )
   }
@@ -70,7 +70,7 @@ class OptionsAugAndNot extends ProtocolUnrestriction {
       (
         aa.getValue() = notFlag
         or
-        impliesValue(aa.getValue(), notFlag, true, true)
+        impliesBitSet(aa.getValue(), notFlag, true, true)
       )
     )
   }
@@ -80,22 +80,36 @@ class OptionsAugAndNot extends ProtocolUnrestriction {
   override ProtocolVersion getUnrestriction() { result = restriction }
 }
 
-/** Whether `part` evaluates to `partIsTrue` if `whole` evaluates to `wholeIsTrue`. */
-predicate impliesValue(BinaryExpr whole, Expr part, boolean partIsTrue, boolean wholeIsTrue) {
+/**
+ * Holds if
+ *   for every bit, _b_:
+ *     `wholeHasBitSet` represents that _b_ is set in `whole`
+ *     implies
+ *     `partHasBitSet` represents that _b_ is set in `part`
+ *
+ * As an example take `whole` = `part1 & part2`. Then
+ * `impliesBitSet(whole, part1, true, true)` holds
+ * because for any bit in `whole`, if that bit is set it must also be set in `part1`.
+ *
+ * Similarly for `whole` = `part1 | part2`. Here
+ * `impliesBitSet(whole, part1, false, false)` holds
+ * because for any bit in `whole`, if that bit is not set, it cannot be set in `part1`.
+ */
+predicate impliesBitSet(BinaryExpr whole, Expr part, boolean partHasBitSet, boolean wholeHasBitSet) {
   whole.getOp() instanceof BitAnd and
   (
-    wholeIsTrue = true and partIsTrue = true and part in [whole.getLeft(), whole.getRight()]
+    wholeHasBitSet = true and partHasBitSet = true and part in [whole.getLeft(), whole.getRight()]
     or
-    wholeIsTrue = true and
-    impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
+    wholeHasBitSet = true and
+    impliesBitSet([whole.getLeft(), whole.getRight()], part, partHasBitSet, wholeHasBitSet)
   )
   or
   whole.getOp() instanceof BitOr and
   (
-    wholeIsTrue = false and partIsTrue = false and part in [whole.getLeft(), whole.getRight()]
+    wholeHasBitSet = false and partHasBitSet = false and part in [whole.getLeft(), whole.getRight()]
     or
-    wholeIsTrue = false and
-    impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
+    wholeHasBitSet = false and
+    impliesBitSet([whole.getLeft(), whole.getRight()], part, partHasBitSet, wholeHasBitSet)
   )
 }
 

From 470b4d86582595101439a043ab4cd4db935b11a2 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 17:35:36 +0100
Subject: [PATCH 080/433] Python: Add missing qldoc

---
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 3ab880e8bd9e..f66d663a7e2a 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -58,6 +58,10 @@ abstract class ProtocolUnrestriction extends DataFlow::CfgNode {
   abstract ProtocolVersion getUnrestriction();
 }
 
+/**
+ * A context is being created with a range of allowed protocols.
+ * This also serves as unrestricting these protocols.
+ */
 abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrestriction {
   TlsLibrary library;
   ProtocolFamily family;
@@ -77,6 +81,7 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
   }
 }
 
+/** A model of a TLS library. */
 abstract class TlsLibrary extends string {
   TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
 

From 44d62df3f72719d8ba57a2519877db2a179f4ec4 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 17:51:18 +0100
Subject: [PATCH 081/433] Python: Fix model of `TLS` and add reference

---
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index f66d663a7e2a..245a60b02955 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -71,11 +71,14 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
   override DataFlow::CfgNode getContext() { result = this }
 
   override ProtocolVersion getUnrestriction() {
+    // see https://www.openssl.org/docs/man1.1.0/man3/TLS_method.html
     family = "TLS" and
-    result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
+    result in ["SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
     or
     // This can negotiate a TLS 1.3 connection (!)
-    // see https://docs.python.org/3/library/ssl.html#ssl-contexts
+    // see
+    // - https://docs.python.org/3/library/ssl.html#ssl-contexts
+    // - https://www.openssl.org/docs/man1.0.2/man3/TLSv1_method.html
     family = "SSLv23" and
     result in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }

From a72b1340eb6bb3bdbea9cabd6bdd942a9365b848 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 26 Mar 2021 16:51:43 +0000
Subject: [PATCH 082/433] Add a comment on how to run the query

---
 .../Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql  | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
index 3acd22e767a3..772ac6cd2091 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -8,6 +8,14 @@
  *       external/cwe-016
  */
 
+/*
+ * Note this query requires properties files to be indexed before it can produce results.
+ * If creating your own database with the CodeQL CLI, you should run
+ * `codeql database index-files --language=properties ...`
+ * If using lgtm.com, you should add `properties_files: true` to the index block of your
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ */
+
 import java
 import semmle.code.configfiles.ConfigFiles
 import semmle.code.xml.MavenPom

From e0352fe7638223a1d998bdd26752e358d2ec8e92 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 23:26:24 +0100
Subject: [PATCH 083/433] Python: remove deprecated section of qhelp file

---
 python/ql/src/Security/CWE-327/InsecureProtocol.qhelp | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
index cfcebd0930d3..9ecc7da0d60b 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.qhelp
@@ -32,12 +32,6 @@
             All cases should be updated to use a secure protocol, such as
             <code>PROTOCOL_TLSv1_2</code>.
           </p>
-          <p>
-            Note that <code>ssl.wrap_socket</code> has been deprecated in
-            Python 3.7. A preferred alternative is to use
-            <code>ssl.SSLContext</code>, which is supported in Python 2.7.9 and
-            3.2 and later versions.
-          </p>
           <p>
             Note that <code>ssl.wrap_socket</code> has been deprecated in
             Python 3.7. The recommended alternatives are:

From bf81122fc6b26584e85d4f0b7b4f854a2296471b Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 26 Mar 2021 23:37:19 +0100
Subject: [PATCH 084/433] Python: fix typo and add linebreaks

---
 python/ql/src/Security/CWE-327/FluentApiModel.qll | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index d4eb13a133d3..803b7adab40e 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -63,7 +63,8 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
 /**
  * Holds if `conectionCreation` marks the creation of a connetion based on the contex
  * found at `contextOrigin` and allowing `insecure_version`.
- * `specific` is true iff the context if configured for a specific protocol version rather
+ *
+ * `specific` is true iff the context is configured for a specific protocol version rather
  * than for a family of protocols.
  */
 predicate unsafe_connection_creation_with_context(
@@ -92,7 +93,8 @@ predicate unsafe_connection_creation_with_context(
 /**
  * Holds if `conectionCreation` marks the creation of a connetion witout reference to a context
  * and allowing `insecure_version`.
- * `specific` is true iff the context if configured for a specific protocol version rather
+ *
+ * `specific` is true iff the context is configured for a specific protocol version rather
  * than for a family of protocols.
  */
 predicate unsafe_connection_creation_without_context(

From bd863884479d4373e17717208441bbe6423d831b Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sat, 27 Mar 2021 01:07:15 +0100
Subject: [PATCH 085/433] Python: Add typetracker to constrain attribute.

---
 python/ql/src/Security/CWE-327/Ssl.qll | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 110b4bf185a1..7f1415233903 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -22,10 +22,28 @@ class SSLDefaultContextCreation extends ContextCreation {
   override DataFlow::CfgNode getProtocol() { none() }
 }
 
+/** Gets a reference to an `ssl.Context` instance. */
+private DataFlow::LocalSourceNode sslContextInstance(DataFlow::TypeTracker t) {
+  t.start() and
+  result = API::moduleImport("ssl").getMember(["SSLContext", "create_default_context"]).getACall()
+  or
+  exists(DataFlow::TypeTracker t2 | result = sslContextInstance(t2).track(t2, t))
+}
+
+/** Gets a reference to an `ssl.Context` instance. */
+DataFlow::Node sslContextInstance() {
+  sslContextInstance(DataFlow::TypeTracker::end()).flowsTo(result)
+}
+
 class WrapSocketCall extends ConnectionCreation {
   override CallNode node;
 
-  WrapSocketCall() { node.getFunction().(AttrNode).getName() = "wrap_socket" }
+  WrapSocketCall() {
+    exists(DataFlow::AttrRead call | node.getFunction() = call.asCfgNode() |
+      call.getAttributeName() = "wrap_socket" and
+      call.getObject() = sslContextInstance()
+    )
+  }
 
   override DataFlow::CfgNode getContext() {
     result.getNode() = node.getFunction().(AttrNode).getObject()

From a53cbc1631c2cfc994f74d4c5ce9e39f6c38abbc Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Sat, 27 Mar 2021 00:11:01 +0000
Subject: [PATCH 086/433] Update qldoc and make the query more readable

---
 .../CWE-555/CredentialsInPropertiesFile.qhelp |  4 +-
 .../CWE-555/CredentialsInPropertiesFile.ql    | 22 +++--
 .../CWE-555/CredentialsInPropertiesFile.ql    | 84 +++++++++++++++++++
 .../CWE-555/CredentialsInPropertiesFile.qlref |  1 -
 4 files changed, 101 insertions(+), 10 deletions(-)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref

diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
index afbd40685bad..0869b8862601 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
@@ -15,7 +15,7 @@
     <p>
       Credentials stored in properties files should be encrypted and recycled regularly. 
       In a Java EE deployment scenario, utilities provided by application servers like 
-      keystore and password vault can be used to encrypt and manage credentials.
+      keystores and password vaults can be used to encrypt and manage credentials.
     </p>
   </recommendation>
 
@@ -27,7 +27,7 @@
 
     <p>
       In the second example, the credentials of a LDAP and datasource properties are stored
-      in the encrypted format.
+      in an encrypted format.
     </p>
     <sample src="configuration.properties" />
   </example>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
index 2ab074e56d85..1e9b99060968 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
@@ -9,10 +9,18 @@
  *       external/cwe/cwe-260
  */
 
+/*
+ * Note this query requires properties files to be indexed before it can produce results.
+ * If creating your own database with the CodeQL CLI, you should run
+ * `codeql database index-files --language=properties ...`
+ * If using lgtm.com, you should add `properties_files: true` to the index block of your
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ */
+
 import java
 import semmle.code.configfiles.ConfigFiles
 
-private string suspicious() {
+private string possibleSecretName() {
   result = "%password%" or
   result = "%passwd%" or
   result = "%account%" or
@@ -23,7 +31,7 @@ private string suspicious() {
   result = "%access%key%"
 }
 
-private string nonSuspicious() {
+private string possibleEncryptedSecretName() {
   result = "%hashed%" or
   result = "%encrypted%" or
   result = "%crypt%"
@@ -48,7 +56,8 @@ predicate isNotCleartextCredentials(string value) {
   or
   value.matches("ENC(%)") // Encrypted value
   or
-  value.toLowerCase().matches(suspicious()) // Could be message properties or fake passwords
+  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
+  value.toLowerCase().matches(possibleSecretName())
 }
 
 /**
@@ -57,8 +66,7 @@ predicate isNotCleartextCredentials(string value) {
  *    b) with a non-production file name
  */
 predicate isNonProdCredentials(CredentialsConfig cc) {
-  cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"]) and
-  not cc.getFile().getAbsolutePath().matches("%codeql%") // CodeQL test cases
+  cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"])
 }
 
 /** The properties file with configuration key/value pairs. */
@@ -69,8 +77,8 @@ class ConfigProperties extends ConfigPair {
 /** The credentials configuration property. */
 class CredentialsConfig extends ConfigProperties {
   CredentialsConfig() {
-    this.getNameElement().getName().trim().toLowerCase().matches(suspicious()) and
-    not this.getNameElement().getName().trim().toLowerCase().matches(nonSuspicious())
+    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName())
   }
 
   string getName() { result = this.getNameElement().getName().trim() }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
new file mode 100644
index 000000000000..bb7495dc4d9a
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
@@ -0,0 +1,84 @@
+/**
+ * @name Cleartext Credentials in Properties File
+ * @description Finds cleartext credentials in Java properties files.
+ * @kind problem
+ * @id java/credentials-in-properties
+ * @tags security
+ *       external/cwe/cwe-555
+ *       external/cwe/cwe-256
+ *       external/cwe/cwe-260
+ */
+
+/*
+ * Note this query requires properties files to be indexed before it can produce results.
+ * If creating your own database with the CodeQL CLI, you should run
+ * `codeql database index-files --language=properties ...`
+ * If using lgtm.com, you should add `properties_files: true` to the index block of your
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+
+private string possibleSecretName() {
+  result = "%password%" or
+  result = "%passwd%" or
+  result = "%account%" or
+  result = "%accnt%" or
+  result = "%credential%" or
+  result = "%token%" or
+  result = "%secret%" or
+  result = "%access%key%"
+}
+
+private string possibleEncryptedSecretName() {
+  result = "%hashed%" or
+  result = "%encrypted%" or
+  result = "%crypt%"
+}
+
+/** Holds if the value is not cleartext credentials. */
+bindingset[value]
+predicate isNotCleartextCredentials(string value) {
+  value = "" // Empty string
+  or
+  value.length() < 7 // Typical credentials are no less than 6 characters
+  or
+  value.matches("% %") // Sentences containing spaces
+  or
+  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
+  or
+  value.matches("@%") // Starts with the "@" sign
+  or
+  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
+  or
+  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
+  or
+  value.matches("ENC(%)") // Encrypted value
+  or
+  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
+  value.toLowerCase().matches(possibleSecretName())
+}
+
+/** The properties file with configuration key/value pairs. */
+class ConfigProperties extends ConfigPair {
+  ConfigProperties() { this.getFile().getBaseName().toLowerCase().matches("%.properties") }
+}
+
+/** The credentials configuration property. */
+class CredentialsConfig extends ConfigProperties {
+  CredentialsConfig() {
+    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName())
+  }
+
+  string getName() { result = this.getNameElement().getName().trim() }
+
+  string getValue() { result = this.getValueElement().getValue().trim() }
+}
+
+from CredentialsConfig cc
+where not isNotCleartextCredentials(cc.getValue())
+select cc,
+  "Plaintext credentials " + cc.getName() + " have cleartext value " + cc.getValue() +
+    " in properties file."
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref
deleted file mode 100644
index e2536bfe8835..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
\ No newline at end of file

From 7a511c5682ca1aec9368a8e1f0c2106fd0912408 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sat, 27 Mar 2021 02:20:59 +0100
Subject: [PATCH 087/433] Python: update naming

---
 python/ql/src/Security/CWE-327/InsecureProtocol.ql | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 974c36ddb0cb..37aab84795e8 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -18,11 +18,12 @@ string callName(AstNode call) {
   exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())
 }
 
-string originName(DataFlow::Node contextOrigin) {
-  result = "call to " + callName(contextOrigin.asCfgNode().(CallNode).getFunction().getNode())
+string configName(DataFlow::Node protocolConfiguration) {
+  result =
+    "call to " + callName(protocolConfiguration.asCfgNode().(CallNode).getFunction().getNode())
   or
-  not contextOrigin.asCfgNode() instanceof CallNode and
-  not contextOrigin instanceof ContextCreation and
+  not protocolConfiguration.asCfgNode() instanceof CallNode and
+  not protocolConfiguration instanceof ContextCreation and
   result = "context modification"
 }
 
@@ -48,4 +49,4 @@ where
   specific = true
 select connectionCreation,
   "Insecure SSL/TLS protocol version " + insecure_version + " " + verb(specific) + " by $@ ",
-  protocolConfiguration, originName(protocolConfiguration)
+  protocolConfiguration, configName(protocolConfiguration)

From 16902c2f56993f4ca29f3f05ca1ce1ac35b656be Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sat, 27 Mar 2021 02:40:13 +0100
Subject: [PATCH 088/433] Python: handle default argument

---
 python/ql/src/Security/CWE-327/Ssl.qll | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 7f1415233903..928a5f74e2d3 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -160,6 +160,10 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
     // These are turned off by default
     // see https://docs.python.org/3/library/ssl.html#ssl-contexts
     not result in ["SSLv2", "SSLv3"]
+    or
+    // The default argument is TLS and the SSL versions are turned off by default.
+    not exists(this.getProtocol()) and
+    result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }
 }
 

From 6d72b4fd39b51315cf0720c35455bb3b66447cae Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sat, 27 Mar 2021 03:10:43 +0100
Subject: [PATCH 089/433] Python: Limit pretty printing to relevant nodes

---
 .../src/Security/CWE-327/InsecureProtocol.ql  | 37 ++++++++++++++++++-
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 37aab84795e8..19f6acf5512c 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -12,13 +12,46 @@
 import python
 import FluentApiModel
 
-string callName(AstNode call) {
+// Helper for pretty printer `configName`.
+// This is a consequence of missing pretty priting.
+// We do not want to evaluate our bespoke pretty printer
+// for all `DataFlow::Node`s so we define a sub class of interesting ones.
+class ProtocolConfiguration extends DataFlow::Node {
+  ProtocolConfiguration() {
+    unsafe_connection_creation_with_context(_, _, this, _)
+    or
+    unsafe_connection_creation_without_context(this, _)
+    or
+    unsafe_context_creation(this, _)
+  }
+}
+
+// Helper for pretty printer `callName`.
+// This is a consequence of missing pretty priting.
+// We do not want to evaluate our bespoke pretty printer
+// for all `AstNode`s so we define a sub class of interesting ones.
+//
+// Note that AstNode is abstract and AstNode_ is a library class, so
+// we have to extend @py_ast_node.
+class Namable extends @py_ast_node {
+  Namable() {
+    exists(ProtocolConfiguration protocolConfiguration |
+      this = protocolConfiguration.asCfgNode().(CallNode).getFunction().getNode()
+    )
+    or
+    exists(Namable attr | this = attr.(Attribute).getObject())
+  }
+
+  string toString() { result = "AstNode" }
+}
+
+string callName(Namable call) {
   result = call.(Name).getId()
   or
   exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())
 }
 
-string configName(DataFlow::Node protocolConfiguration) {
+string configName(ProtocolConfiguration protocolConfiguration) {
   result =
     "call to " + callName(protocolConfiguration.asCfgNode().(CallNode).getFunction().getNode())
   or

From 5ce3f9d6ff6eb740d8c6add31fd7c95fa79f6453 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Sun, 28 Mar 2021 03:15:06 +0000
Subject: [PATCH 090/433] Update qldoc and enhance the query

---
 .../CWE-555/CredentialsInPropertiesFile.qhelp |  6 +-
 .../CWE-555/CredentialsInPropertiesFile.ql    | 84 +++++++++++++------
 .../CredentialsInPropertiesFile.expected      | 10 +--
 .../CWE-555/CredentialsInPropertiesFile.ql    | 81 ++++++++++++------
 .../security/CWE-555/PropertiesUtils.java     | 57 +++++++++++++
 .../security/CWE-555/messages.properties      |  1 +
 6 files changed, 179 insertions(+), 60 deletions(-)
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
index 0869b8862601..5549f188f1f4 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
@@ -3,7 +3,7 @@
   <overview>
     <p>
       Credentials management issues occur when credentials are stored in plaintext in 
-      an application’s properties file. Common credentials include but are not limited 
+      an application's properties file. Common credentials include but are not limited 
       to LDAP, mail, database, proxy account, and so on. Storing plaintext credentials 
       in a properties file allows anyone who can read the file access to the protected 
       resource. Good credentials management guidelines require that credentials never 
@@ -21,12 +21,12 @@
 
   <example>
     <p>
-      In the first example, the credentials of a LDAP and datasource properties are stored 
+      In the first example, the credentials for the LDAP and datasource properties are stored 
       in cleartext in the properties file.
     </p>
 
     <p>
-      In the second example, the credentials of a LDAP and datasource properties are stored
+      In the second example, the credentials for the LDAP and datasource properties are stored
       in an encrypted format.
     </p>
     <sample src="configuration.properties" />
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
index 1e9b99060968..8bbc0d00a462 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
@@ -14,28 +14,22 @@
  * If creating your own database with the CodeQL CLI, you should run
  * `codeql database index-files --language=properties ...`
  * If using lgtm.com, you should add `properties_files: true` to the index block of your
- * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction#customizing-index)
  */
 
 import java
 import semmle.code.configfiles.ConfigFiles
+import semmle.code.java.dataflow.FlowSources
 
 private string possibleSecretName() {
-  result = "%password%" or
-  result = "%passwd%" or
-  result = "%account%" or
-  result = "%accnt%" or
-  result = "%credential%" or
-  result = "%token%" or
-  result = "%secret%" or
-  result = "%access%key%"
+  result =
+    [
+      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
+      "%access%key%"
+    ]
 }
 
-private string possibleEncryptedSecretName() {
-  result = "%hashed%" or
-  result = "%encrypted%" or
-  result = "%crypt%"
-}
+private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
 
 /** Holds if the value is not cleartext credentials. */
 bindingset[value]
@@ -69,27 +63,63 @@ predicate isNonProdCredentials(CredentialsConfig cc) {
   cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"])
 }
 
-/** The properties file with configuration key/value pairs. */
-class ConfigProperties extends ConfigPair {
-  ConfigProperties() { this.getFile().getBaseName().toLowerCase().matches("%.properties") }
-}
-
 /** The credentials configuration property. */
-class CredentialsConfig extends ConfigProperties {
+class CredentialsConfig extends ConfigPair {
   CredentialsConfig() {
     this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
-    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName())
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
+    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
   }
 
   string getName() { result = this.getNameElement().getName().trim() }
 
   string getValue() { result = this.getValueElement().getValue().trim() }
+
+  /** Returns a description of this vulnerability. */
+  string getConfigDesc() {
+    exists(
+      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
+    |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink) and
+      ma.getArgument(0) = sink.asExpr() and
+      result = "Plaintext credentials " + this.getName() + " are loaded in " + ma
+    )
+    or
+    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink)
+    ) and
+    result =
+      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
+        " in properties file"
+  }
+}
+
+/**
+ * A dataflow configuration tracking flow of a method that loads a credentials property.
+ */
+class LoadCredentialsConfiguration extends DataFlow::Configuration {
+  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(CredentialsConfig cc |
+      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() =
+      any(MethodAccess ma |
+        ma.getMethod()
+            .getDeclaringType()
+            .getASupertype*()
+            .hasQualifiedName("java.util", "Properties") and
+        ma.getMethod().getName() = "getProperty"
+      ).getArgument(0)
+  }
 }
 
 from CredentialsConfig cc
-where
-  not isNotCleartextCredentials(cc.getValue()) and
-  not isNonProdCredentials(cc)
-select cc,
-  "Plaintext credentials " + cc.getName() + " have cleartext value " + cc.getValue() +
-    " in properties file."
+where not isNonProdCredentials(cc)
+select cc, cc.getConfigDesc()
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
index 0ce339139324..1bdc004a446f 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
@@ -1,5 +1,5 @@
-| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password have cleartext value mysecpass in properties file. |
-| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password have cleartext value Passw0rd@123 in properties file. |
-| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password have cleartext value MysecPWxWa@1993 in properties file. |
-| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key have cleartext value AKMAMQPBYMCD6YSAYCBA in properties file. |
-| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key have cleartext value 8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k in properties file. |
+| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password are loaded in getProperty(...) |
+| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password are loaded in getProperty(...) |
+| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password are loaded in getProperty(...) |
+| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key are loaded in getProperty(...) |
+| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key are loaded in getProperty(...) |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
index bb7495dc4d9a..b6890e4ac9fc 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
@@ -14,28 +14,22 @@
  * If creating your own database with the CodeQL CLI, you should run
  * `codeql database index-files --language=properties ...`
  * If using lgtm.com, you should add `properties_files: true` to the index block of your
- * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction#customizing-index)
  */
 
 import java
 import semmle.code.configfiles.ConfigFiles
+import semmle.code.java.dataflow.FlowSources
 
 private string possibleSecretName() {
-  result = "%password%" or
-  result = "%passwd%" or
-  result = "%account%" or
-  result = "%accnt%" or
-  result = "%credential%" or
-  result = "%token%" or
-  result = "%secret%" or
-  result = "%access%key%"
+  result =
+    [
+      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
+      "%access%key%"
+    ]
 }
 
-private string possibleEncryptedSecretName() {
-  result = "%hashed%" or
-  result = "%encrypted%" or
-  result = "%crypt%"
-}
+private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
 
 /** Holds if the value is not cleartext credentials. */
 bindingset[value]
@@ -60,25 +54,62 @@ predicate isNotCleartextCredentials(string value) {
   value.toLowerCase().matches(possibleSecretName())
 }
 
-/** The properties file with configuration key/value pairs. */
-class ConfigProperties extends ConfigPair {
-  ConfigProperties() { this.getFile().getBaseName().toLowerCase().matches("%.properties") }
-}
-
 /** The credentials configuration property. */
-class CredentialsConfig extends ConfigProperties {
+class CredentialsConfig extends ConfigPair {
   CredentialsConfig() {
     this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
-    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName())
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
+    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
   }
 
   string getName() { result = this.getNameElement().getName().trim() }
 
   string getValue() { result = this.getValueElement().getValue().trim() }
+
+  /** Returns a description of this vulnerability. */
+  string getConfigDesc() {
+    exists(
+      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
+    |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink) and
+      ma.getArgument(0) = sink.asExpr() and
+      result = "Plaintext credentials " + this.getName() + " are loaded in " + ma
+    )
+    or
+    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink)
+    ) and
+    result =
+      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
+        " in properties file"
+  }
+}
+
+/**
+ * A dataflow configuration tracking flow of a method that loads a credentials property.
+ */
+class LoadCredentialsConfiguration extends DataFlow::Configuration {
+  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(CredentialsConfig cc |
+      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() =
+      any(MethodAccess ma |
+        ma.getMethod()
+            .getDeclaringType()
+            .getASupertype*()
+            .hasQualifiedName("java.util", "Properties") and
+        ma.getMethod().getName() = "getProperty"
+      ).getArgument(0)
+  }
 }
 
 from CredentialsConfig cc
-where not isNotCleartextCredentials(cc.getValue())
-select cc,
-  "Plaintext credentials " + cc.getName() + " have cleartext value " + cc.getValue() +
-    " in properties file."
+select cc, cc.getConfigDesc()
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java b/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
new file mode 100644
index 000000000000..b54995a9967e
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
@@ -0,0 +1,57 @@
+import java.io.IOException;
+import java.util.Properties;
+
+public class PropertiesUtils {
+	/* Properties declaration. */ 
+	private static Properties properties;  
+
+    /** Static block to initializing the properties. */
+	static {
+		properties = new Properties();
+		try {
+			properties.load(PropertiesUtils.class.getClassLoader().getResourceAsStream("configuration.properties"));
+		} catch (IOException e) {
+			e.printStackTrace();
+		}
+	}
+
+	/** Returns the LDAP DN property value. */
+	public static String getLdapDN() {
+		return properties.getProperty("ldap.loginDN");
+	}
+    
+	/** Returns the LDAP password property value. */
+	public static String getLdapPassword() {
+		return properties.getProperty("ldap.password");
+	}
+
+	/** Returns the SQL Server username property value. */
+	public static String getMSDataSourceUserName() {
+		return properties.getProperty("datasource1.username");
+	}
+
+	/** Returns the SQL Server password property value. */
+	public static String getMSDataSourcePassword() {
+		return properties.getProperty("datasource1.password");
+	}
+    
+	/** Returns the mail account property value. */
+	public static String getMailUserName() {
+		return properties.getProperty("mail.username");
+	}
+
+ 	/** Returns the mail password property value. */
+	public static String getMailPassword() {
+		return properties.getProperty("mail.password");
+	}
+
+	/** Returns the AWS Access Key property value. */
+	public static String getAWSAccessKey() {
+		return properties.getProperty("com.example.aws.s3.access_key");
+	}
+
+	/** Returns the AWS Secret Key property value. */
+	public static String getAWSSecretKey() {
+		return properties.getProperty("com.example.aws.s3.secret_key");
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
index fac63ec23e85..27a244c60716 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
@@ -1,3 +1,4 @@
+# GOOD: UI display messages; not credentials
 prompt.username=Username
 prompt.password=Password
 

From 093c63ea3b15cd33b08b8bd1d1058ffc3c6dd075 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Sun, 28 Mar 2021 23:42:36 +0300
Subject: [PATCH 091/433] Update
 OperatorPrecedenceLogicErrorWhenUseBoolType.expected

---
 .../tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
index 76062fc360a3..1209c7e78307 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
@@ -1,4 +1,4 @@
-| test.cpp:10:3:10:10 | ... = ... | this expression needs attention |
+| test.cpp:10:8:10:10 | - ... | this expression needs attention |
 | test.cpp:12:3:12:6 | ... ++ | this expression needs attention |
 | test.cpp:13:3:13:6 | ++ ... | this expression needs attention |
 | test.cpp:14:6:14:21 | ... = ... | this expression needs attention |

From 3f215d0954ea56c34f90837e259553be82675f76 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Sun, 28 Mar 2021 23:43:22 +0300
Subject: [PATCH 092/433] Update OperatorPrecedenceLogicErrorWhenUseBoolType.ql

---
 ...ratorPrecedenceLogicErrorWhenUseBoolType.ql | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
index 034df703bc30..4f30f112eb07 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
@@ -13,17 +13,17 @@
  */
 
 import cpp
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.valuenumbering.HashCons
 
 /** Holds if `exp` increments a boolean value. */
-predicate incrementBoolType(Expr exp) {
-  exp.(IncrementOperation).getOperand().getType() instanceof BoolType
+predicate incrementBoolType(IncrementOperation exp) {
+  exp.getOperand().getType() instanceof BoolType
 }
 
 /** Holds if `exp` applies the unary minus operator to a boolean type. */
-predicate revertSignBoolType(Expr exp) {
-  exp.(AssignExpr).getRValue().(UnaryMinusExpr).getAnOperand().getType() instanceof BoolType and
-  exp.(AssignExpr).getLValue().getType() instanceof BoolType
+predicate revertSignBoolType(UnaryMinusExpr exp) {
+  exp.getAnOperand().getType() instanceof BoolType and
+  exp.getFullyConverted().getType() instanceof BoolType
 }
 
 /** Holds, if this is an expression, uses comparison and assignment outside of execution precedence. */
@@ -33,6 +33,12 @@ predicate assignBoolType(Expr exp) {
     exp.isCondition() and
     not co.isParenthesised() and
     not exp.(AssignExpr).getLValue().getType() instanceof BoolType and
+    not exists(Expr exbl |
+      hashCons(exbl.(AssignExpr).getLValue()) = hashCons(exp.(AssignExpr).getLValue()) and
+      not exbl.isCondition() and
+      exbl.(AssignExpr).getRValue().getType() instanceof BoolType and
+      exbl.(AssignExpr).getLValue().getType() = exp.(AssignExpr).getLValue().getType()
+    ) and
     co.getLeftOperand() instanceof FunctionCall and
     not co.getRightOperand().getType() instanceof BoolType and
     not co.getRightOperand().getValue() = "0" and

From 0775d35591511db2003b3b7453c6bfc2284ba250 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Mon, 29 Mar 2021 12:02:37 +0800
Subject: [PATCH 093/433] update VerificationMethodFlowConfig, add if test

---
 .../Security/CWE/CWE-352/JsonpInjection.java  |  35 ++--
 .../Security/CWE/CWE-352/JsonpInjection.qhelp |   2 +-
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  27 ++--
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  47 ++++--
 .../JsonpController.java                      |  35 ++--
 .../JsonpInjection.expected                   | 138 ++++++++--------
 .../JsonpController.java                      |  37 +++--
 .../JsonpInjection.expected                   | 147 ++++++++---------
 .../JsonpController.java                      |  37 +++--
 .../JsonpInjection.expected                   | 150 +++++++++---------
 10 files changed, 362 insertions(+), 293 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
index 7f479a8c0230..8e2a0c9005ff 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
@@ -26,9 +26,6 @@ public class JsonpInjection {
         hashMap.put("password","123456");
     }
 
-    private String name = null;
-
-
     @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
         PrintWriter pw = null;
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
-
         String resultStr = null;
         pw = response.getWriter();
         resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-
     @GetMapping(value = "jsonp8")
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad8(HttpServletRequest request) {
         String resultStr = null;
         String token = request.getParameter("token");
-        if (verifToken(token)){
+        boolean result = verifToken(token); //Just check.
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String referer = request.getParameter("referer");
+        if (verifReferer(referer)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
     }
 
 
-    @GetMapping(value = "jsonp9")
+    @GetMapping(value = "jsonp10")
     @ResponseBody
     public String good2(HttpServletRequest request) {
         String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp10")
+    @RequestMapping(value = "jsonp11")
     @ResponseBody
     public String good3(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp11")
+    @RequestMapping(value = "jsonp12")
     @ResponseBody
     public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
         }
         return true;
     }
+
+    public static boolean verifReferer(String str){
+        if (str != "xxxx"){
+            return false;
+        }
+        return true;
+    }
 }
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index 93c167d6c2ca..2712f30a3f2b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -14,7 +14,7 @@ When there is a cross-domain problem, the problem of sensitive information leaka
 </recommendation>
 <example>
 
-<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad7</code>, 
+<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad8</code>, 
 will cause information leakage problems when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
 method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can 
 solve the problem of information leakage caused by cross-domain.</p>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index eb4fe4e5b66a..6e333d839930 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -18,20 +18,18 @@ import DataFlow::PathGraph
 
 /** Determine whether there is a verification method for the remote streaming source data flow path method. */
 predicate existsFilterVerificationMethod() {
-  exists(MethodAccess ma, Node existsNode, Method m |
-    ma.getMethod() instanceof VerificationMethodClass and
-    existsNode.asExpr() = ma and
-    m = getACallingCallableOrSelf(existsNode.getEnclosingCallable()) and
+  exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc, Method m |
+    vmfc.hasFlow(source, sink) and
+    m = getACallingCallableOrSelf(source.getEnclosingCallable()) and
     isDoFilterMethod(m)
   )
 }
 
 /** Determine whether there is a verification method for the remote streaming source data flow path method. */
 predicate existsServletVerificationMethod(Node checkNode) {
-  exists(MethodAccess ma, Node existsNode |
-    ma.getMethod() instanceof VerificationMethodClass and
-    existsNode.asExpr() = ma and
-    getACallingCallableOrSelf(existsNode.getEnclosingCallable()) =
+  exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
+    vmfc.hasFlow(source, sink) and
+    getACallingCallableOrSelf(source.getEnclosingCallable()) =
       getACallingCallableOrSelf(checkNode.getEnclosingCallable())
   )
 }
@@ -40,13 +38,14 @@ predicate existsServletVerificationMethod(Node checkNode) {
 class RequestResponseFlowConfig extends TaintTracking::Configuration {
   RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
+  override predicate isSource(DataFlow::Node source) {
+    source instanceof RemoteFlowSource and
+    getACallingCallableOrSelf(source.getEnclosingCallable()) instanceof RequestGetMethod
+  }
 
-  /** Eliminate the method of calling the node is not the get method. */
-  override predicate isSanitizer(DataFlow::Node node) {
-    not getACallingCallableOrSelf(node.getEnclosingCallable()) instanceof RequestGetMethod
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof XssSink and
+    getACallingCallableOrSelf(sink.getEnclosingCallable()) instanceof RequestGetMethod
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index d0e00bcb634f..bf90926f72f0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -3,30 +3,47 @@ import DataFlow
 import JsonStringLib
 import semmle.code.java.security.XSS
 import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.DataFlow3
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
-/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
-class VerificationMethodFlowConfig extends TaintTracking::Configuration {
-  VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
+/** A data flow configuration is tracing flow from the access to the authentication method of token/auth/referer/origin to if condition. */
+class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
+  VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
 
-  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+  override predicate isSource(DataFlow::Node src) {
+    exists(MethodAccess ma, BarrierGuard bg | ma = bg |
+      (
+        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        or
+        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+      ) and
+      ma = src.asExpr()
+    )
+  }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
-      ma.getAnArgument() = sink.asExpr()
-    )
+    exists(IfStmt is | is.getCondition() = sink.asExpr())
   }
 }
 
-/** The parameter names of this method are token/auth/referer/origin. */
-class VerificationMethodClass extends Method {
-  VerificationMethodClass() {
-    exists(MethodAccess ma, VerificationMethodFlowConfig vmfc, Node node |
-      this = ma.getMethod() and
-      node.asExpr() = ma.getAnArgument() and
-      vmfc.hasFlowTo(node)
+/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
+class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
+  VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma, BarrierGuard bg, int i, VerificationMethodToIfFlowConfig vmtifc |
+      ma = bg
+    |
+      (
+        ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        or
+        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+      ) and
+      ma.getArgument(i) = sink.asExpr() and
+      vmtifc.hasFlow(exprNode(ma), _)
     )
   }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
index e5b5e70a38d7..e875da2f6995 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
@@ -26,9 +26,6 @@ public class JsonpController {
         hashMap.put("password","123456");
     }
 
-    private String name = null;
-
-
     @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
         PrintWriter pw = null;
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
-
         String resultStr = null;
         pw = response.getWriter();
         resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-
     @GetMapping(value = "jsonp8")
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad8(HttpServletRequest request) {
         String resultStr = null;
         String token = request.getParameter("token");
-        if (verifToken(token)){
+        boolean result = verifToken(token); //Just check.
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String referer = request.getParameter("referer");
+        if (verifReferer(referer)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
     }
 
 
-    @GetMapping(value = "jsonp9")
+    @GetMapping(value = "jsonp10")
     @ResponseBody
     public String good2(HttpServletRequest request) {
         String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp10")
+    @RequestMapping(value = "jsonp11")
     @ResponseBody
     public String good3(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp11")
+    @RequestMapping(value = "jsonp12")
     @ResponseBody
     public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
         }
         return true;
     }
+
+    public static boolean verifReferer(String str){
+        if (str != "xxxx"){
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
index 501565f2b4ec..3da805c6a698 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
@@ -1,80 +1,76 @@
 edges
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
 | JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
 | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
 | JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| RefererFilter.java:22:26:22:53 | getHeader(...) : String | RefererFilter.java:23:39:23:45 | refefer |
 nodes
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:118:24:118:28 | token | semmle.label | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:133:37:133:41 | token | semmle.label | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
@@ -82,6 +78,4 @@ nodes
 | JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| RefererFilter.java:22:26:22:53 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| RefererFilter.java:23:39:23:45 | refefer | semmle.label | refefer |
 #select
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
index e5b5e70a38d7..4c60b356cfb4 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
@@ -26,9 +26,6 @@ public class JsonpController {
         hashMap.put("password","123456");
     }
 
-    private String name = null;
-
-
     @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
         PrintWriter pw = null;
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
-
         String resultStr = null;
         pw = response.getWriter();
         resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-
     @GetMapping(value = "jsonp8")
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad8(HttpServletRequest request) {
         String resultStr = null;
         String token = request.getParameter("token");
-        if (verifToken(token)){
+        boolean result = verifToken(token); //Just check.
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String referer = request.getParameter("referer");
+        if (verifReferer(referer)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
     }
 
 
-    @GetMapping(value = "jsonp9")
+    @GetMapping(value = "jsonp10")
     @ResponseBody
     public String good2(HttpServletRequest request) {
         String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp10")
+    @RequestMapping(value = "jsonp11")
     @ResponseBody
     public String good3(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp11")
+    @RequestMapping(value = "jsonp12")
     @ResponseBody
     public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
         }
         return true;
     }
-}
+
+    public static boolean verifReferer(String str){
+        if (str != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
index 91d23cebbdac..2e4bc97ff973 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
@@ -1,76 +1,77 @@
 edges
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
 nodes
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:118:24:118:28 | token | semmle.label | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:133:37:133:41 | token | semmle.label | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
 #select
-| JsonpController.java:40:16:40:24 | resultStr | JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:36:32:36:68 | getParameter(...) | this user input |
-| JsonpController.java:49:16:49:24 | resultStr | JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:47:32:47:68 | getParameter(...) | this user input |
-| JsonpController.java:59:16:59:24 | resultStr | JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:56:32:56:68 | getParameter(...) | this user input |
-| JsonpController.java:69:16:69:24 | resultStr | JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:66:32:66:68 | getParameter(...) | this user input |
-| JsonpController.java:84:20:84:28 | resultStr | JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:76:32:76:68 | getParameter(...) | this user input |
-| JsonpController.java:98:20:98:28 | resultStr | JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:91:32:91:68 | getParameter(...) | this user input |
-| JsonpController.java:109:16:109:24 | resultStr | JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:105:32:105:68 | getParameter(...) | this user input |
+| JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
+| JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
+| JsonpController.java:56:16:56:24 | resultStr | JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:53:32:53:68 | getParameter(...) | this user input |
+| JsonpController.java:66:16:66:24 | resultStr | JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:63:32:63:68 | getParameter(...) | this user input |
+| JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
+| JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
+| JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
+| JsonpController.java:117:16:117:24 | resultStr | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:114:32:114:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
index e5b5e70a38d7..4c60b356cfb4 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
@@ -26,9 +26,6 @@ public class JsonpController {
         hashMap.put("password","123456");
     }
 
-    private String name = null;
-
-
     @GetMapping(value = "jsonp1")
     @ResponseBody
     public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
         PrintWriter pw = null;
         Gson gson = new Gson();
         String result = gson.toJson(hashMap);
-
         String resultStr = null;
         pw = response.getWriter();
         resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-
     @GetMapping(value = "jsonp8")
     @ResponseBody
-    public String good1(HttpServletRequest request) {
+    public String bad8(HttpServletRequest request) {
         String resultStr = null;
         String token = request.getParameter("token");
-        if (verifToken(token)){
+        boolean result = verifToken(token); //Just check.
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+
+    @GetMapping(value = "jsonp9")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        String resultStr = null;
+        String referer = request.getParameter("referer");
+        if (verifReferer(referer)){
             String jsonpCallback = request.getParameter("jsonpCallback");
             String jsonStr = getJsonStr(hashMap);
             resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
     }
 
 
-    @GetMapping(value = "jsonp9")
+    @GetMapping(value = "jsonp10")
     @ResponseBody
     public String good2(HttpServletRequest request) {
         String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp10")
+    @RequestMapping(value = "jsonp11")
     @ResponseBody
     public String good3(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
         return resultStr;
     }
 
-    @RequestMapping(value = "jsonp11")
+    @RequestMapping(value = "jsonp12")
     @ResponseBody
     public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
         }
         return true;
     }
-}
+
+    public static boolean verifReferer(String str){
+        if (str != "xxxx"){
+            return false;
+        }
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
index c2bcab77d4d4..d90d51ab5524 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
@@ -1,79 +1,76 @@
 edges
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:39:21:39:54 | ... + ... : String | JsonpController.java:40:16:40:24 | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:48:21:48:80 | ... + ... : String | JsonpController.java:49:16:49:24 | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:58:21:58:55 | ... + ... : String | JsonpController.java:59:16:59:24 | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:68:21:68:54 | ... + ... : String | JsonpController.java:69:16:69:24 | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:83:21:83:54 | ... + ... : String | JsonpController.java:84:20:84:28 | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:97:21:97:54 | ... + ... : String | JsonpController.java:98:20:98:28 | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:108:21:108:54 | ... + ... : String | JsonpController.java:109:16:109:24 | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | JsonpController.java:118:24:118:28 | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:121:25:121:59 | ... + ... : String | JsonpController.java:122:20:122:28 | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | JsonpController.java:133:37:133:41 | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:139:21:139:55 | ... + ... : String | JsonpController.java:140:16:140:24 | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | JsonpController.java:151:16:151:24 | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | JsonpController.java:166:16:166:24 | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
 | JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | JsonpInjectionServlet1.java:38:39:38:45 | referer |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
 | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
 | JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
 nodes
-| JsonpController.java:36:32:36:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:39:21:39:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:40:16:40:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:47:32:47:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:48:21:48:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:49:16:49:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:56:32:56:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:58:21:58:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:59:16:59:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:66:32:66:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:68:21:68:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:69:16:69:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:76:32:76:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:83:21:83:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:84:20:84:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:91:32:91:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:97:21:97:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:98:20:98:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:32:105:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:108:21:108:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:109:16:109:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:24:117:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:118:24:118:28 | token | semmle.label | token |
-| JsonpController.java:119:36:119:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:121:25:121:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:122:20:122:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:132:24:132:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:133:37:133:41 | token | semmle.label | token |
-| JsonpController.java:137:32:137:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:139:21:139:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:140:16:140:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:150:21:150:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:151:16:151:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:165:21:165:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:166:16:166:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet1.java:36:26:36:49 | getHeader(...) : String | semmle.label | getHeader(...) : String |
-| JsonpInjectionServlet1.java:38:39:38:45 | referer | semmle.label | referer |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
@@ -82,11 +79,12 @@ nodes
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
 #select
-| JsonpController.java:40:16:40:24 | resultStr | JsonpController.java:36:32:36:68 | getParameter(...) : String | JsonpController.java:40:16:40:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:36:32:36:68 | getParameter(...) | this user input |
-| JsonpController.java:49:16:49:24 | resultStr | JsonpController.java:47:32:47:68 | getParameter(...) : String | JsonpController.java:49:16:49:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:47:32:47:68 | getParameter(...) | this user input |
-| JsonpController.java:59:16:59:24 | resultStr | JsonpController.java:56:32:56:68 | getParameter(...) : String | JsonpController.java:59:16:59:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:56:32:56:68 | getParameter(...) | this user input |
-| JsonpController.java:69:16:69:24 | resultStr | JsonpController.java:66:32:66:68 | getParameter(...) : String | JsonpController.java:69:16:69:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:66:32:66:68 | getParameter(...) | this user input |
-| JsonpController.java:84:20:84:28 | resultStr | JsonpController.java:76:32:76:68 | getParameter(...) : String | JsonpController.java:84:20:84:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:76:32:76:68 | getParameter(...) | this user input |
-| JsonpController.java:98:20:98:28 | resultStr | JsonpController.java:91:32:91:68 | getParameter(...) : String | JsonpController.java:98:20:98:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:91:32:91:68 | getParameter(...) | this user input |
-| JsonpController.java:109:16:109:24 | resultStr | JsonpController.java:105:32:105:68 | getParameter(...) : String | JsonpController.java:109:16:109:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:105:32:105:68 | getParameter(...) | this user input |
+| JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
+| JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
+| JsonpController.java:56:16:56:24 | resultStr | JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:53:32:53:68 | getParameter(...) | this user input |
+| JsonpController.java:66:16:66:24 | resultStr | JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:63:32:63:68 | getParameter(...) | this user input |
+| JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
+| JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
+| JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
+| JsonpController.java:117:16:117:24 | resultStr | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:114:32:114:68 | getParameter(...) | this user input |
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | Jsonp response might include code from $@. | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) | this user input |

From 1349bf7b0ba8b83ee86d5fbdc46b207e32439cd1 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Tue, 30 Mar 2021 02:57:58 +0000
Subject: [PATCH 094/433] Create a .qll file to reuse the code and add check of
 Spring properties

---
 .../CWE-555/CredentialsInPropertiesFile.ql    |  93 +--------------
 .../CredentialsInPropertiesFile.qll           | 107 ++++++++++++++++++
 .../CredentialsInPropertiesFile.expected      |  10 +-
 .../CWE-555/CredentialsInPropertiesFile.ql    |  93 +--------------
 .../security/CWE-555/MailConfig.java          |  11 ++
 .../security/CWE-555/PropertiesUtils.java     |  10 --
 .../query-tests/security/CWE-555/options      |   1 +
 .../beans/factory/annotation/Value.java       |  11 ++
 8 files changed, 137 insertions(+), 199 deletions(-)
 create mode 100644 java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/options
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
index 8bbc0d00a462..d4ebe902cf75 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
@@ -18,41 +18,7 @@
  */
 
 import java
-import semmle.code.configfiles.ConfigFiles
-import semmle.code.java.dataflow.FlowSources
-
-private string possibleSecretName() {
-  result =
-    [
-      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
-      "%access%key%"
-    ]
-}
-
-private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
-
-/** Holds if the value is not cleartext credentials. */
-bindingset[value]
-predicate isNotCleartextCredentials(string value) {
-  value = "" // Empty string
-  or
-  value.length() < 7 // Typical credentials are no less than 6 characters
-  or
-  value.matches("% %") // Sentences containing spaces
-  or
-  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
-  or
-  value.matches("@%") // Starts with the "@" sign
-  or
-  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
-  or
-  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
-  or
-  value.matches("ENC(%)") // Encrypted value
-  or
-  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
-  value.toLowerCase().matches(possibleSecretName())
-}
+import experimental.semmle.code.java.frameworks.CredentialsInPropertiesFile
 
 /**
  * Holds if the credentials are in a non-production properties file indicated by:
@@ -63,63 +29,6 @@ predicate isNonProdCredentials(CredentialsConfig cc) {
   cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"])
 }
 
-/** The credentials configuration property. */
-class CredentialsConfig extends ConfigPair {
-  CredentialsConfig() {
-    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
-    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
-    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
-  }
-
-  string getName() { result = this.getNameElement().getName().trim() }
-
-  string getValue() { result = this.getValueElement().getValue().trim() }
-
-  /** Returns a description of this vulnerability. */
-  string getConfigDesc() {
-    exists(
-      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
-    |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink) and
-      ma.getArgument(0) = sink.asExpr() and
-      result = "Plaintext credentials " + this.getName() + " are loaded in " + ma
-    )
-    or
-    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink)
-    ) and
-    result =
-      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
-        " in properties file"
-  }
-}
-
-/**
- * A dataflow configuration tracking flow of a method that loads a credentials property.
- */
-class LoadCredentialsConfiguration extends DataFlow::Configuration {
-  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) {
-    exists(CredentialsConfig cc |
-      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() =
-      any(MethodAccess ma |
-        ma.getMethod()
-            .getDeclaringType()
-            .getASupertype*()
-            .hasQualifiedName("java.util", "Properties") and
-        ma.getMethod().getName() = "getProperty"
-      ).getArgument(0)
-  }
-}
-
 from CredentialsConfig cc
 where not isNonProdCredentials(cc)
 select cc, cc.getConfigDesc()
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
new file mode 100644
index 000000000000..9577789ce0c0
--- /dev/null
+++ b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
@@ -0,0 +1,107 @@
+/**
+ * Provides classes for analyzing properties files.
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.Properties
+
+private string possibleSecretName() {
+  result =
+    [
+      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
+      "%access%key%"
+    ]
+}
+
+private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
+
+/** Holds if the value is not cleartext credentials. */
+bindingset[value]
+predicate isNotCleartextCredentials(string value) {
+  value = "" // Empty string
+  or
+  value.length() < 7 // Typical credentials are no less than 6 characters
+  or
+  value.matches("% %") // Sentences containing spaces
+  or
+  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
+  or
+  value.matches("@%") // Starts with the "@" sign
+  or
+  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
+  or
+  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
+  or
+  value.matches("ENC(%)") // Encrypted value
+  or
+  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
+  value.toLowerCase().matches(possibleSecretName())
+}
+
+/** The credentials configuration property. */
+class CredentialsConfig extends ConfigPair {
+  CredentialsConfig() {
+    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
+    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
+  }
+
+  string getName() { result = this.getNameElement().getName().trim() }
+
+  string getValue() { result = this.getValueElement().getValue().trim() }
+
+  /** Returns a description of this vulnerability. */
+  string getConfigDesc() {
+    exists(
+      // getProperty(...)
+      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
+    |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink) and
+      ma.getArgument(0) = sink.asExpr() and
+      result = "Plaintext credentials " + this.getName() + " are loaded in Java Properties " + ma
+    )
+    or
+    exists(
+      // @Value("${mail.password}")
+      Annotation a
+    |
+      a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
+      a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}" and
+      result = "Plaintext credentials " + this.getName() + " are loaded in Spring annotation " + a
+    )
+    or
+    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
+      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
+      cc.hasFlow(source, sink)
+    ) and
+    not exists(Annotation a |
+      a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
+      a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}"
+    ) and
+    result =
+      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
+        " in properties file"
+  }
+}
+
+/**
+ * A dataflow configuration tracking flow of cleartext credentials stored in a properties file
+ *  to a `Properties.getProperty(...)` method call.
+ */
+class LoadCredentialsConfiguration extends DataFlow::Configuration {
+  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(CredentialsConfig cc |
+      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() =
+      any(MethodAccess ma | ma.getMethod() instanceof PropertiesGetPropertyMethod).getArgument(0)
+  }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
index 1bdc004a446f..371a4765c53b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
@@ -1,5 +1,5 @@
-| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password are loaded in getProperty(...) |
-| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password are loaded in getProperty(...) |
-| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password are loaded in getProperty(...) |
-| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key are loaded in getProperty(...) |
-| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key are loaded in getProperty(...) |
+| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password are loaded in Java Properties getProperty(...) |
+| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password are loaded in Java Properties getProperty(...) |
+| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password are loaded in Spring annotation Value |
+| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key are loaded in Java Properties getProperty(...) |
+| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key are loaded in Java Properties getProperty(...) |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
index b6890e4ac9fc..f085317218c0 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
@@ -18,98 +18,7 @@
  */
 
 import java
-import semmle.code.configfiles.ConfigFiles
-import semmle.code.java.dataflow.FlowSources
-
-private string possibleSecretName() {
-  result =
-    [
-      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
-      "%access%key%"
-    ]
-}
-
-private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
-
-/** Holds if the value is not cleartext credentials. */
-bindingset[value]
-predicate isNotCleartextCredentials(string value) {
-  value = "" // Empty string
-  or
-  value.length() < 7 // Typical credentials are no less than 6 characters
-  or
-  value.matches("% %") // Sentences containing spaces
-  or
-  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
-  or
-  value.matches("@%") // Starts with the "@" sign
-  or
-  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
-  or
-  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
-  or
-  value.matches("ENC(%)") // Encrypted value
-  or
-  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
-  value.toLowerCase().matches(possibleSecretName())
-}
-
-/** The credentials configuration property. */
-class CredentialsConfig extends ConfigPair {
-  CredentialsConfig() {
-    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
-    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
-    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
-  }
-
-  string getName() { result = this.getNameElement().getName().trim() }
-
-  string getValue() { result = this.getValueElement().getValue().trim() }
-
-  /** Returns a description of this vulnerability. */
-  string getConfigDesc() {
-    exists(
-      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
-    |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink) and
-      ma.getArgument(0) = sink.asExpr() and
-      result = "Plaintext credentials " + this.getName() + " are loaded in " + ma
-    )
-    or
-    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink)
-    ) and
-    result =
-      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
-        " in properties file"
-  }
-}
-
-/**
- * A dataflow configuration tracking flow of a method that loads a credentials property.
- */
-class LoadCredentialsConfiguration extends DataFlow::Configuration {
-  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) {
-    exists(CredentialsConfig cc |
-      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() =
-      any(MethodAccess ma |
-        ma.getMethod()
-            .getDeclaringType()
-            .getASupertype*()
-            .hasQualifiedName("java.util", "Properties") and
-        ma.getMethod().getName() = "getProperty"
-      ).getArgument(0)
-  }
-}
+import experimental.semmle.code.java.frameworks.CredentialsInPropertiesFile
 
 from CredentialsConfig cc
 select cc, cc.getConfigDesc()
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java b/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
new file mode 100644
index 000000000000..bef99dac3ea7
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
@@ -0,0 +1,11 @@
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class MailConfig {
+    @Value("${mail.password}")
+    private String mailPassword;
+
+    @Value("${mail.username}")
+    private String mailUserName;
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java b/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
index b54995a9967e..f33ef39ee077 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
@@ -35,16 +35,6 @@ public static String getMSDataSourcePassword() {
 		return properties.getProperty("datasource1.password");
 	}
     
-	/** Returns the mail account property value. */
-	public static String getMailUserName() {
-		return properties.getProperty("mail.username");
-	}
-
- 	/** Returns the mail password property value. */
-	public static String getMailPassword() {
-		return properties.getProperty("mail.password");
-	}
-
 	/** Returns the AWS Access Key property value. */
 	public static String getAWSAccessKey() {
 		return properties.getProperty("com.example.aws.s3.access_key");
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/options b/java/ql/test/experimental/query-tests/security/CWE-555/options
new file mode 100644
index 000000000000..cf3d60de0e5c
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java
new file mode 100644
index 000000000000..67c38cf5d20b
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java
@@ -0,0 +1,11 @@
+package org.springframework.beans.factory.annotation;
+
+public @interface Value {
+
+	/**
+	 * The actual value expression such as <code>#{systemProperties.myProp}</code>
+	 * or property placeholder such as <code>${my.app.myProp}</code>.
+	 */
+	String value();
+
+}
\ No newline at end of file

From 8159098dc0e47627a2386d8682e36f3d0445ca3e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 31 Mar 2021 11:32:01 +0200
Subject: [PATCH 095/433] C++: Add test from issue #5190.

---
 .../dataflow/taint-tests/smart_pointer.cpp             | 10 ++++++++++
 cpp/ql/test/library-tests/dataflow/taint-tests/stl.h   |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index f45260228e8e..1f222cbae3e2 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -65,4 +65,14 @@ void test_shared_field_member() {
     std::unique_ptr<A> p = std::make_unique<A>(source(), 0);
     sink(p->x); // $ MISSING: ast,ir
     sink(p->y); // not tainted
+}
+
+void getNumber(std::shared_ptr<int> ptr) {
+  *ptr = source();
+}
+
+int test_from_issue_5190() {
+  std::shared_ptr<int> p(new int);
+  getNumber(p);
+  sink(*p); // $ MISSING: ast,ir
 }
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
index 09e77c5a3b67..1382552bdcaf 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
@@ -348,7 +348,7 @@ namespace std {
 	class shared_ptr {
 	public:
 		shared_ptr() noexcept;
-		explicit shared_ptr(T*);
+		explicit shared_ptr(T*); shared_ptr(const shared_ptr&) noexcept;
 		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
 		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
 

From 9ff894bf839a098aad951f8d5df23b6f339da14b Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 31 Mar 2021 11:42:09 +0200
Subject: [PATCH 096/433] C++: Add support for AST dataflow out of functions
 that take a smart pointer by value.

---
 .../cpp/dataflow/internal/DataFlowUtil.qll    | 14 ++++
 .../code/cpp/dataflow/internal/FlowVar.qll    | 72 ++++++++++++++++++-
 .../dataflow/internal/TaintTrackingUtil.qll   |  6 +-
 cpp/ql/src/semmle/code/cpp/exprs/Call.qll     |  1 +
 .../dataflow/taint-tests/localTaint.expected  | 22 ++++++
 .../dataflow/taint-tests/smart_pointer.cpp    | 10 +--
 6 files changed, 118 insertions(+), 7 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 0a6d459ec79b..baf5f72b75b6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -199,6 +199,8 @@ class DefinitionByReferenceOrIteratorNode extends PartialDefinitionNode {
       this.getPartialDefinition() instanceof DefinitionByReference
       or
       this.getPartialDefinition() instanceof DefinitionByIterator
+      or
+      this.getPartialDefinition() instanceof DefinitionBySmartPointer
     )
   }
 
@@ -330,6 +332,18 @@ class IteratorPartialDefinitionNode extends PartialDefinitionNode {
   override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
 }
 
+/**
+ * INTERNAL: do not use.
+ *
+ * A synthetic data flow node used for flow into a collection when a smart pointer
+ * write occurs in a callee.
+ */
+class SmartPointerPartialDefinitionNode extends PartialDefinitionNode {
+  override SmartPointerPartialDefinition pd;
+
+  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
+}
+
 /**
  * A post-update node on the `e->f` in `f(&e->f)` (and other forms).
  */
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index f3aa94a79920..21ba4dff36d3 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -7,6 +7,7 @@ private import semmle.code.cpp.controlflow.SSA
 private import semmle.code.cpp.dataflow.internal.SubBasicBlocks
 private import semmle.code.cpp.dataflow.internal.AddressFlow
 private import semmle.code.cpp.models.implementations.Iterator
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
  * A conceptual variable that is assigned only once, like an SSA variable. This
@@ -243,6 +244,54 @@ private module PartialDefinitions {
     }
   }
 
+  class SmartPointerPartialDefinition extends PartialDefinition {
+    Variable pointer;
+    Expr innerDefinedExpr;
+
+    SmartPointerPartialDefinition() {
+      exists(Expr convertedInner |
+        not this instanceof Conversion and
+        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
+        innerDefinedExpr = convertedInner.getUnconverted() and
+        innerDefinedExpr = getAPointerWrapperAccess(pointer)
+      )
+      or
+      // iterators passed by value without a copy constructor
+      exists(Call call |
+        call = node and
+        call.getAnArgument() = innerDefinedExpr and
+        innerDefinedExpr = this and
+        this = getAPointerWrapperAccess(pointer) and
+        not call instanceof OverloadedPointerDereferenceExpr
+      )
+      or
+      // iterators passed by value with a copy constructor
+      exists(Call call, ConstructorCall copy |
+        copy.getTarget() instanceof CopyConstructor and
+        call = node and
+        call.getAnArgument() = copy and
+        copy.getArgument(0) = getAPointerWrapperAccess(pointer) and
+        innerDefinedExpr = this and
+        this = copy and
+        not call instanceof OverloadedPointerDereferenceExpr
+      )
+    }
+
+    deprecated override predicate partiallyDefines(Variable v) { v = pointer }
+
+    deprecated override predicate partiallyDefinesThis(ThisExpr e) { none() }
+
+    override predicate definesExpressions(Expr inner, Expr outer) {
+      inner = innerDefinedExpr and
+      outer = this
+    }
+
+    override predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn) {
+      v = pointer and
+      cfn = node
+    }
+  }
+
   /**
    * A partial definition that's a definition via an output iterator.
    */
@@ -256,6 +305,15 @@ private module PartialDefinitions {
   class DefinitionByReference extends VariablePartialDefinition {
     DefinitionByReference() { exists(Call c | this = c.getAnArgument() or this = c.getQualifier()) }
   }
+
+  /**
+   * A partial definition that's a definition via a smart pointer being passed into a function.
+   */
+  class DefinitionBySmartPointer extends SmartPointerPartialDefinition {
+    DefinitionBySmartPointer() {
+      exists(Call c | this = c.getAnArgument() or this = c.getQualifier())
+    }
+  }
 }
 
 import PartialDefinitions
@@ -296,7 +354,8 @@ module FlowVar_internal {
     // treating them as immutable, but for data flow it gives better results in
     // practice to make the variable synonymous with its contents.
     not v.getUnspecifiedType() instanceof ReferenceType and
-    not v instanceof IteratorParameter
+    not v instanceof IteratorParameter and
+    not v instanceof PointerWrapperParameter
   }
 
   /**
@@ -648,6 +707,8 @@ module FlowVar_internal {
     )
     or
     p instanceof IteratorParameter
+    or
+    p instanceof PointerWrapperParameter
   }
 
   /**
@@ -832,10 +893,19 @@ module FlowVar_internal {
     )
   }
 
+  Call getAPointerWrapperAccess(Variable pointer) {
+    pointer.getUnspecifiedType() instanceof PointerWrapper and
+    [result.getQualifier(), result.getAnArgument()] = pointer.getAnAccess()
+  }
+
   class IteratorParameter extends Parameter {
     IteratorParameter() { this.getUnspecifiedType() instanceof Iterator }
   }
 
+  class PointerWrapperParameter extends Parameter {
+    PointerWrapperParameter() { this.getUnspecifiedType() instanceof PointerWrapper }
+  }
+
   /**
    * Holds if `v` is initialized to have value `assignedExpr`.
    */
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
index 1ef340c4f213..591f461c8eb9 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
@@ -11,6 +11,7 @@
 private import semmle.code.cpp.models.interfaces.DataFlow
 private import semmle.code.cpp.models.interfaces.Taint
 private import semmle.code.cpp.models.interfaces.Iterator
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 private module DataFlow {
   import semmle.code.cpp.dataflow.internal.DataFlowUtil
@@ -141,7 +142,10 @@ private predicate noFlowFromChildExpr(Expr e) {
   or
   e instanceof LogicalOrExpr
   or
-  e instanceof Call
+  // Allow taint from `operator*` on smart pointers.
+  exists(Call call | e = call |
+    not call.getTarget() = any(PointerWrapper wrapper).getAnUnwrapperFunction()
+  )
   or
   e instanceof SizeofOperator
   or
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
index 349efdcee103..6f6f710ac4b3 100644
--- a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
@@ -314,6 +314,7 @@ class OverloadedPointerDereferenceFunction extends Function {
  * T1 operator*(const T2 &);
  * T1 a; T2 b;
  * a = *b;
+ * ```
  */
 class OverloadedPointerDereferenceExpr extends FunctionCall {
   OverloadedPointerDereferenceExpr() {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 4444ea13267f..9b1ad0d4f10a 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3223,24 +3223,30 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
+| smart_pointer.cpp:12:10:12:10 | call to operator* [post update] | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
+| smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:11:18:11 | p | smart_pointer.cpp:18:10:18:10 | call to operator* | TAINT |
 | smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
+| smart_pointer.cpp:24:10:24:10 | call to operator* [post update] | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
+| smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:11:30:11 | p | smart_pointer.cpp:30:10:30:10 | call to operator* | TAINT |
 | smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:37:6:37:6 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:39:11:39:11 | p |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
 | smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
@@ -3251,6 +3257,8 @@
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:45:6:45:6 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
 | smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
@@ -3268,7 +3276,21 @@
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:67:10:67:10 | p |  |
 | smart_pointer.cpp:65:48:65:53 | call to source | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
 | smart_pointer.cpp:65:58:65:58 | 0 | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
+| smart_pointer.cpp:66:10:66:10 | p | smart_pointer.cpp:66:11:66:11 | call to operator-> | TAINT |
 | smart_pointer.cpp:66:10:66:10 | ref arg p | smart_pointer.cpp:67:10:67:10 | p |  |
+| smart_pointer.cpp:67:10:67:10 | p | smart_pointer.cpp:67:11:67:11 | call to operator-> | TAINT |
+| smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:71:4:71:6 | ptr |  |
+| smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
+| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* | TAINT |
+| smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:10:71:15 | call to source | smart_pointer.cpp:71:3:71:17 | ... = ... |  |
+| smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p |  |
+| smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:76:13:76:13 | call to shared_ptr [post update] | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:76:13:76:13 | p | smart_pointer.cpp:76:13:76:13 | call to shared_ptr |  |
+| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* | TAINT |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:39:45:39:51 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:40:11:40:17 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:41:12:41:18 | source1 |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index 1f222cbae3e2..e5d835d3426f 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -35,16 +35,16 @@ void test_reverse_taint_shared() {
     std::shared_ptr<int> p = std::make_shared<int>();
 
     *p = source();
-    sink(p); // $ MISSING: ast,ir
-    sink(*p); // $ MISSING: ast,ir
+    sink(p); // $ ast MISSING: ir
+    sink(*p); // $ ast MISSING: ir
 }
 
 void test_reverse_taint_unique() {
     std::unique_ptr<int> p = std::unique_ptr<int>();
 
     *p = source();
-    sink(p); // $ MISSING: ast,ir
-    sink(*p); // $ MISSING: ast,ir
+    sink(p); // $ ast MISSING: ir
+    sink(*p); // $ ast MISSING: ir
 }
 
 void test_shared_get() {
@@ -74,5 +74,5 @@ void getNumber(std::shared_ptr<int> ptr) {
 int test_from_issue_5190() {
   std::shared_ptr<int> p(new int);
   getNumber(p);
-  sink(*p); // $ MISSING: ast,ir
+  sink(*p); // $ ast MISSING: ir
 }
\ No newline at end of file

From ecbce88ec78710f67c0160f7ae58e58c027fb73c Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 31 Mar 2021 22:23:50 +0200
Subject: [PATCH 097/433] C++: Fix comment.

---
 cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index 21ba4dff36d3..29b6cd691a45 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -256,7 +256,7 @@ private module PartialDefinitions {
         innerDefinedExpr = getAPointerWrapperAccess(pointer)
       )
       or
-      // iterators passed by value without a copy constructor
+      // pointer wrappers passed by value without a copy constructor
       exists(Call call |
         call = node and
         call.getAnArgument() = innerDefinedExpr and
@@ -265,7 +265,7 @@ private module PartialDefinitions {
         not call instanceof OverloadedPointerDereferenceExpr
       )
       or
-      // iterators passed by value with a copy constructor
+      // pointer wrappers passed by value with a copy constructor
       exists(Call call, ConstructorCall copy |
         copy.getTarget() instanceof CopyConstructor and
         call = node and

From 480ce39618efaa47d7a51b43a80a044aca7d6532 Mon Sep 17 00:00:00 2001
From: Luke Cartey <5377966+lcartey@users.noreply.github.com>
Date: Thu, 1 Apr 2021 11:23:31 +0100
Subject: [PATCH 098/433] C#: Exclude jump-to-def information for elements with
 too many locations

In databases which include multiple duplicated files, we can get an
explosion of definition locations that can cause this query to produce
too many results for the CodeQL toolchain. This commit restricts the
definitions.ql query to producing definition/uses for definitions with
fewer than 10 locations. This replicates the logic used in the C++
definitions.qll library which faces similar problems.
---
 csharp/ql/src/definitions.qll | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/csharp/ql/src/definitions.qll b/csharp/ql/src/definitions.qll
index 2004ad0d2187..c1b456f4dbf2 100644
--- a/csharp/ql/src/definitions.qll
+++ b/csharp/ql/src/definitions.qll
@@ -187,5 +187,11 @@ cached
 Declaration definitionOf(Use use, string kind) {
   result = use.getDefinition() and
   result.fromSource() and
-  kind = use.getUseType()
+  kind = use.getUseType() and
+  // Some entities have many locations. This can arise for files that
+  // are duplicated multiple times in the database at different
+  // locations. Rather than letting the result set explode, we just
+  // exclude results that are "too ambiguous" -- we could also arbitrarily
+  // pick one location later on.
+  strictcount(result.getLocation()) < 10
 }

From 32a8b9a857eb66a5b471de771dff380a61654e7b Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 6 Apr 2021 08:56:14 +0200
Subject: [PATCH 099/433] C++: Move copy constructor to its own line and accept
 test changes.

---
 .../dataflow/taint-tests/localTaint.expected  | 238 +++++++++---------
 .../library-tests/dataflow/taint-tests/stl.h  |   3 +-
 2 files changed, 121 insertions(+), 120 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 9b1ad0d4f10a..e10014278187 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3410,125 +3410,125 @@
 | stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
 | stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
 | stl.h:292:53:292:63 | 0 | stl.h:292:46:292:64 | (no string representation) | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:6 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:36:395:43 | call to unknown function | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:46:395:54 | call to unknown function | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:6 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:36:396:43 | call to unknown function | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:46:396:54 | call to unknown function | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
 | string.cpp:25:12:25:17 | call to source | string.cpp:29:7:29:7 | a |  |
 | string.cpp:26:16:26:20 | 123 | string.cpp:26:16:26:21 | call to basic_string | TAINT |
 | string.cpp:26:16:26:21 | call to basic_string | string.cpp:30:7:30:7 | b |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
index 1382552bdcaf..44550c3df768 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
@@ -348,7 +348,8 @@ namespace std {
 	class shared_ptr {
 	public:
 		shared_ptr() noexcept;
-		explicit shared_ptr(T*); shared_ptr(const shared_ptr&) noexcept;
+		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
 		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
 		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
 

From 8e11abca40b0b60a590bc9e245917d5796b72fd3 Mon Sep 17 00:00:00 2001
From: Taus Brock-Nannestad <tausbn@github.com>
Date: Tue, 6 Apr 2021 17:39:41 +0200
Subject: [PATCH 100/433] Revert "Merge pull request #5552 from
 RasmusWL/revert-import-change"

This reverts commit 49d1937dc42ed2afe51a82191deec05e9f58ac12, reversing
changes made to d4877a9038ae9d94b35d4a543d38599802b3f934.
---
 python/ql/src/semmle/python/Files.qll         | 30 +++++++++++++++++++
 python/ql/src/semmle/python/Module.qll        |  7 ++++-
 .../modules/entry_point/hash_bang/main.py     |  7 +++++
 .../modules/entry_point/hash_bang/module.py   |  2 ++
 .../namespace_package_main.py                 |  2 ++
 .../namespace_package_module.py               |  1 +
 .../entry_point/hash_bang/package/__init__.py |  2 ++
 .../hash_bang/package/package_main.py         |  2 ++
 .../hash_bang/package/package_module.py       |  1 +
 .../modules/entry_point/modules.expected      | 16 ++++++++++
 .../modules/entry_point/modules.ql            |  4 +++
 .../modules/entry_point/name_main/main.py     |  8 +++++
 .../modules/entry_point/name_main/module.py   |  2 ++
 .../namespace_package_main.py                 |  2 ++
 .../namespace_package_module.py               |  1 +
 .../entry_point/name_main/package/__init__.py |  2 ++
 .../name_main/package/package_main.py         |  2 ++
 .../name_main/package/package_module.py       |  1 +
 .../entry_point/no_py_extension/main.secretpy |  6 ++++
 .../entry_point/no_py_extension/module.py     |  2 ++
 .../namespace_package_main.py                 |  2 ++
 .../namespace_package_module.py               |  1 +
 .../no_py_extension/package/__init__.py       |  2 ++
 .../no_py_extension/package/package_main.py   |  2 ++
 .../no_py_extension/package/package_module.py |  1 +
 .../library-tests/modules/entry_point/options |  1 +
 26 files changed, 108 insertions(+), 1 deletion(-)
 create mode 100755 python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/modules.expected
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/modules.ql
 create mode 100755 python/ql/test/3/library-tests/modules/entry_point/name_main/main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py
 create mode 100755 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py
 create mode 100644 python/ql/test/3/library-tests/modules/entry_point/options

diff --git a/python/ql/src/semmle/python/Files.qll b/python/ql/src/semmle/python/Files.qll
index ef6484fbdc6e..83ba92f0abcc 100644
--- a/python/ql/src/semmle/python/Files.qll
+++ b/python/ql/src/semmle/python/Files.qll
@@ -72,6 +72,33 @@ class File extends Container {
    * are specified to be extracted.
    */
   string getContents() { file_contents(this, result) }
+
+  /** Holds if this file is likely to get executed directly, and thus act as an entry point for execution. */
+  predicate maybeExecutedDirectly() {
+    // Only consider files in the source code, and not things like the standard library
+    exists(this.getRelativePath()) and
+    (
+      // The file doesn't have the extension `.py` but still contains Python statements
+      not this.getExtension().matches("py%") and
+      exists(Stmt s | s.getLocation().getFile() = this)
+      or
+      // The file contains the usual `if __name__ == '__main__':` construction
+      exists(If i, Name name, StrConst main, Cmpop op |
+        i.getScope().(Module).getFile() = this and
+        op instanceof Eq and
+        i.getTest().(Compare).compares(name, op, main) and
+        name.getId() = "__name__" and
+        main.getText() = "__main__"
+      )
+      or
+      // The file contains a `#!` line referencing the python interpreter
+      exists(Comment c |
+        c.getLocation().getFile() = this and
+        c.getLocation().getStartLine() = 1 and
+        c.getText().regexpMatch("^#! */.*python(2|3)?[ \\\\t]*$")
+      )
+    )
+  }
 }
 
 private predicate occupied_line(File f, int n) {
@@ -121,6 +148,9 @@ class Folder extends Container {
     this.getBaseName().regexpMatch("[^\\d\\W]\\w*") and
     result = this.getParent().getImportRoot(n)
   }
+
+  /** Holds if execution may start in a file in this directory. */
+  predicate mayContainEntryPoint() { any(File f | f.getParent() = this).maybeExecutedDirectly() }
 }
 
 /**
diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index fcf1c0b29252..8a420a800ea6 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -204,8 +204,13 @@ private string moduleNameFromBase(Container file) {
 string moduleNameFromFile(Container file) {
   exists(string basename |
     basename = moduleNameFromBase(file) and
-    legalShortName(basename) and
+    legalShortName(basename)
+  |
     result = moduleNameFromFile(file.getParent()) + "." + basename
+    or
+    // If execution can start in the folder containing this module, then we will assume `file` can
+    // be imported as an absolute import, and hence return `basename` as a possible name.
+    file.getParent().(Folder).mayContainEntryPoint() and result = basename
   )
   or
   isPotentialSourcePackage(file) and
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py
new file mode 100755
index 000000000000..ad619e5cbd83
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py
@@ -0,0 +1,7 @@
+#! /usr/bin/python3
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py
new file mode 100644
index 000000000000..36206ca60b75
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py
new file mode 100644
index 000000000000..5db80f18a278
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py
new file mode 100644
index 000000000000..ca14a9f5804e
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py
new file mode 100644
index 000000000000..158b12678e3b
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.expected b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
new file mode 100644
index 000000000000..e5f6b300074c
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
@@ -0,0 +1,16 @@
+| main | hash_bang/main.py:0:0:0:0 | Script main |
+| main | name_main/main.py:0:0:0:0 | Module main |
+| module | hash_bang/module.py:0:0:0:0 | Module module |
+| module | name_main/module.py:0:0:0:0 | Module module |
+| package | hash_bang/package:0:0:0:0 | Package package |
+| package | name_main/package:0:0:0:0 | Package package |
+| package | no_py_extension/package:0:0:0:0 | Package package |
+| package.__init__ | hash_bang/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.__init__ | name_main/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.__init__ | no_py_extension/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.package_main | hash_bang/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_main | name_main/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_main | no_py_extension/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_module | hash_bang/package/package_module.py:0:0:0:0 | Module package.package_module |
+| package.package_module | name_main/package/package_module.py:0:0:0:0 | Module package.package_module |
+| package.package_module | no_py_extension/package/package_module.py:0:0:0:0 | Module package.package_module |
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.ql b/python/ql/test/3/library-tests/modules/entry_point/modules.ql
new file mode 100644
index 000000000000..10c390e8616c
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.ql
@@ -0,0 +1,4 @@
+import python
+
+from Module m
+select m.getName(), m
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py
new file mode 100755
index 000000000000..08ec212383bb
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py
@@ -0,0 +1,8 @@
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+
+if __name__ == '__main__':
+   print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py
new file mode 100644
index 000000000000..36206ca60b75
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py
new file mode 100644
index 000000000000..5db80f18a278
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py
new file mode 100644
index 000000000000..ca14a9f5804e
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py
new file mode 100644
index 000000000000..158b12678e3b
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy
new file mode 100755
index 000000000000..e2673d4da786
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy
@@ -0,0 +1,6 @@
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py
new file mode 100644
index 000000000000..36206ca60b75
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py
new file mode 100644
index 000000000000..5db80f18a278
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py
new file mode 100644
index 000000000000..ca14a9f5804e
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py
new file mode 100644
index 000000000000..158b12678e3b
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py
new file mode 100644
index 000000000000..567a23d59ce3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/options b/python/ql/test/3/library-tests/modules/entry_point/options
new file mode 100644
index 000000000000..6beceeb08ed0
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/options
@@ -0,0 +1 @@
+semmle-extractor-options: --lang=3 --path bogus -R . --filter=include:**/*.secretpy

From b44db460f613164309f6d8f0726f8b1f2658edb6 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Tue, 6 Apr 2021 19:55:43 +0000
Subject: [PATCH 101/433] Python: Only track modules that are imported

---
 python/ql/src/semmle/python/Module.qll        | 21 ++++++++++++++++---
 .../modules/entry_point/modules.expected      |  2 --
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index 8a420a800ea6..48d0e9e1a3d9 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -201,6 +201,20 @@ private string moduleNameFromBase(Container file) {
   file instanceof File and result = file.getStem()
 }
 
+/**
+ * Holds if `file` may be transitively imported from a file that may serve as the entry point of
+ * the execution.
+ */
+private predicate transitively_imported_from_entry_point(File file) {
+  file.getExtension().matches("%py%") and
+  exists(File importer |
+    importer.getParent() = file.getParent() and
+    exists(ImportExpr i | i.getLocation().getFile() = importer and i.getName() = file.getStem())
+  |
+    importer.maybeExecutedDirectly() or transitively_imported_from_entry_point(importer)
+  )
+}
+
 string moduleNameFromFile(Container file) {
   exists(string basename |
     basename = moduleNameFromBase(file) and
@@ -208,9 +222,10 @@ string moduleNameFromFile(Container file) {
   |
     result = moduleNameFromFile(file.getParent()) + "." + basename
     or
-    // If execution can start in the folder containing this module, then we will assume `file` can
-    // be imported as an absolute import, and hence return `basename` as a possible name.
-    file.getParent().(Folder).mayContainEntryPoint() and result = basename
+    // If `file` is a transitive import of a file that's executed directly, we allow references
+    // to it by its `basename`.
+    transitively_imported_from_entry_point(file) and
+    result = basename
   )
   or
   isPotentialSourcePackage(file) and
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.expected b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
index e5f6b300074c..cdc743a360d1 100644
--- a/python/ql/test/3/library-tests/modules/entry_point/modules.expected
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
@@ -1,5 +1,3 @@
-| main | hash_bang/main.py:0:0:0:0 | Script main |
-| main | name_main/main.py:0:0:0:0 | Module main |
 | module | hash_bang/module.py:0:0:0:0 | Module module |
 | module | name_main/module.py:0:0:0:0 | Module module |
 | package | hash_bang/package:0:0:0:0 | Package package |

From 43ae7462b44b4fc9561ee1cc6c246507e32b04c0 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Tue, 6 Apr 2021 19:55:43 +0000
Subject: [PATCH 102/433] Python: Only track modules that are imported

This greatly restricts the set of modules that have a new name under
this scheme.

One change to the tests was needed, which reflects the fact that the
two `main.py` files no longer have the name `main` (which makes sense,
since they're never imported under this name).
---
 python/ql/src/semmle/python/Module.qll        | 21 ++++++++++++++++---
 .../modules/entry_point/modules.expected      |  2 --
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index 8a420a800ea6..48d0e9e1a3d9 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -201,6 +201,20 @@ private string moduleNameFromBase(Container file) {
   file instanceof File and result = file.getStem()
 }
 
+/**
+ * Holds if `file` may be transitively imported from a file that may serve as the entry point of
+ * the execution.
+ */
+private predicate transitively_imported_from_entry_point(File file) {
+  file.getExtension().matches("%py%") and
+  exists(File importer |
+    importer.getParent() = file.getParent() and
+    exists(ImportExpr i | i.getLocation().getFile() = importer and i.getName() = file.getStem())
+  |
+    importer.maybeExecutedDirectly() or transitively_imported_from_entry_point(importer)
+  )
+}
+
 string moduleNameFromFile(Container file) {
   exists(string basename |
     basename = moduleNameFromBase(file) and
@@ -208,9 +222,10 @@ string moduleNameFromFile(Container file) {
   |
     result = moduleNameFromFile(file.getParent()) + "." + basename
     or
-    // If execution can start in the folder containing this module, then we will assume `file` can
-    // be imported as an absolute import, and hence return `basename` as a possible name.
-    file.getParent().(Folder).mayContainEntryPoint() and result = basename
+    // If `file` is a transitive import of a file that's executed directly, we allow references
+    // to it by its `basename`.
+    transitively_imported_from_entry_point(file) and
+    result = basename
   )
   or
   isPotentialSourcePackage(file) and
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.expected b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
index e5f6b300074c..cdc743a360d1 100644
--- a/python/ql/test/3/library-tests/modules/entry_point/modules.expected
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
@@ -1,5 +1,3 @@
-| main | hash_bang/main.py:0:0:0:0 | Script main |
-| main | name_main/main.py:0:0:0:0 | Module main |
 | module | hash_bang/module.py:0:0:0:0 | Module module |
 | module | name_main/module.py:0:0:0:0 | Module module |
 | package | hash_bang/package:0:0:0:0 | Package package |

From acf8fd0f038aaafed40c7d3e8643024dcc2a8f97 Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Tue, 6 Apr 2021 22:45:03 +0200
Subject: [PATCH 103/433] Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 .../src/Security/CWE-327/FluentApiModel.qll   | 22 ++++++++----------
 python/ql/src/Security/CWE-327/Ssl.qll        | 23 ++++---------------
 .../src/Security/CWE-327/TlsLibraryModel.qll  |  2 +-
 3 files changed, 16 insertions(+), 31 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 803b7adab40e..c6836ba60579 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -3,7 +3,8 @@ import TlsLibraryModel
 
 /**
  * Configuration to determine the state of a context being used to create
- * a conection.
+ * a conection. There is one configuration for each pair of `TlsLibrary` and `ProtocolVersion`,
+ * such that a single configuration only tracks contexts where a specific `ProtocolVersion` is allowed.
  *
  * The state is in terms of whether a specific protocol is allowed. This is
  * either true or false when the context is created and can then be modified
@@ -72,20 +73,18 @@ predicate unsafe_connection_creation_with_context(
   boolean specific
 ) {
   // Connection created from a context allowing `insecure_version`.
-  exists(InsecureContextConfiguration c, ProtocolUnrestriction co |
-    c.hasFlow(co, connectionCreation)
+  exists(InsecureContextConfiguration c |
+    c.hasFlow(contextOrigin, connectionCreation)
   |
     insecure_version = c.getTrackedVersion() and
-    contextOrigin = co and
+    contextOrigin instanceof ProtocolUnrestriction and
     specific = false
   )
   or
   // Connection created from a context specifying `insecure_version`.
-  exists(TlsLibrary l, DataFlow::CfgNode cc |
-    cc = l.insecure_connection_creation(insecure_version)
-  |
-    connectionCreation = cc and
-    contextOrigin = cc and
+  exists(TlsLibrary l |
+    connectionCreation = l.insecure_connection_creation(insecure_version) and
+    contextOrigin = connectionCreation and
     specific = true
   )
 }
@@ -105,7 +104,6 @@ predicate unsafe_connection_creation_without_context(
 
 /** Holds if `contextCreation` is creating a context ties to a specific insecure version. */
 predicate unsafe_context_creation(DataFlow::CallCfgNode contextCreation, string insecure_version) {
-  exists(TlsLibrary l, ContextCreation cc | cc = l.insecure_context_creation(insecure_version) |
-    contextCreation = cc
-  )
+  contextCreation instanceof ContextCreation and
+  exists(TlsLibrary l | contextCreation = l.insecure_context_creation(insecure_version))
 }
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 928a5f74e2d3..9def499fb118 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -23,30 +23,17 @@ class SSLDefaultContextCreation extends ContextCreation {
 }
 
 /** Gets a reference to an `ssl.Context` instance. */
-private DataFlow::LocalSourceNode sslContextInstance(DataFlow::TypeTracker t) {
-  t.start() and
-  result = API::moduleImport("ssl").getMember(["SSLContext", "create_default_context"]).getACall()
-  or
-  exists(DataFlow::TypeTracker t2 | result = sslContextInstance(t2).track(t2, t))
-}
-
-/** Gets a reference to an `ssl.Context` instance. */
-DataFlow::Node sslContextInstance() {
-  sslContextInstance(DataFlow::TypeTracker::end()).flowsTo(result)
+API::Node sslContextInstance() {
+  result = API::moduleImport("ssl").getMember(["SSLContext", "create_default_context"]).getReturn()
 }
 
-class WrapSocketCall extends ConnectionCreation {
-  override CallNode node;
-
+class WrapSocketCall extends ConnectionCreation, DataFlow::CallCfgNode {
   WrapSocketCall() {
-    exists(DataFlow::AttrRead call | node.getFunction() = call.asCfgNode() |
-      call.getAttributeName() = "wrap_socket" and
-      call.getObject() = sslContextInstance()
-    )
+    this = sslContextInstance().getMember("wrap_socket").getACall()
   }
 
   override DataFlow::CfgNode getContext() {
-    result.getNode() = node.getFunction().(AttrNode).getObject()
+    result = this.getFunction().(DataFlow::AttrRead).getObject()
   }
 }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 245a60b02955..73ab52be8070 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -84,7 +84,7 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
   }
 }
 
-/** A model of a TLS library. */
+/** A model of a SSL/TLS library. */
 abstract class TlsLibrary extends string {
   TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
 

From 062668444220f9b00476c92df3dd1c6b52b33148 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 6 Apr 2021 22:55:32 +0200
Subject: [PATCH 104/433] Python: small cleanups enabled by review

---
 python/ql/src/Security/CWE-327/FluentApiModel.qll | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index c6836ba60579..652a4bae2a10 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -3,7 +3,7 @@ import TlsLibraryModel
 
 /**
  * Configuration to determine the state of a context being used to create
- * a conection. There is one configuration for each pair of `TlsLibrary` and `ProtocolVersion`,
+ * a connection. There is one configuration for each pair of `TlsLibrary` and `ProtocolVersion`,
  * such that a single configuration only tracks contexts where a specific `ProtocolVersion` is allowed.
  *
  * The state is in terms of whether a specific protocol is allowed. This is
@@ -73,11 +73,8 @@ predicate unsafe_connection_creation_with_context(
   boolean specific
 ) {
   // Connection created from a context allowing `insecure_version`.
-  exists(InsecureContextConfiguration c |
-    c.hasFlow(contextOrigin, connectionCreation)
-  |
+  exists(InsecureContextConfiguration c | c.hasFlow(contextOrigin, connectionCreation) |
     insecure_version = c.getTrackedVersion() and
-    contextOrigin instanceof ProtocolUnrestriction and
     specific = false
   )
   or
@@ -104,6 +101,5 @@ predicate unsafe_connection_creation_without_context(
 
 /** Holds if `contextCreation` is creating a context ties to a specific insecure version. */
 predicate unsafe_context_creation(DataFlow::CallCfgNode contextCreation, string insecure_version) {
-  contextCreation instanceof ContextCreation and
   exists(TlsLibrary l | contextCreation = l.insecure_context_creation(insecure_version))
 }

From a44490b47053f6b7339a1c26b01070dfa878d73c Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 6 Apr 2021 22:56:07 +0200
Subject: [PATCH 105/433] Python: remove unused file

---
 .../src/Security/CWE-327/examples/secure_protocol.py  | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 python/ql/src/Security/CWE-327/examples/secure_protocol.py

diff --git a/python/ql/src/Security/CWE-327/examples/secure_protocol.py b/python/ql/src/Security/CWE-327/examples/secure_protocol.py
deleted file mode 100644
index e349bdae832d..000000000000
--- a/python/ql/src/Security/CWE-327/examples/secure_protocol.py
+++ /dev/null
@@ -1,11 +0,0 @@
-import socket
-import ssl
-
-hostname = 'www.python.org'
-context = ssl.SSLContext(ssl.PROTOCOL_TLS)
-context.options |= ssl.OP_NO_TLSv1
-context.options |= ssl.OP_NO_TLSv1_1
-
-with socket.create_connection((hostname, 443)) as sock:
-    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-        print(ssock.version())

From 094d2f3b7d3d628b7e1a8e7d3999f6ce235bb642 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 6 Apr 2021 22:59:58 +0200
Subject: [PATCH 106/433] Python: clean up tests

---
 .../Security/CWE-327/ssl_fluent.py            | 59 ++-----------------
 1 file changed, 6 insertions(+), 53 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index ceddaa32f091..0f7620f21ea1 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -56,58 +56,11 @@ def test_fluent_ssl():
             print(ssock.version())
 
 
-def test_fluent_ssl_no_TLSv1():
-    hostname = 'www.python.org'
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-    context.options |= ssl.OP_NO_TLSv1
-
-    with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-            print(ssock.version())
-
-def test_fluent_ssl_safe():
-    hostname = 'www.python.org'
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-    context.options |= ssl.OP_NO_TLSv1
-    context.options |= ssl.OP_NO_TLSv1_1
-
-    with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-            print(ssock.version())
-
-def test_fluent_ssl_safe_combined():
-    hostname = 'www.python.org'
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
-
-    with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-            print(ssock.version())
-
-def test_fluent_ssl_unsafe_combined_wrongly():
-    hostname = 'www.python.org'
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-    context.options |= ssl.OP_NO_TLSv1 & ssl.OP_NO_TLSv1_1
-
-    with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-            print(ssock.version())
-
-def test_fluent_ssl_safe_combined_multiple():
-    hostname = 'www.python.org'
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1_2
-
-    with socket.create_connection((hostname, 443)) as sock:
-        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-            print(ssock.version())
-
-
 def create_relaxed_context():
-    return ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    return ssl.SSLContext(ssl.PROTOCOL_TLS)
 
 def create_secure_context():
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
     context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
     return context
 
@@ -143,21 +96,21 @@ def test_delegated_context_made_unsafe():
             print(ssock.version())
 
 def test_delegated_connection_unsafe():
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
     create_connection(context)
 
 def test_delegated_connection_safe():
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
     context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
     create_connection(context)
 
 def test_delegated_connection_made_safe():
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
     context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
     create_connection(context)
 
 def test_delegated_connection_made_unsafe():
-    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
     context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
     context.options &= ~ssl.OP_NO_TLSv1_1
     create_connection(context)

From fb95c488e8854e816ef8da12450ad262b47867a7 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 7 Apr 2021 08:20:52 +0200
Subject: [PATCH 107/433] Python: format

---
 python/ql/src/Security/CWE-327/Ssl.qll | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 9def499fb118..26928e31cb0b 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -28,9 +28,7 @@ API::Node sslContextInstance() {
 }
 
 class WrapSocketCall extends ConnectionCreation, DataFlow::CallCfgNode {
-  WrapSocketCall() {
-    this = sslContextInstance().getMember("wrap_socket").getACall()
-  }
+  WrapSocketCall() { this = sslContextInstance().getMember("wrap_socket").getACall() }
 
   override DataFlow::CfgNode getContext() {
     result = this.getFunction().(DataFlow::AttrRead).getObject()

From a0e3e3afaf2456f9ad80c9fd9d639c2daecb1373 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 7 Apr 2021 08:22:36 +0200
Subject: [PATCH 108/433] Python: adjust test expectations

---
 .../CWE-327/InsecureProtocol.expected         | 29 +++++++++----------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index f4cd96eb82e2..57b19cef0b17 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -24,19 +24,16 @@
 | ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:33:15:33:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:65:14:65:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:61:15:61:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:93:14:93:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:89:15:89:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:93:14:93:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:89:15:89:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:146:15:146:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:146:15:146:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:116:14:116:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:180:5:180:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:122:14:122:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:122:14:122:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:107:12:107:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:142:14:142:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:140:5:140:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:191:14:191:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:188:5:188:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:207:5:207:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:206:15:206:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
-| ssl_fluent.py:210:14:210:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:206:15:206:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:99:15:99:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:99:15:99:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:115:5:115:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:133:5:133:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:95:14:95:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:93:5:93:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:144:14:144:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:141:5:141:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:160:5:160:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:159:15:159:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:159:15:159:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |

From f22db2a30b305ba15019fb77463e42c2022cfe86 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 7 Apr 2021 08:32:21 +0200
Subject: [PATCH 109/433] Python: One family to rule them all...

---
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 73ab52be8070..82c251f3f810 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -71,15 +71,10 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
   override DataFlow::CfgNode getContext() { result = this }
 
   override ProtocolVersion getUnrestriction() {
-    // see https://www.openssl.org/docs/man1.1.0/man3/TLS_method.html
-    family = "TLS" and
-    result in ["SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
-    or
-    // This can negotiate a TLS 1.3 connection (!)
-    // see
-    // - https://docs.python.org/3/library/ssl.html#ssl-contexts
-    // - https://www.openssl.org/docs/man1.0.2/man3/TLSv1_method.html
-    family = "SSLv23" and
+    // There is only one family, the two names are aliases in OpenSSL.
+    // see https://github.com/openssl/openssl/blob/13888e797c5a3193e91d71e5f5a196a2d68d266f/include/openssl/ssl.h.in#L1953-L1955
+    family in ["SSLv23", "TLS"] and
+    // see https://docs.python.org/3/library/ssl.html#ssl-contexts
     result in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }
 }

From a006a92f8dd93e5503108e02762188f63fad288b Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 7 Apr 2021 08:32:40 +0200
Subject: [PATCH 110/433] Python: Expand commentary

---
 python/ql/src/Security/CWE-327/Ssl.qll | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 26928e31cb0b..fc4d13bffae9 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -141,13 +141,15 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
   UnspecificSSLContextCreation() { library = "ssl" }
 
   override ProtocolVersion getUnrestriction() {
+    // Case: A protocol argument is present.
     result = UnspecificContextCreation.super.getUnrestriction() and
     // These are turned off by default
     // see https://docs.python.org/3/library/ssl.html#ssl-contexts
     not result in ["SSLv2", "SSLv3"]
     or
-    // The default argument is TLS and the SSL versions are turned off by default.
+    // Case: No protocol arguemnt is present.
     not exists(this.getProtocol()) and
+    // The default argument is TLS and the SSL versions are turned off by default.
     result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }
 }

From 9c3b7e81c7c8b6ed00ef22f3e43485e777e9d7f3 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Tue, 6 Apr 2021 10:31:06 +0300
Subject: [PATCH 111/433] Add files via upload

---
 ...trolFlowManagementWhenUsingBitOperations.c |  4 +
 ...FlowManagementWhenUsingBitOperations.qhelp | 28 +++++++
 ...rolFlowManagementWhenUsingBitOperations.ql | 80 +++++++++++++++++++
 3 files changed, 112 insertions(+)
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c
new file mode 100644
index 000000000000..276318431186
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c
@@ -0,0 +1,4 @@
+if(len>0 & memset(buf,0,len)) return 1; // BAD: `memset` will be called regardless of the value of the `len` variable. moreover, one cannot be sure that it will happen after verification
+...
+if(len>0 && memset(buf,0,len)) return 1; // GOOD: `memset` will be called after the `len` variable has been checked.
+...
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp
new file mode 100644
index 000000000000..f49d5a4fe78f
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using bitwise operations can be a mistake in some situations. For example, if parameters are evaluated in an expression and the function should be called only upon certain test results. These bitwise operations look suspicious and require developer attention.</p>
+
+
+</overview>
+<recommendation>
+
+<p>We recommend that you evaluate the correctness of using the specified bit operations.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates the erroneous and fixed use of bit and logical operations.</p>
+<sample src="InsufficientControlFlowManagementWhenUsingBitOperations.c" />
+
+</example>
+<references>
+
+<li>
+  CWE Common Weakness Enumeration:
+  <a href="https://cwe.mitre.org/data/definitions/691.html"> CWE-691: Insufficient Control Flow Management</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
new file mode 100644
index 000000000000..a599fc19fde3
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -0,0 +1,80 @@
+/**
+ * @name Errors When Using Bit Operations
+ * @description --Using bitwise operations can be a mistake in some situations.
+ *              --For example, if parameters are evaluated in an expression and the function should be called only upon certain test results.
+ *              --These bitwise operations look suspicious and require developer attention.
+ * @kind problem
+ * @id cpp/errors-when-using-bit-operations
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-691
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+/**
+ * Dangerous uses of bit operations.
+ * For example: `if(intA>0 & intA<10 & charBuf&myFunc(charBuf[intA]))`.
+ * In this case, the function will be called in any case, and even the sequence of the call is not guaranteed.
+ */
+class DangerousBitOperations extends Expr {
+  FunctionCall bfc;
+
+  /**
+   * The assignment indicates the conscious use of the bit operator.
+   * Use in comparison, conversion, or return value indicates conscious use of the bit operator.
+   * The use of shifts and bitwise operations on any element of an expression indicates a conscious use of the bitwise operator.
+   */
+  DangerousBitOperations() {
+    bfc = this.(BinaryBitwiseOperation).getRightOperand() and
+    not this.getParent*() instanceof AssignExpr and
+    not this.getParent*() instanceof Initializer and
+    not this.getParent*() instanceof ReturnStmt and
+    not this.getParent*() instanceof EqualityOperation and
+    not this.getParent*() instanceof UnaryLogicalOperation and
+    not this.getParent*() instanceof BinaryLogicalOperation and
+    not this.(BinaryBitwiseOperation).getAChild*() instanceof BitwiseXorExpr and
+    not this.(BinaryBitwiseOperation).getAChild*() instanceof LShiftExpr and
+    not this.(BinaryBitwiseOperation).getAChild*() instanceof RShiftExpr
+  }
+
+  /** Holds when part of a bit expression is used in a logical operation. */
+  predicate useInLogicalOperations() {
+    exists(BinaryLogicalOperation blop, Expr exp |
+      blop.getAChild*() = exp and
+      exp.(FunctionCall).getTarget() = bfc.getTarget() and
+      not exp.getParent() instanceof ComparisonOperation and
+      not exp.getParent() instanceof BinaryBitwiseOperation
+    )
+  }
+
+  /** Holds when part of a bit expression is used as part of another supply. For example, as an argument to another function. */
+  predicate useInOtherCalls() {
+    bfc.hasQualifier() or
+    bfc.getTarget() instanceof Operator or
+    exists(FunctionCall fc | fc.getAnArgument().getAChild*() = this) or
+    bfc.getTarget() instanceof BuiltInFunction
+  }
+
+  /** Holds when the bit expression contains both arguments and a function call. */
+  predicate dangerousArgumentChecking() {
+    not this.(BinaryBitwiseOperation).getLeftOperand() instanceof Call and
+    globalValueNumber(this.(BinaryBitwiseOperation).getLeftOperand().getAChild*()) =
+      globalValueNumber(bfc.getAnArgument())
+  }
+
+  /** Holds when function calls are present in the bit expression. */
+  predicate functionCallsInBitsExpression() {
+    this.(BinaryBitwiseOperation).getLeftOperand().getAChild*() instanceof FunctionCall
+  }
+}
+
+from DangerousBitOperations dbo
+where
+  not dbo.useInOtherCalls() and
+  dbo.useInLogicalOperations() and
+  (not dbo.functionCallsInBitsExpression() or dbo.dangerousArgumentChecking())
+select dbo, "this bit expression needs your attention"

From ed2a8db8c9e4b5e60032b97ad2028e4342459200 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Tue, 6 Apr 2021 10:32:05 +0300
Subject: [PATCH 112/433] Add files via upload

---
 ...wManagementWhenUsingBitOperations.expected |  2 ++
 ...FlowManagementWhenUsingBitOperations.qlref |  1 +
 .../Security/CWE/CWE-691/semmle/tests/test.c  | 28 +++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
new file mode 100644
index 000000000000..6aa02a61eaf6
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
@@ -0,0 +1,2 @@
+| test.c:8:6:8:51 | ... & ... | this bit expression needs your attention |
+| test.c:10:6:10:30 | ... & ... | this bit expression needs your attention |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
new file mode 100644
index 000000000000..9bf28db3c8a8
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
new file mode 100644
index 000000000000..fc30f7a6e97e
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -0,0 +1,28 @@
+int tmpFunction(){
+  return 5;
+}
+void workFunction_0(char *s) {
+  int intSize;
+  char buf[80];
+  if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD
+  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD
+  if(intSize>0 && tmpFunction()) return;
+  if(intSize<0 & tmpFunction()) return; // BAD
+}
+void workFunction_1(char *s) {
+  int intA,intB;
+
+  if(intA + intB) return; // BAD
+  if(intA + intB>4) return; // GOOD
+  if(intA>0 && (intA + intB)) return; // BAD
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  }while(intA>0); // BAD
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  } // GOOD
+}

From 36de496d47b6fb95058920cb3cf7412a5001af95 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Tue, 6 Apr 2021 10:35:28 +0300
Subject: [PATCH 113/433] Add files via upload

---
 ...rolFlowManagementAfterRefactoringTheCode.c |  17 +++
 ...lowManagementAfterRefactoringTheCode.qhelp |  28 +++++
 ...olFlowManagementAfterRefactoringTheCode.ql | 118 ++++++++++++++++++
 3 files changed, 163 insertions(+)
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
new file mode 100644
index 000000000000..3ba47068244d
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
@@ -0,0 +1,17 @@
+while(flagsLoop)
+{
+  ...
+  if(flagsIf) break;
+  ...
+}while(flagsLoop); // BAD: when exiting through `break`, it is possible to get into an eternal loop.
+...
+while(flagsLoop)
+{
+  ...
+  if(flagsIf) break;
+  ...
+} // GOOD: coreten cycle
+...
+if(intA+intB) return 1; // BAD: possibly no comparison
+...
+if(intA+intB>intC) return 1; // GOOD: correct comparison
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
new file mode 100644
index 000000000000..2c485dfd0cf4
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>In some situations, after code refactoring, parts of the old constructs may remain. They are correctly accepted by the compiler, but can critically affect program execution. For example, if you switch from `do {...} while ();` to `while () {...}` with errors, you run the risk of running out of resources. These code snippets look suspicious and require the developer's attention.</p>
+
+
+</overview>
+<recommendation>
+
+<p>We recommend that you use more explicit code transformations.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates the erroneous and corrected sections of the code.</p>
+<sample src="InsufficientControlFlowManagementAfterRefactoringTheCode.c" />
+
+</example>
+<references>
+
+<li>
+  CWE Common Weakness Enumeration:
+  <a href="https://cwe.mitre.org/data/definitions/691.html"> CWE-691: Insufficient Control Flow Management</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
new file mode 100644
index 000000000000..6b9639fe8b9b
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
@@ -0,0 +1,118 @@
+/**
+ * @name Errors After Refactoring
+ * @description --In some situations, after code refactoring, parts of the old constructs may remain.
+ *              --They are correctly accepted by the compiler, but can critically affect program execution.
+ *              --For example, if you switch from `do {...} while ();` to `while () {...}` with errors, you run the risk of running out of resources.
+ *              --These code snippets look suspicious and require the developer's attention.
+ * @kind problem
+ * @id cpp/errors-after-refactoring
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-691
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.HashCons
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+/**
+ * Using `while` directly after the body of another` while`.
+ */
+class UsingWhileAfterWhile extends WhileStmt {
+  /**
+   * Using a loop call after another loop has finished running can result in an eternal loop.
+   * For example, perhaps as a result of refactoring, the `do ... while ()` loop was incorrectly corrected.
+   * Even in the case of deliberate use of such an expression, it is better to correct it.
+   */
+  UsingWhileAfterWhile() {
+    exists(WhileStmt wh1 |
+      wh1.getStmt().getAChild*().(BreakStmt).(ControlFlowNode).getASuccessor().getASuccessor() =
+        this and
+      hashCons(wh1.getCondition()) = hashCons(this.getCondition()) and
+      this.getStmt() instanceof EmptyStmt
+    )
+    or
+    exists(ForStmt fr1 |
+      fr1.getStmt().getAChild*().(BreakStmt).(ControlFlowNode).getASuccessor().getASuccessor() =
+        this and
+      hashCons(fr1.getCondition()) = hashCons(this.getCondition()) and
+      this.getStmt() instanceof EmptyStmt
+    )
+  }
+}
+
+/**
+ * Using arithmetic in comparison.
+ */
+class UsingArithmeticInComparison extends BinaryArithmeticOperation {
+  /**
+   * Using arithmetic operations in a comparison operation can be dangerous.
+   * For example, part of the comparison may have been lost as a result of refactoring.
+   * Even if you deliberately use such an expression, it is better to add an explicit comparison.
+   */
+  UsingArithmeticInComparison() {
+    this.getParent*() instanceof IfStmt and
+    not this.getAChild*().isConstant() and
+    not this.getParent*() instanceof Call and
+    not this.getParent*() instanceof AssignExpr and
+    not this.getParent*() instanceof RemExpr and
+    not this.getParent*() instanceof AssignBitwiseOperation and
+    not this.getParent*() instanceof AssignArithmeticOperation and
+    not this.getParent*() instanceof EqualityOperation and
+    not this.getParent*() instanceof RelationalOperation
+  }
+
+  /** Holds when the expression is inside the loop body. */
+  predicate insideTheLoop() { exists(Loop lp | lp.getStmt().getAChild*() = this.getParent*()) }
+
+  /** Holds when the expression is used in binary operations. */
+  predicate workingWithValue() {
+    this.getParent*() instanceof BinaryBitwiseOperation or
+    this.getParent*() instanceof NotExpr
+  }
+
+  /** Holds when the expression contains a pointer. */
+  predicate workingWithPointer() {
+    this.getAChild*().getFullyConverted().getType() instanceof DerivedType
+  }
+
+  /** Holds when a null comparison expression exists. */
+  predicate compareWithZero() {
+    exists(Expr exp |
+      exp instanceof ComparisonOperation and
+      (
+        globalValueNumber(exp.getAChild*()) = globalValueNumber(this) or
+        hashCons(exp.getAChild*()) = hashCons(this)
+      ) and
+      (
+        exp.(ComparisonOperation).getLeftOperand().getValue() = "0" or
+        exp.(ComparisonOperation).getRightOperand().getValue() = "0"
+      )
+    )
+  }
+
+  /** Holds when a comparison expression exists. */
+  predicate compareWithOutZero() {
+    exists(Expr exp |
+      exp instanceof ComparisonOperation and
+      (
+        globalValueNumber(exp.getAChild*()) = globalValueNumber(this) or
+        hashCons(exp.getAChild*()) = hashCons(this)
+      )
+    )
+  }
+}
+
+from Expr exp, WhileStmt wst
+where
+  exp instanceof UsingArithmeticInComparison and
+  not exp.(UsingArithmeticInComparison).workingWithValue() and
+  not exp.(UsingArithmeticInComparison).workingWithPointer() and
+  not exp.(UsingArithmeticInComparison).insideTheLoop() and
+  not exp.(UsingArithmeticInComparison).compareWithZero() and
+  exp.(UsingArithmeticInComparison).compareWithOutZero()
+  or
+  wst instanceof UsingWhileAfterWhile and exp = wst.getCondition()
+select exp, "this expression needs your attention"

From cbf158ea6bbd4f5f98c5e1ad997fe6a58902e993 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Tue, 6 Apr 2021 10:36:22 +0300
Subject: [PATCH 114/433] Add files via upload

---
 ...ManagementAfterRefactoringTheCode.expected |  3 ++
 ...lowManagementAfterRefactoringTheCode.qlref |  1 +
 .../Security/CWE/CWE-691/semmle/tests/test.c  | 28 +++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
new file mode 100644
index 000000000000..cc1b5cf46d80
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
@@ -0,0 +1,3 @@
+| test.c:15:6:15:16 | ... + ... | this expression needs your attention |
+| test.c:17:17:17:27 | ... + ... | this expression needs your attention |
+| test.c:22:10:22:15 | ... > ... | this expression needs your attention |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
new file mode 100644
index 000000000000..496d5f1b7be6
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
new file mode 100644
index 000000000000..fc30f7a6e97e
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -0,0 +1,28 @@
+int tmpFunction(){
+  return 5;
+}
+void workFunction_0(char *s) {
+  int intSize;
+  char buf[80];
+  if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD
+  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD
+  if(intSize>0 && tmpFunction()) return;
+  if(intSize<0 & tmpFunction()) return; // BAD
+}
+void workFunction_1(char *s) {
+  int intA,intB;
+
+  if(intA + intB) return; // BAD
+  if(intA + intB>4) return; // GOOD
+  if(intA>0 && (intA + intB)) return; // BAD
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  }while(intA>0); // BAD
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  } // GOOD
+}

From 6c69c1aeeb10737bd63bc95ed8c7759342116cdb Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Wed, 7 Apr 2021 10:47:21 +0000
Subject: [PATCH 115/433] Python: Minor cleanup

---
 python/ql/src/semmle/python/Files.qll  | 5 +----
 python/ql/src/semmle/python/Module.qll | 2 +-
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/python/ql/src/semmle/python/Files.qll b/python/ql/src/semmle/python/Files.qll
index 83ba92f0abcc..6eb6b2a18aca 100644
--- a/python/ql/src/semmle/python/Files.qll
+++ b/python/ql/src/semmle/python/Files.qll
@@ -74,7 +74,7 @@ class File extends Container {
   string getContents() { file_contents(this, result) }
 
   /** Holds if this file is likely to get executed directly, and thus act as an entry point for execution. */
-  predicate maybeExecutedDirectly() {
+  predicate isPossibleEntryPoint() {
     // Only consider files in the source code, and not things like the standard library
     exists(this.getRelativePath()) and
     (
@@ -148,9 +148,6 @@ class Folder extends Container {
     this.getBaseName().regexpMatch("[^\\d\\W]\\w*") and
     result = this.getParent().getImportRoot(n)
   }
-
-  /** Holds if execution may start in a file in this directory. */
-  predicate mayContainEntryPoint() { any(File f | f.getParent() = this).maybeExecutedDirectly() }
 }
 
 /**
diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index 48d0e9e1a3d9..753be2605d2e 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -211,7 +211,7 @@ private predicate transitively_imported_from_entry_point(File file) {
     importer.getParent() = file.getParent() and
     exists(ImportExpr i | i.getLocation().getFile() = importer and i.getName() = file.getStem())
   |
-    importer.maybeExecutedDirectly() or transitively_imported_from_entry_point(importer)
+    importer.isPossibleEntryPoint() or transitively_imported_from_entry_point(importer)
   )
 }
 

From 38daeb4df23057c160c744387316c012ea80f92a Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Wed, 7 Apr 2021 15:50:51 +0200
Subject: [PATCH 116/433] Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/Security/CWE-327/FluentApiModel.qll         | 4 ++--
 python/ql/src/Security/CWE-327/Ssl.qll                    | 3 ++-
 python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py | 2 ++
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 652a4bae2a10..b5d6823c44c2 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -65,8 +65,8 @@ class InsecureContextConfiguration extends DataFlow::Configuration {
  * Holds if `conectionCreation` marks the creation of a connetion based on the contex
  * found at `contextOrigin` and allowing `insecure_version`.
  *
- * `specific` is true iff the context is configured for a specific protocol version rather
- * than for a family of protocols.
+ * `specific` is true iff the context is configured for a specific protocol version (`ssl.PROTOCOL_TLSv1_2`) rather
+ * than for a family of protocols (`ssl.PROTOCOL_TLS`).
  */
 predicate unsafe_connection_creation_with_context(
   DataFlow::Node connectionCreation, ProtocolVersion insecure_version, DataFlow::Node contextOrigin,
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index fc4d13bffae9..2ca7dcce1f90 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -149,7 +149,8 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
     or
     // Case: No protocol arguemnt is present.
     not exists(this.getProtocol()) and
-    // The default argument is TLS and the SSL versions are turned off by default.
+    // The default argument is TLS and the SSL versions are turned off by default since Python 3.6
+    // see https://docs.python.org/3.6/library/ssl.html#ssl.SSLContext
     result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }
 }
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
index 0f7620f21ea1..a8e491a42f1e 100644
--- a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
+++ b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -49,6 +49,8 @@ def test_fluent_tls_safe():
 
 def test_fluent_ssl():
     hostname = 'www.python.org'
+    # notice that `ssl.PROTOCOL_SSLv23` is just a deprecated alias for `ssl.PROTOCOL_TLS`.
+    # Therefore, we only have this one test using PROTOCOL_SSLv23, to show that we handle this alias correctly.
     context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
 
     with socket.create_connection((hostname, 443)) as sock:

From 80ac2aff268cd11501e8aaea05842c63bbc7afb4 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Wed, 7 Apr 2021 20:55:03 +0300
Subject: [PATCH 117/433] Fixed typos

Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
---
 .../CWE-094/JakartaExpressionInjection.qhelp   | 18 +++++++++---------
 .../SaferExpressionEvaluationWithJuel.java     |  4 ++--
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
index 6e6b5f633947..8a9e4e7276f0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
@@ -4,22 +4,22 @@
 <overview>
 <p>
 Jakarta Expression Language (EL) is an expression language for Java applications.
-There are a single language specification and multiple implementations
+There is a single language specification and multiple implementations
 such as Glassfish, Juel, Apache Commons EL, etc.
 The language allows invocation of methods available in the JVM.
 If an expression is built using attacker-controlled data,
-and then evaluated, then it may allow the attacker to run arbitrary code.
+and then evaluated, it may allow the attacker to run arbitrary code.
 </p>
 </overview>
 
 <recommendation>
 <p>
 It is generally recommended to avoid using untrusted data in an EL expression.
-Before using untrusted data to build an EL expressoin, the data should be validated
-to ensure it is not evaluated as expression language. If the EL implementaion offers
-configuring a sandbox for EL expression, they should be run in a restircitive sandbox
+Before using untrusted data to build an EL expression, the data should be validated
+to ensure it is not evaluated as expression language. If the EL implementation offers
+configuring a sandbox for EL expressions, they should be run in a restrictive sandbox
 that allows accessing only explicitly allowed classes. If the EL implementation
-does not allow sandboxing, consider using other expressiong language implementations
+does not support sandboxing, consider using other expression language implementations
 with sandboxing capabilities such as Apache Commons JEXL or the Spring Expression Language.
 </p>
 </recommendation>
@@ -32,9 +32,9 @@ using the JUEL interpreter:
 <sample src="UnsafeExpressionEvaluationWithJUEL.java" />
 
 <p>
-JUEL does not allow to run expression in a sandbox. To prevent running arbitrary code,
-incoming data has to be checked before including to an expression. The next example
-uses a Regex pattern to check whether a user tries to run an allowed exression or not:
+JUEL does not support to run expressions in a sandbox. To prevent running arbitrary code,
+incoming data has to be checked before including it in an expression. The next example
+uses a Regex pattern to check whether a user tries to run an allowed expression or not:
 </p>
 <sample src="SaferExpressionEvaluationWithJUEL.java" />
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
index 54fb9a0ed36c..3dfaaead68a5 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
@@ -1,10 +1,10 @@
 String input = getRemoteUserInput();
 String pattern = "(inside|outside)\\.(temperature|humidity)";
 if (!input.matches(pattern)) {
-    throw new IllegalArgumentException("Unexpected exression");
+    throw new IllegalArgumentException("Unexpected expression");
 }
 String expression = "${" + input + "}";
 ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
 ValueExpression e = factory.createValueExpression(context, expression, Object.class);
 SimpleContext context = getContext();
-Object result = e.getValue(context);
\ No newline at end of file
+Object result = e.getValue(context);

From 3d8e173c5770a32804cbffb798ce63cfaddb795d Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Wed, 7 Apr 2021 20:59:07 +0300
Subject: [PATCH 118/433] Removed a reference to Apache Commons EL

---
 .../Security/CWE/CWE-094/JakartaExpressionInjection.qhelp     | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
index 8a9e4e7276f0..a6d66c1d1d16 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
@@ -57,9 +57,5 @@ uses a Regex pattern to check whether a user tries to run an allowed expression
   JUEL:
   <a href="http://juel.sourceforge.net">Home page</a>
 </li>
-<li>
-  Apache Foundation:
-  <a href="https://commons.apache.org/dormant/commons-el/">Apache Commons EL</a>
-</li>
 </references>
 </qhelp>

From c13ee0859acb4222aae8d4071d039494edfc782a Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Wed, 7 Apr 2021 21:02:21 +0300
Subject: [PATCH 119/433] LambdaExpression should extend JakartaType

---
 .../Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index 22f421b8bf8c..5b652d3d8e65 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -97,6 +97,6 @@ private class MethodExpression extends JakartaType {
   MethodExpression() { hasName("MethodExpression") }
 }
 
-private class LambdaExpression extends RefType {
+private class LambdaExpression extends JakartaType {
   LambdaExpression() { hasName("LambdaExpression") }
 }

From a764a79090e17ce22b7e1a3d8927dc80f0effd1b Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Wed, 7 Apr 2021 21:12:21 +0300
Subject: [PATCH 120/433] Always bind arguments in TaintPropagatingCall

---
 .../CWE-094/JakartaExpressionInjectionLib.qll | 20 ++++++++++---------
 .../JakartaExpressionInjection.expected       | 18 -----------------
 2 files changed, 11 insertions(+), 27 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index 5b652d3d8e65..e3a3994c8818 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -56,15 +56,17 @@ private class TaintPropagatingCall extends Call {
 
   TaintPropagatingCall() {
     taintFromExpr = this.getArgument(1) and
-    exists(Method m | this.(MethodAccess).getMethod() = m |
-      m.getDeclaringType() instanceof ExpressionFactory and
-      m.hasName(["createValueExpression", "createMethodExpression"]) and
-      taintFromExpr.getType() instanceof TypeString
-    )
-    or
-    exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
-      c.getDeclaringType() instanceof LambdaExpression and
-      taintFromExpr.getType() instanceof ValueExpression
+    (
+      exists(Method m | this.(MethodAccess).getMethod() = m |
+        m.getDeclaringType() instanceof ExpressionFactory and
+        m.hasName(["createValueExpression", "createMethodExpression"]) and
+        taintFromExpr.getType() instanceof TypeString
+      )
+      or
+      exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
+        c.getDeclaringType() instanceof LambdaExpression and
+        taintFromExpr.getType() instanceof ValueExpression
+      )
     )
   }
 
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
index 111cc81541c2..e0d699b14e3a 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -10,22 +10,9 @@ edges
 | JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
 | JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
 | JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
-| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
 | JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
-| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression |
 | JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e |
-| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
-| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
-| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e |
-| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
-| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
-| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression |
 | JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e |
-| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
-| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
-| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e |
-| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
-| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
 | JakartaExpressionInjection.java:79:24:79:33 | expression : String | JakartaExpressionInjection.java:83:13:83:13 | e |
 nodes
 | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -35,18 +22,13 @@ nodes
 | JakartaExpressionInjection.java:37:24:37:33 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:39:32:39:41 | expression | semmle.label | expression |
 | JakartaExpressionInjection.java:44:24:44:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | semmle.label | new LambdaExpression(...) : LambdaExpression |
 | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | semmle.label | lambdaExpression |
 | JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
 | JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
 | JakartaExpressionInjection.java:65:13:65:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | semmle.label | e : ValueExpression |
 | JakartaExpressionInjection.java:70:24:70:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
 | JakartaExpressionInjection.java:74:13:74:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | semmle.label | e : ValueExpression |
 | JakartaExpressionInjection.java:79:24:79:33 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:83:13:83:13 | e | semmle.label | e |
 #select

From eb9b41acab71dc9d72a835af2a100ed80b16292d Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Wed, 7 Apr 2021 21:31:12 +0300
Subject: [PATCH 121/433] Apply suggestions from code review

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 ...ufficientControlFlowManagementWhenUsingBitOperations.ql | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
index a599fc19fde3..7b441da9288a 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -1,8 +1,7 @@
 /**
  * @name Errors When Using Bit Operations
- * @description --Using bitwise operations can be a mistake in some situations.
- *              --For example, if parameters are evaluated in an expression and the function should be called only upon certain test results.
- *              --These bitwise operations look suspicious and require developer attention.
+ * @description Unlike the binary operations `||` and `&&`, there is no sequence point after evaluating an
+ *              operand of a bitwise operation like `|` or `&`. If left-to-right evaluation is expected this may be confusing.
  * @kind problem
  * @id cpp/errors-when-using-bit-operations
  * @problem.severity warning
@@ -77,4 +76,4 @@ where
   not dbo.useInOtherCalls() and
   dbo.useInLogicalOperations() and
   (not dbo.functionCallsInBitsExpression() or dbo.dangerousArgumentChecking())
-select dbo, "this bit expression needs your attention"
+select dbo, "This bitwise operation appears in a context where a Boolean operation is expected."

From ed34c96357e95fa58b19b5f5c5759e0a7053810f Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Wed, 7 Apr 2021 21:40:49 +0300
Subject: [PATCH 122/433] Update
 InsufficientControlFlowManagementWhenUsingBitOperations.ql

---
 .../InsufficientControlFlowManagementWhenUsingBitOperations.ql  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
index 7b441da9288a..c387fb923be2 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -29,7 +29,7 @@ class DangerousBitOperations extends Expr {
    */
   DangerousBitOperations() {
     bfc = this.(BinaryBitwiseOperation).getRightOperand() and
-    not this.getParent*() instanceof AssignExpr and
+    not this.getParent*() instanceof Assignment and
     not this.getParent*() instanceof Initializer and
     not this.getParent*() instanceof ReturnStmt and
     not this.getParent*() instanceof EqualityOperation and

From 675de07c3e7698d5137b520f870107e642c9b05d Mon Sep 17 00:00:00 2001
From: Dilan <dbhalla21@berkeley.edu>
Date: Wed, 7 Apr 2021 15:04:18 -0700
Subject: [PATCH 123/433] autoformat ql

---
 python/ql/src/experimental/Classes/NamingConventionsClasses.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
index f16d242eadf3..0ab11b4197c8 100644
--- a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
@@ -10,7 +10,7 @@
 import python
 
 predicate lower_case_class(Class c) {
-  exists(string first_char | 
+  exists(string first_char |
     first_char = c.getName().prefix(1) and
     not first_char = first_char.toUpperCase()
   )

From 8ce5c46e05dbf11bb3581490601ff9fc04dd3631 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Sat, 27 Mar 2021 18:57:46 +0100
Subject: [PATCH 124/433] Python: Minor refactor

modName/clsName _is_ shorter, but also looks way worse :D
---
 .../ql/src/semmle/python/frameworks/Django.qll  | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 02d5030bb1e8..ebc1d1bdfa24 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -2081,20 +2081,21 @@ private module Django {
     module Field {
       /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
       API::Node subclassRef() {
-        exists(string modName, string clsName |
+        exists(string moduleName, string className |
           // canonical definition
           result =
             API::moduleImport("django")
                 .getMember("forms")
-                .getMember(modName)
-                .getMember(clsName)
+                .getMember(moduleName)
+                .getMember(className)
                 .getASubclass*()
           or
           // alias from `django.forms`
-          result = API::moduleImport("django").getMember("forms").getMember(clsName).getASubclass*()
+          result =
+            API::moduleImport("django").getMember("forms").getMember(className).getASubclass*()
         |
-          modName = "fields" and
-          clsName in [
+          moduleName = "fields" and
+          className in [
               "Field",
               // Known subclasses
               "BooleanField", "IntegerField", "CharField", "SlugField", "DateTimeField",
@@ -2106,8 +2107,8 @@ private module Django {
             ]
           or
           // Known subclasses from `django.forms.models`
-          modName = "models" and
-          clsName in ["ModelChoiceField", "ModelMultipleChoiceField", "InlineForeignKeyField"]
+          moduleName = "models" and
+          className in ["ModelChoiceField", "ModelMultipleChoiceField", "InlineForeignKeyField"]
         )
         or
         // other Field subclasses defined in Django

From 322bdcb7034c9ccd10747c991f4c66bfa7a4c1b5 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Sat, 27 Mar 2021 18:58:37 +0100
Subject: [PATCH 125/433] Python: Port Django view modeling to API graphs

---
 .../src/semmle/python/frameworks/Django.qll   | 434 ++----------------
 1 file changed, 43 insertions(+), 391 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index ebc1d1bdfa24..77cb337d2f60 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1519,402 +1519,54 @@ private module Django {
     /** Provides models for the `django.views` module */
     module views {
       /**
-       * Gets a reference to the attribute `attr_name` of the `django.views` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node views_attr(DataFlow::TypeTracker t, string attr_name) {
-        // for 1.11.x, see: https://github.com/django/django/blob/stable/1.11.x/django/views/__init__.py
-        attr_name in ["generic", "View"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.views" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = views()
-        )
-        or
-        // Due to bad performance when using normal setup with `views_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            views_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate views_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(views_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.views` module.
-       * WARNING: Only holds for a few predefined attributes.
+       * Provides models for the `django.views.generic.View` class and subclasses.
+       *
+       * See
+       *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
+       *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
        */
-      private DataFlow::Node views_attr(string attr_name) {
-        result = views_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
-      // -------------------------------------------------------------------------
-      // django.views.generic
-      // -------------------------------------------------------------------------
-      /** Gets a reference to the `django.views.generic` module. */
-      DataFlow::Node generic() { result = views_attr("generic") }
-
-      /** Provides models for the `django.views.generic` module */
-      module generic {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.views.generic` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node generic_attr(DataFlow::TypeTracker t, string attr_name) {
-          // for 3.1.x see: https://github.com/django/django/blob/stable/3.1.x/django/views/generic/__init__.py
-          // same for 1.11.x see: https://github.com/django/django/blob/stable/1.11.x/django/views/generic/__init__.py
-          attr_name in [
-              "View", "TemplateView", "RedirectView", "ArchiveIndexView", "YearArchiveView",
-              "MonthArchiveView", "WeekArchiveView", "DayArchiveView", "TodayArchiveView",
-              "DateDetailView", "DetailView", "FormView", "CreateView", "UpdateView", "DeleteView",
-              "ListView", "GenericViewError",
-              // modules
-              "base", "dates", "detail", "edit", "list"
-            ] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.views.generic" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = generic()
-          )
-          or
-          // Due to bad performance when using normal setup with `generic_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              generic_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate generic_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(generic_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.views.generic` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node generic_attr(string attr_name) {
-          result = generic_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.base
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.base` module. */
-        DataFlow::Node base() { result = generic_attr("base") }
-
-        /** Provides models for the `django.views.generic.base` module */
-        module base {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.base` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node base_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["RedirectView", "TemplateView", "View"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.base" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = base()
-            )
-            or
-            // Due to bad performance when using normal setup with `base_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                base_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate base_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(base_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.base` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node base_attr(string attr_name) {
-            result = base_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.dates
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.dates` module. */
-        DataFlow::Node dates() { result = generic_attr("dates") }
-
-        /** Provides models for the `django.views.generic.dates` module */
-        module dates {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.dates` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node dates_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in [
+      module View {
+        /** Gets a reference to the `django.views.generic.View` class or any subclass. */
+        API::Node subclassRef() {
+          exists(string moduleName, string className |
+            // canonical definition
+            result =
+              API::moduleImport("django")
+                  .getMember("views")
+                  .getMember("generic")
+                  .getMember(moduleName)
+                  .getMember(className)
+                  .getASubclass*()
+            or
+            // alias from `django.view.generic`
+            result =
+              API::moduleImport("django")
+                  .getMember("view")
+                  .getMember("generic")
+                  .getMember(className)
+                  .getASubclass*()
+          |
+            moduleName = "base" and
+            className in ["RedirectView", "TemplateView", "View"]
+            or
+            moduleName = "dates" and
+            className in [
                 "ArchiveIndexView", "DateDetailView", "DayArchiveView", "MonthArchiveView",
                 "TodayArchiveView", "WeekArchiveView", "YearArchiveView"
-              ] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.dates" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = dates()
-            )
-            or
-            // Due to bad performance when using normal setup with `dates_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                dates_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate dates_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(dates_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.dates` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node dates_attr(string attr_name) {
-            result = dates_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.detail
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.detail` module. */
-        DataFlow::Node detail() { result = generic_attr("detail") }
-
-        /** Provides models for the `django.views.generic.detail` module */
-        module detail {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.detail` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node detail_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["DetailView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.detail" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = detail()
-            )
-            or
-            // Due to bad performance when using normal setup with `detail_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                detail_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate detail_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(detail_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.detail` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node detail_attr(string attr_name) {
-            result = detail_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.edit
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.edit` module. */
-        DataFlow::Node edit() { result = generic_attr("edit") }
-
-        /** Provides models for the `django.views.generic.edit` module */
-        module edit {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.edit` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node edit_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["CreateView", "DeleteView", "FormView", "UpdateView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.edit" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = edit()
-            )
-            or
-            // Due to bad performance when using normal setup with `edit_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                edit_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate edit_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(edit_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.edit` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node edit_attr(string attr_name) {
-            result = edit_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.list
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.list` module. */
-        DataFlow::Node list() { result = generic_attr("list") }
-
-        /** Provides models for the `django.views.generic.list` module */
-        module list {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.list` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node list_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["ListView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.list" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = list()
-            )
-            or
-            // Due to bad performance when using normal setup with `list_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                list_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate list_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(list_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.list` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node list_attr(string attr_name) {
-            result = list_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        /**
-         * Provides models for the `django.views.generic.View` class and subclasses.
-         *
-         * See
-         *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
-         *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
-         */
-        module View {
-          /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-          private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result =
-              generic_attr([
-                  "View",
-                  // Known Views
-                  "TemplateView", "RedirectView", "ArchiveIndexView", "YearArchiveView",
-                  "MonthArchiveView", "WeekArchiveView", "DayArchiveView", "TodayArchiveView",
-                  "DateDetailView", "DetailView", "FormView", "CreateView", "UpdateView",
-                  "DeleteView", "ListView"
-                ])
+              ]
             or
-            // aliases
-            t.start() and
-            (
-              // django.views.View
-              result = views_attr("View")
-              or
-              // django.views.generic.base.*
-              result = base::base_attr(_)
-              or
-              // django.views.generic.dates.*
-              result = dates::dates_attr(_)
-              or
-              // django.views.generic.detail.*
-              result = detail::detail_attr(_)
-              or
-              // django.views.generic.edit.*
-              result = edit::edit_attr(_)
-              or
-              // django.views.generic.list.*
-              result = list::list_attr(_)
-            )
+            moduleName = "detail" and
+            className = "DetailView"
             or
-            // subclasses in project code
-            result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
+            moduleName = "edit" and
+            className in ["CreateView", "DeleteView", "FormView", "UpdateView"]
             or
-            exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-          }
-
-          /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-          DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+            moduleName = "list" and
+            className = "ListView"
+          )
+          or
+          // `django.views.View` alias
+          result = API::moduleImport("django").getMember("views").getMember("View").getASubclass*()
         }
       }
     }
@@ -2389,7 +2041,7 @@ private module Django {
    */
   class DjangoViewClassFromSuperClass extends DjangoViewClass {
     DjangoViewClassFromSuperClass() {
-      this.getABase() = django::views::generic::View::subclassRef().asExpr()
+      this.getABase() = django::views::View::subclassRef().getAUse().asExpr()
     }
   }
 

From b7483a539430ddb05012044db1a6d36ee43b9fcb Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 6 Apr 2021 10:46:36 +0200
Subject: [PATCH 126/433] Python: Add modeledSubclassRef for Django
 views/fields/forms

---
 .../src/semmle/python/frameworks/Django.qll   | 54 +++++++++----------
 1 file changed, 26 insertions(+), 28 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 77cb337d2f60..c22f06c9a953 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1526,8 +1526,11 @@ private module Django {
        *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
        */
       module View {
-        /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-        API::Node subclassRef() {
+        /**
+         * Get a references to: the `django.views.generic.View` class, or any subclass
+         * that has explicitly been modeled in the CodeQL libraries.
+         */
+        API::Node modeledSubclassRef() {
           exists(string moduleName, string className |
             // canonical definition
             result =
@@ -1536,7 +1539,6 @@ private module Django {
                   .getMember("generic")
                   .getMember(moduleName)
                   .getMember(className)
-                  .getASubclass*()
             or
             // alias from `django.view.generic`
             result =
@@ -1544,7 +1546,6 @@ private module Django {
                   .getMember("view")
                   .getMember("generic")
                   .getMember(className)
-                  .getASubclass*()
           |
             moduleName = "base" and
             className in ["RedirectView", "TemplateView", "View"]
@@ -1566,8 +1567,11 @@ private module Django {
           )
           or
           // `django.views.View` alias
-          result = API::moduleImport("django").getMember("views").getMember("View").getASubclass*()
+          result = API::moduleImport("django").getMember("views").getMember("View")
         }
+
+        /** Gets a reference to the `django.views.generic.View` class or any subclass. */
+        API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
       }
     }
 
@@ -1638,29 +1642,29 @@ private module Django {
      * See https://docs.djangoproject.com/en/3.1/ref/forms/api/
      */
     module Form {
-      /** Gets a reference to the `django.forms.forms.BaseForm` class or any subclass. */
-      API::Node subclassRef() {
+      /**
+       * Get a references to: the `django.forms.forms.BaseForm` class, or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      API::Node modeledSubclassRef() {
         // canonical definition
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember("forms")
               .getMember(["BaseForm", "Form"])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember("models")
               .getMember(["BaseModelForm", "ModelForm"])
-              .getASubclass*()
         or
         // aliases from `django.forms`
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember(["BaseForm", "Form", "BaseModelForm", "ModelForm"])
-              .getASubclass*()
         or
         // other Form subclasses defined in Django
         result =
@@ -1669,7 +1673,6 @@ private module Django {
               .getMember("admin")
               .getMember("forms")
               .getMember(["AdminAuthenticationForm", "AdminPasswordChangeForm"])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1677,7 +1680,6 @@ private module Django {
               .getMember("admin")
               .getMember("helpers")
               .getMember("ActionForm")
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1686,7 +1688,6 @@ private module Django {
               .getMember("views")
               .getMember("main")
               .getMember("ChangeListSearchForm")
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1698,7 +1699,6 @@ private module Django {
                   "AdminPasswordChangeForm", "PasswordChangeForm", "AuthenticationForm",
                   "UserCreationForm"
                 ])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1706,22 +1706,22 @@ private module Django {
               .getMember("flatpages")
               .getMember("forms")
               .getMember("FlatpageForm")
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember("formsets")
               .getMember("ManagementForm")
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember("models")
               .getMember(["ModelForm", "BaseModelForm"])
-              .getASubclass*()
       }
+
+      /** Gets a reference to the `django.forms.forms.BaseForm` class or any subclass. */
+      API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
     }
 
     /**
@@ -1731,8 +1731,11 @@ private module Django {
      * See https://docs.djangoproject.com/en/3.1/ref/forms/fields/
      */
     module Field {
-      /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
-      API::Node subclassRef() {
+      /**
+       * Get a references to: the `django.forms.fields.Field` class, or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      API::Node modeledSubclassRef() {
         exists(string moduleName, string className |
           // canonical definition
           result =
@@ -1740,11 +1743,9 @@ private module Django {
                 .getMember("forms")
                 .getMember(moduleName)
                 .getMember(className)
-                .getASubclass*()
           or
           // alias from `django.forms`
-          result =
-            API::moduleImport("django").getMember("forms").getMember(className).getASubclass*()
+          result = API::moduleImport("django").getMember("forms").getMember(className)
         |
           moduleName = "fields" and
           className in [
@@ -1770,7 +1771,6 @@ private module Django {
               .getMember("auth")
               .getMember("forms")
               .getMember(["ReadOnlyPasswordHashField", "UsernameField"])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1783,7 +1783,6 @@ private module Django {
                   "MultiLineStringField", "MultiPointField", "MultiPolygonField", "PointField",
                   "PolygonField"
                 ])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1792,7 +1791,6 @@ private module Django {
               .getMember("forms")
               .getMember("array")
               .getMember(["SimpleArrayField", "SplitArrayField"])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1801,7 +1799,6 @@ private module Django {
               .getMember("forms")
               .getMember("hstore")
               .getMember("HStoreField")
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
@@ -1813,15 +1810,16 @@ private module Django {
                   "BaseRangeField", "DateRangeField", "DateTimeRangeField", "DecimalRangeField",
                   "IntegerRangeField"
                 ])
-              .getASubclass*()
         or
         result =
           API::moduleImport("django")
               .getMember("forms")
               .getMember("models")
               .getMember(["InlineForeignKeyField", "ModelChoiceField", "ModelMultipleChoiceField"])
-              .getASubclass*()
       }
+
+      /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
+      API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
     }
   }
 

From 83477439a1a94af960d8edc5c5c2818da2614bcf Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Sun, 28 Mar 2021 14:13:32 +0200
Subject: [PATCH 127/433] Python: Make django views/fields/forms class modeling
 extensible

This also requires that we make this part of the modeling public, which I guess
is step we want to take eventually anyway!

I'm not quite sure whether the modules `Django::Views` and `Django::Forms` are
actually helpful, or whether we should just have their modules available as
`Django::View`, `Django::Form`, and `Django::Field`...
---
 .../src/semmle/python/frameworks/Django.qll   | 537 +++++++++---------
 1 file changed, 279 insertions(+), 258 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index c22f06c9a953..f41920c86b8a 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -16,7 +16,284 @@ private import semmle.python.regex
  * Provides models for the `django` PyPI package.
  * See https://www.djangoproject.com/.
  */
-private module Django {
+module Django {
+  /** Provides models for the `django.views` module */
+  module Views {
+    /**
+     * Provides models for the `django.views.generic.View` class and subclasses.
+     *
+     * See
+     *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
+     *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
+     */
+    module View {
+      /**
+       * An `API::Node` for references to `django.views.generic.View` or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django view subclass in the `django` package. */
+      private class DjangoViewSubclassesInDjango extends ModeledSubclass {
+        DjangoViewSubclassesInDjango() {
+          exists(string moduleName, string className |
+            // canonical definition
+            this =
+              API::moduleImport("django")
+                  .getMember("views")
+                  .getMember("generic")
+                  .getMember(moduleName)
+                  .getMember(className)
+            or
+            // aliases from `django.views.generic`
+            this =
+              API::moduleImport("django")
+                  .getMember("views")
+                  .getMember("generic")
+                  .getMember(className)
+          |
+            moduleName = "base" and
+            className in ["RedirectView", "TemplateView", "View"]
+            or
+            moduleName = "dates" and
+            className in [
+                "ArchiveIndexView", "DateDetailView", "DayArchiveView", "MonthArchiveView",
+                "TodayArchiveView", "WeekArchiveView", "YearArchiveView"
+              ]
+            or
+            moduleName = "detail" and
+            className = "DetailView"
+            or
+            moduleName = "edit" and
+            className in ["CreateView", "DeleteView", "FormView", "UpdateView"]
+            or
+            moduleName = "list" and
+            className = "ListView"
+          )
+          or
+          // `django.views.View` alias
+          this = API::moduleImport("django").getMember("views").getMember("View")
+        }
+      }
+
+      /** Gets a reference to the `django.views.generic.View` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+  }
+
+  /** Provides models for django forms (defined in the `django.forms` module) */
+  module Forms {
+    /**
+     * Provides models for the `django.forms.forms.BaseForm` class and subclasses. This
+     * is usually used by the `django.forms.forms.Form` class, which is also available
+     * under the more commonly used alias `django.forms.Form`.
+     *
+     * See https://docs.djangoproject.com/en/3.1/ref/forms/api/
+     */
+    module Form {
+      /**
+       * An `API::Node` for references to `django.forms.forms.BaseForm` or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django form subclass in the `django` package. */
+      private class DjangoFormSubclassesInDjango extends ModeledSubclass {
+        DjangoFormSubclassesInDjango() {
+          // canonical definition
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("forms")
+                .getMember(["BaseForm", "Form"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["BaseModelForm", "ModelForm"])
+          or
+          // aliases from `django.forms`
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember(["BaseForm", "Form", "BaseModelForm", "ModelForm"])
+          or
+          // other Form subclasses defined in Django
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("forms")
+                .getMember(["AdminAuthenticationForm", "AdminPasswordChangeForm"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("helpers")
+                .getMember("ActionForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("views")
+                .getMember("main")
+                .getMember("ChangeListSearchForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("auth")
+                .getMember("forms")
+                .getMember([
+                    "PasswordResetForm", "UserChangeForm", "SetPasswordForm",
+                    "AdminPasswordChangeForm", "PasswordChangeForm", "AuthenticationForm",
+                    "UserCreationForm"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("flatpages")
+                .getMember("forms")
+                .getMember("FlatpageForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("formsets")
+                .getMember("ManagementForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["ModelForm", "BaseModelForm"])
+        }
+      }
+
+      /** Gets a reference to the `django.forms.forms.BaseForm` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+
+    /**
+     * Provides models for the `django.forms.fields.Field` class and subclasses. This is
+     * also available under the more commonly used alias `django.forms.Field`.
+     *
+     * See https://docs.djangoproject.com/en/3.1/ref/forms/fields/
+     */
+    module Field {
+      /**
+       * An `API::Node` for references to `django.forms.fields.Field` or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django field subclass in the `django` package. */
+      private class DjangoFieldSubclassesInDjango extends ModeledSubclass {
+        DjangoFieldSubclassesInDjango() {
+          exists(string moduleName, string className |
+            // canonical definition
+            this =
+              API::moduleImport("django")
+                  .getMember("forms")
+                  .getMember(moduleName)
+                  .getMember(className)
+            or
+            // aliases from `django.forms`
+            this = API::moduleImport("django").getMember("forms").getMember(className)
+          |
+            moduleName = "fields" and
+            className in [
+                "Field",
+                // Known subclasses
+                "BooleanField", "IntegerField", "CharField", "SlugField", "DateTimeField",
+                "EmailField", "DateField", "TimeField", "DurationField", "DecimalField",
+                "FloatField", "GenericIPAddressField", "UUIDField", "JSONField", "FilePathField",
+                "NullBooleanField", "URLField", "TypedChoiceField", "FileField", "ImageField",
+                "RegexField", "ChoiceField", "MultipleChoiceField", "ComboField", "MultiValueField",
+                "SplitDateTimeField", "TypedMultipleChoiceField", "BaseTemporalField"
+              ]
+            or
+            // Known subclasses from `django.forms.models`
+            moduleName = "models" and
+            className in ["ModelChoiceField", "ModelMultipleChoiceField", "InlineForeignKeyField"]
+          )
+          or
+          // other Field subclasses defined in Django
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("auth")
+                .getMember("forms")
+                .getMember(["ReadOnlyPasswordHashField", "UsernameField"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("gis")
+                .getMember("forms")
+                .getMember("fields")
+                .getMember([
+                    "GeometryCollectionField", "GeometryField", "LineStringField",
+                    "MultiLineStringField", "MultiPointField", "MultiPolygonField", "PointField",
+                    "PolygonField"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("array")
+                .getMember(["SimpleArrayField", "SplitArrayField"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("hstore")
+                .getMember("HStoreField")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("ranges")
+                .getMember([
+                    "BaseRangeField", "DateRangeField", "DateTimeRangeField", "DecimalRangeField",
+                    "IntegerRangeField"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["InlineForeignKeyField", "ModelChoiceField", "ModelMultipleChoiceField"])
+        }
+      }
+
+      /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+  }
+}
+
+/**
+ * Provides models for the `django` PyPI package (that we are not quite ready to publicly expose yet).
+ * See https://www.djangoproject.com/.
+ */
+private module PrivateDjango {
   // ---------------------------------------------------------------------------
   // django
   // ---------------------------------------------------------------------------
@@ -1510,71 +1787,6 @@ private module Django {
       }
     }
 
-    // -------------------------------------------------------------------------
-    // django.views
-    // -------------------------------------------------------------------------
-    /** Gets a reference to the `django.views` module. */
-    DataFlow::Node views() { result = django_attr("views") }
-
-    /** Provides models for the `django.views` module */
-    module views {
-      /**
-       * Provides models for the `django.views.generic.View` class and subclasses.
-       *
-       * See
-       *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
-       *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
-       */
-      module View {
-        /**
-         * Get a references to: the `django.views.generic.View` class, or any subclass
-         * that has explicitly been modeled in the CodeQL libraries.
-         */
-        API::Node modeledSubclassRef() {
-          exists(string moduleName, string className |
-            // canonical definition
-            result =
-              API::moduleImport("django")
-                  .getMember("views")
-                  .getMember("generic")
-                  .getMember(moduleName)
-                  .getMember(className)
-            or
-            // alias from `django.view.generic`
-            result =
-              API::moduleImport("django")
-                  .getMember("view")
-                  .getMember("generic")
-                  .getMember(className)
-          |
-            moduleName = "base" and
-            className in ["RedirectView", "TemplateView", "View"]
-            or
-            moduleName = "dates" and
-            className in [
-                "ArchiveIndexView", "DateDetailView", "DayArchiveView", "MonthArchiveView",
-                "TodayArchiveView", "WeekArchiveView", "YearArchiveView"
-              ]
-            or
-            moduleName = "detail" and
-            className = "DetailView"
-            or
-            moduleName = "edit" and
-            className in ["CreateView", "DeleteView", "FormView", "UpdateView"]
-            or
-            moduleName = "list" and
-            className = "ListView"
-          )
-          or
-          // `django.views.View` alias
-          result = API::moduleImport("django").getMember("views").getMember("View")
-        }
-
-        /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-        API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
-      }
-    }
-
     // -------------------------------------------------------------------------
     // django.shortcuts
     // -------------------------------------------------------------------------
@@ -1632,197 +1844,6 @@ private module Django {
     }
   }
 
-  /** Provides models for django forms (defined in the `django.forms` module) */
-  module Forms {
-    /**
-     * Provides models for the `django.forms.forms.BaseForm` class and subclasses. This
-     * is usually used by the `django.forms.forms.Form` class, which is also available
-     * under the more commonly used alias `django.forms.Form`.
-     *
-     * See https://docs.djangoproject.com/en/3.1/ref/forms/api/
-     */
-    module Form {
-      /**
-       * Get a references to: the `django.forms.forms.BaseForm` class, or any subclass
-       * that has explicitly been modeled in the CodeQL libraries.
-       */
-      API::Node modeledSubclassRef() {
-        // canonical definition
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember("forms")
-              .getMember(["BaseForm", "Form"])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember("models")
-              .getMember(["BaseModelForm", "ModelForm"])
-        or
-        // aliases from `django.forms`
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember(["BaseForm", "Form", "BaseModelForm", "ModelForm"])
-        or
-        // other Form subclasses defined in Django
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("admin")
-              .getMember("forms")
-              .getMember(["AdminAuthenticationForm", "AdminPasswordChangeForm"])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("admin")
-              .getMember("helpers")
-              .getMember("ActionForm")
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("admin")
-              .getMember("views")
-              .getMember("main")
-              .getMember("ChangeListSearchForm")
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("auth")
-              .getMember("forms")
-              .getMember([
-                  "PasswordResetForm", "UserChangeForm", "SetPasswordForm",
-                  "AdminPasswordChangeForm", "PasswordChangeForm", "AuthenticationForm",
-                  "UserCreationForm"
-                ])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("flatpages")
-              .getMember("forms")
-              .getMember("FlatpageForm")
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember("formsets")
-              .getMember("ManagementForm")
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember("models")
-              .getMember(["ModelForm", "BaseModelForm"])
-      }
-
-      /** Gets a reference to the `django.forms.forms.BaseForm` class or any subclass. */
-      API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
-    }
-
-    /**
-     * Provides models for the `django.forms.fields.Field` class and subclasses. This is
-     * also available under the more commonly used alias `django.forms.Field`.
-     *
-     * See https://docs.djangoproject.com/en/3.1/ref/forms/fields/
-     */
-    module Field {
-      /**
-       * Get a references to: the `django.forms.fields.Field` class, or any subclass
-       * that has explicitly been modeled in the CodeQL libraries.
-       */
-      API::Node modeledSubclassRef() {
-        exists(string moduleName, string className |
-          // canonical definition
-          result =
-            API::moduleImport("django")
-                .getMember("forms")
-                .getMember(moduleName)
-                .getMember(className)
-          or
-          // alias from `django.forms`
-          result = API::moduleImport("django").getMember("forms").getMember(className)
-        |
-          moduleName = "fields" and
-          className in [
-              "Field",
-              // Known subclasses
-              "BooleanField", "IntegerField", "CharField", "SlugField", "DateTimeField",
-              "EmailField", "DateField", "TimeField", "DurationField", "DecimalField", "FloatField",
-              "GenericIPAddressField", "UUIDField", "JSONField", "FilePathField",
-              "NullBooleanField", "URLField", "TypedChoiceField", "FileField", "ImageField",
-              "RegexField", "ChoiceField", "MultipleChoiceField", "ComboField", "MultiValueField",
-              "SplitDateTimeField", "TypedMultipleChoiceField", "BaseTemporalField"
-            ]
-          or
-          // Known subclasses from `django.forms.models`
-          moduleName = "models" and
-          className in ["ModelChoiceField", "ModelMultipleChoiceField", "InlineForeignKeyField"]
-        )
-        or
-        // other Field subclasses defined in Django
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("auth")
-              .getMember("forms")
-              .getMember(["ReadOnlyPasswordHashField", "UsernameField"])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("gis")
-              .getMember("forms")
-              .getMember("fields")
-              .getMember([
-                  "GeometryCollectionField", "GeometryField", "LineStringField",
-                  "MultiLineStringField", "MultiPointField", "MultiPolygonField", "PointField",
-                  "PolygonField"
-                ])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("postgres")
-              .getMember("forms")
-              .getMember("array")
-              .getMember(["SimpleArrayField", "SplitArrayField"])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("postgres")
-              .getMember("forms")
-              .getMember("hstore")
-              .getMember("HStoreField")
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("contrib")
-              .getMember("postgres")
-              .getMember("forms")
-              .getMember("ranges")
-              .getMember([
-                  "BaseRangeField", "DateRangeField", "DateTimeRangeField", "DecimalRangeField",
-                  "IntegerRangeField"
-                ])
-        or
-        result =
-          API::moduleImport("django")
-              .getMember("forms")
-              .getMember("models")
-              .getMember(["InlineForeignKeyField", "ModelChoiceField", "ModelMultipleChoiceField"])
-      }
-
-      /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
-      API::Node subclassRef() { result = modeledSubclassRef().getASubclass*() }
-    }
-  }
-
   // ---------------------------------------------------------------------------
   // Helpers
   // ---------------------------------------------------------------------------
@@ -2039,7 +2060,7 @@ private module Django {
    */
   class DjangoViewClassFromSuperClass extends DjangoViewClass {
     DjangoViewClassFromSuperClass() {
-      this.getABase() = django::views::View::subclassRef().getAUse().asExpr()
+      this.getABase() = Django::Views::View::subclassRef().getAUse().asExpr()
     }
   }
 

From b39a3ab12ccd57ec76fc22b58d2fde78aadf38c7 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Thu, 8 Apr 2021 20:32:10 +0300
Subject: [PATCH 128/433] Added setVariable() sink

---
 .../CWE-094/JakartaExpressionInjectionLib.qll |  4 +++
 .../JakartaExpressionInjection.expected       | 31 +++++++++++--------
 .../CWE-094/JakartaExpressionInjection.java   |  7 +++++
 .../java-ee-el/javax/el/ELProcessor.java      |  1 +
 4 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index e3a3994c8818..b1c5d1e8ae20 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -44,6 +44,10 @@ private class ExpressionEvaluationSink extends DataFlow::ExprNode {
       m.getDeclaringType() instanceof ELProcessor and
       m.hasName(["eval", "getValue", "setValue"]) and
       ma.getArgument(0) = taintFrom
+      or
+      m.getDeclaringType() instanceof ELProcessor and
+      m.hasName("setVariable") and
+      ma.getArgument(1) = taintFrom
     )
   }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
index e0d699b14e3a..ef002aefdf5c 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -5,15 +5,17 @@ edges
 | JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:44:24:44:33 | expression : String |
 | JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:54:24:54:33 | expression : String |
 | JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:61:24:61:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:70:24:70:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:79:24:79:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:68:24:68:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:77:24:77:33 | expression : String |
+| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:86:24:86:33 | expression : String |
 | JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
 | JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
 | JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
 | JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
-| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e |
-| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e |
-| JakartaExpressionInjection.java:79:24:79:33 | expression : String | JakartaExpressionInjection.java:83:13:83:13 | e |
+| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:63:43:63:52 | expression |
+| JakartaExpressionInjection.java:68:24:68:33 | expression : String | JakartaExpressionInjection.java:72:13:72:13 | e |
+| JakartaExpressionInjection.java:77:24:77:33 | expression : String | JakartaExpressionInjection.java:81:13:81:13 | e |
+| JakartaExpressionInjection.java:86:24:86:33 | expression : String | JakartaExpressionInjection.java:90:13:90:13 | e |
 nodes
 | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | JakartaExpressionInjection.java:24:31:24:40 | expression : String | semmle.label | expression : String |
@@ -26,16 +28,19 @@ nodes
 | JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
 | JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:65:13:65:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:70:24:70:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:74:13:74:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:79:24:79:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:83:13:83:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:63:43:63:52 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:68:24:68:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:72:13:72:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:77:24:77:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:81:13:81:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:86:24:86:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:90:13:90:13 | e | semmle.label | e |
 #select
 | JakartaExpressionInjection.java:32:28:32:37 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:32:28:32:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
 | JakartaExpressionInjection.java:39:32:39:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:39:32:39:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
 | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
 | JakartaExpressionInjection.java:56:32:56:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:56:32:56:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:65:13:65:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:65:13:65:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:74:13:74:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:74:13:74:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:83:13:83:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:83:13:83:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:63:43:63:52 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:63:43:63:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:72:13:72:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:72:13:72:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:81:13:81:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:81:13:81:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:90:13:90:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:90:13:90:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
index a9fb2d45d6f4..2e1d1e55b020 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
@@ -57,6 +57,13 @@ private static void testWithELProcessorSetValue() throws IOException {
         });
     }
 
+    private static void testWithELProcessorSetVariable() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.setVariable("test", expression);
+        });
+    }
+
     private static void testWithJuelValueExpressionGetValue() throws IOException {
         testWithSocket(expression -> {
             ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
index 3c523e685c5e..95895fabc648 100644
--- a/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
@@ -4,4 +4,5 @@ public class ELProcessor {
     public Object eval(String expression) { return null; }
     public Object getValue(String expression, Class<?> expectedType) { return null; }
     public void setValue(String expression, Object value) {}
+    public void setVariable(String var, String expression) {}
 }

From d73ba13b28b42b6e0c3d2ef6f1072ff52c00dc58 Mon Sep 17 00:00:00 2001
From: Dilan <dbhalla21@berkeley.edu>
Date: Thu, 8 Apr 2021 11:41:58 -0700
Subject: [PATCH 129/433] autoformat fix

---
 .../ql/src/experimental/Functions/NamingConventionsFunctions.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
index d2868af22c99..dcfe280c0bf6 100644
--- a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
@@ -10,7 +10,7 @@
 import python
 
 predicate upper_case_function(Function func) {
-  exists(string first_char | 
+  exists(string first_char |
     first_char = func.getName().prefix(1) and
     not first_char = first_char.toLowerCase()
   )

From a6b486a448ca621a3567ef5c4bd87067702e79b4 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 8 Apr 2021 22:01:43 +0300
Subject: [PATCH 130/433] Update
 InsufficientControlFlowManagementWhenUsingBitOperations.ql

---
 ...ontrolFlowManagementWhenUsingBitOperations.ql | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
index c387fb923be2..8a7a3fff1d02 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -19,7 +19,7 @@ import semmle.code.cpp.valuenumbering.GlobalValueNumbering
  * For example: `if(intA>0 & intA<10 & charBuf&myFunc(charBuf[intA]))`.
  * In this case, the function will be called in any case, and even the sequence of the call is not guaranteed.
  */
-class DangerousBitOperations extends Expr {
+class DangerousBitOperations extends BinaryBitwiseOperation {
   FunctionCall bfc;
 
   /**
@@ -28,16 +28,16 @@ class DangerousBitOperations extends Expr {
    * The use of shifts and bitwise operations on any element of an expression indicates a conscious use of the bitwise operator.
    */
   DangerousBitOperations() {
-    bfc = this.(BinaryBitwiseOperation).getRightOperand() and
+    bfc = this.getRightOperand() and
     not this.getParent*() instanceof Assignment and
     not this.getParent*() instanceof Initializer and
     not this.getParent*() instanceof ReturnStmt and
     not this.getParent*() instanceof EqualityOperation and
     not this.getParent*() instanceof UnaryLogicalOperation and
     not this.getParent*() instanceof BinaryLogicalOperation and
-    not this.(BinaryBitwiseOperation).getAChild*() instanceof BitwiseXorExpr and
-    not this.(BinaryBitwiseOperation).getAChild*() instanceof LShiftExpr and
-    not this.(BinaryBitwiseOperation).getAChild*() instanceof RShiftExpr
+    not this.getAChild*() instanceof BitwiseXorExpr and
+    not this.getAChild*() instanceof LShiftExpr and
+    not this.getAChild*() instanceof RShiftExpr
   }
 
   /** Holds when part of a bit expression is used in a logical operation. */
@@ -60,14 +60,14 @@ class DangerousBitOperations extends Expr {
 
   /** Holds when the bit expression contains both arguments and a function call. */
   predicate dangerousArgumentChecking() {
-    not this.(BinaryBitwiseOperation).getLeftOperand() instanceof Call and
-    globalValueNumber(this.(BinaryBitwiseOperation).getLeftOperand().getAChild*()) =
+    not this.getLeftOperand() instanceof Call and
+    globalValueNumber(this.getLeftOperand().getAChild*()) =
       globalValueNumber(bfc.getAnArgument())
   }
 
   /** Holds when function calls are present in the bit expression. */
   predicate functionCallsInBitsExpression() {
-    this.(BinaryBitwiseOperation).getLeftOperand().getAChild*() instanceof FunctionCall
+    this.getLeftOperand().getAChild*() instanceof FunctionCall
   }
 }
 

From 02eb447a359cba04c6d29b49957fbe095235d3e6 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 8 Apr 2021 22:04:08 +0300
Subject: [PATCH 131/433] Update
 InsufficientControlFlowManagementWhenUsingBitOperations.expected

---
 ...icientControlFlowManagementWhenUsingBitOperations.expected | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
index 6aa02a61eaf6..d11bbd446a61 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
@@ -1,2 +1,2 @@
-| test.c:8:6:8:51 | ... & ... | this bit expression needs your attention |
-| test.c:10:6:10:30 | ... & ... | this bit expression needs your attention |
+| test.c:8:6:8:51 | ... & ... | This bitwise operation appears in a context where a Boolean operation is expected. |
+| test.c:10:6:10:30 | ... & ... | This bitwise operation appears in a context where a Boolean operation is expected. |

From 3d117243e4acd9c3fd48bc13807e5e22dbf4aebc Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 8 Apr 2021 22:05:31 +0300
Subject: [PATCH 132/433] Update test.c

---
 .../query-tests/Security/CWE/CWE-691/semmle/tests/test.c      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
index fc30f7a6e97e..e2fccf587366 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -5,9 +5,9 @@ void workFunction_0(char *s) {
   int intSize;
   char buf[80];
   if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD
-  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD
+  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD [NOT DETECTED]
   if(intSize>0 && tmpFunction()) return;
-  if(intSize<0 & tmpFunction()) return; // BAD
+  if(intSize<0 & tmpFunction()) return; // BAD [NOT DETECTED]
 }
 void workFunction_1(char *s) {
   int intA,intB;

From 9b3ccade439293370532322017df0605449d7b62 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Thu, 8 Apr 2021 22:06:35 +0300
Subject: [PATCH 133/433] Update test.c

---
 .../query-tests/Security/CWE/CWE-691/semmle/tests/test.c    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
index fc30f7a6e97e..1db60826b60a 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -12,14 +12,14 @@ void workFunction_0(char *s) {
 void workFunction_1(char *s) {
   int intA,intB;
 
-  if(intA + intB) return; // BAD
+  if(intA + intB) return; // BAD [NOT DETECTED]
   if(intA + intB>4) return; // GOOD
-  if(intA>0 && (intA + intB)) return; // BAD
+  if(intA>0 && (intA + intB)) return; // BAD [NOT DETECTED]
   while(intA>0)
   {
     if(intB - intA<10) break;
     intA--;
-  }while(intA>0); // BAD
+  }while(intA>0); // BAD [NOT DETECTED]
   while(intA>0)
   {
     if(intB - intA<10) break;

From 956311457db86b5aeb1f22ffd458df154c31c20f Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 8 Apr 2021 21:15:50 +0200
Subject: [PATCH 134/433] fixed bad SourceNode X SourceNode join in HTTP model

---
 javascript/ql/src/semmle/javascript/frameworks/Express.qll | 3 +--
 javascript/ql/src/semmle/javascript/frameworks/Fastify.qll | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index bd1249e92681..17bfed8afdac 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -688,8 +688,7 @@ module Express {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll b/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
index cca2ec8122bf..3e96cea462cb 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
@@ -283,8 +283,7 @@ module Fastify {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        this.getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }

From e5bce548de872e4257ab1ff4896d10c6836f21c3 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 8 Apr 2021 21:37:32 +0200
Subject: [PATCH 135/433] add nomagic on mayHaveStringValue

---
 javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 8835b14af05e..aafbc4c81a99 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -96,6 +96,7 @@ module DataFlow {
     predicate accessesGlobal(string g) { globalVarRef(g).flowsTo(this) }
 
     /** Holds if this node may evaluate to the string `s`, possibly through local data flow. */
+    pragma[nomagic]
     predicate mayHaveStringValue(string s) {
       getAPredecessor().mayHaveStringValue(s)
       or

From 7f01586bf130494ea9eeb65d05d8ae9c58b63737 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 9 Apr 2021 01:15:46 +0200
Subject: [PATCH 136/433] fix bad join order in `getDocumentedParameter`

---
 javascript/ql/src/semmle/javascript/JSDoc.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/JSDoc.qll b/javascript/ql/src/semmle/javascript/JSDoc.qll
index bee65bc9ab3b..e7fb681da2a9 100644
--- a/javascript/ql/src/semmle/javascript/JSDoc.qll
+++ b/javascript/ql/src/semmle/javascript/JSDoc.qll
@@ -144,7 +144,7 @@ class JSDocParamTag extends JSDocTag {
   /** Gets the parameter this tag refers to, if it can be determined. */
   Variable getDocumentedParameter() {
     exists(Parameterized parm | parm.getDocumentation() = getParent() |
-      result = parm.getParameterVariable(getName())
+      result = pragma[only_bind_out](parm).getParameterVariable(getName())
     )
   }
 }

From 11304b2ae15fed18f1452bd1e01720351d84e1a4 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 9 Apr 2021 02:21:59 +0000
Subject: [PATCH 137/433] Update qldoc and change the wrapper method
 implementation

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 42 +++++++++----------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index f1bc7879b8a6..d566bd539453 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -1,6 +1,8 @@
 /**
  * @name Sensitive cookies without the HttpOnly response header set
- * @description Sensitive cookies without 'HttpOnly' leaves session cookies vulnerable to an XSS attack.
+ * @description Sensitive cookies without the 'HttpOnly' flag set leaves session cookies vulnerable to
+ *              an XSS attack. This query checks whether 'HttpOnly' is not set in a Java Cookie object
+ *              or the 'Set-Cookie' HTTP header.
  * @kind path-problem
  * @id java/sensitive-cookie-not-httponly
  * @tags security
@@ -25,14 +27,14 @@ string getCsrfCookieNameRegex() { result = "(?i).*(csrf).*" }
  * they are special cookies implementing the Synchronizer Token Pattern that can be used in JavaScript.
  */
 predicate isSensitiveCookieNameExpr(Expr expr) {
-  exists(string s | s = expr.(CompileTimeConstantExpr).getStringValue().toLowerCase() |
+  exists(string s | s = expr.(CompileTimeConstantExpr).getStringValue() |
     s.regexpMatch(getSensitiveCookieNameRegex()) and not s.regexpMatch(getCsrfCookieNameRegex())
   )
   or
   isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
 }
 
-/** The method call `Set-Cookie` of `addHeader` or `setHeader`. */
+/** A method call that sets a `Set-Cookie` header. */
 class SetCookieMethodAccess extends MethodAccess {
   SetCookieMethodAccess() {
     (
@@ -59,7 +61,7 @@ class MatchesHttpOnlyConfiguration extends TaintTracking2::Configuration {
   }
 }
 
-/** The cookie class of Java EE. */
+/** A class descended from `javax.servlet.http.Cookie` or `javax/jakarta.ws.rs.core.Cookie`. */
 class CookieClass extends RefType {
   CookieClass() {
     this.getASupertype*()
@@ -67,25 +69,23 @@ class CookieClass extends RefType {
   }
 }
 
-/** Holds if the `Expr` expr is evaluated to boolean true. */
-predicate isBooleanTrue(Expr expr) {
+/** Holds if the `expr` is `true` or a variable that is ever assigned `true`. */
+predicate mayBeBooleanTrue(Expr expr) {
   expr.(CompileTimeConstantExpr).getBooleanValue() = true or
   expr.(VarAccess).getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getBooleanValue() =
     true
 }
 
 /** Holds if the method call sets the `HttpOnly` flag. */
-predicate setHttpOnlyInCookie(MethodAccess ma) {
+predicate setsCookieHttpOnly(MethodAccess ma) {
   ma.getMethod().getName() = "setHttpOnly" and
   (
-    isBooleanTrue(ma.getArgument(0)) // boolean literal true
+    ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
     or
-    exists(
-      MethodAccess mpa, int i // runtime assignment of boolean value true
-    |
-      TaintTracking::localTaint(DataFlow::parameterNode(mpa.getMethod().getParameter(i)),
-        DataFlow::exprNode(ma.getArgument(0))) and
-      isBooleanTrue(mpa.getArgument(i))
+    // any use of setHttpOnly(x) where x isn't false is probably safe
+    not exists(VarAccess va |
+      ma.getArgument(0).(VarAccess).getVariable().getAnAccess() = va and
+      va.getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getBooleanValue() = false
     )
   )
 }
@@ -99,7 +99,7 @@ class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr() =
-      any(MethodAccess ma | setHttpOnlyInCookie(ma) or removeCookie(ma)).getQualifier()
+      any(MethodAccess ma | setsCookieHttpOnly(ma) or removeCookie(ma)).getQualifier()
   }
 
   override predicate isSink(DataFlow::Node sink) {
@@ -108,18 +108,18 @@ class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
   }
 }
 
-/** Holds if the method call removes a cookie. */
+/** Holds if `ma` removes a cookie. */
 predicate removeCookie(MethodAccess ma) {
   ma.getMethod().getName() = "setMaxAge" and
   ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
 }
 
-/** Sensitive cookie name used in a `Cookie` constructor or a `Set-Cookie` call. */
+/** A sensitive cookie name. */
 class SensitiveCookieNameExpr extends Expr {
   SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
 }
 
-/** Sink of adding a cookie to the HTTP response. */
+/** A cookie that is added to an HTTP response, used as a sink in `MissingHttpOnlyConfiguration`. */
 class CookieResponseSink extends DataFlow::ExprNode {
   CookieResponseSink() {
     exists(MethodAccess ma |
@@ -145,14 +145,14 @@ predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
   cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
   (
     cie.getNumArgument() = 6 and
-    isBooleanTrue(cie.getArgument(5)) // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    mayBeBooleanTrue(cie.getArgument(5)) // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
     or
     cie.getNumArgument() = 8 and
     cie.getArgument(6).getType() instanceof BooleanType and
-    isBooleanTrue(cie.getArgument(7)) // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+    mayBeBooleanTrue(cie.getArgument(7)) // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
     or
     cie.getNumArgument() = 10 and
-    isBooleanTrue(cie.getArgument(9)) // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    mayBeBooleanTrue(cie.getArgument(9)) // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
   )
 }
 

From 53daa7c43685304e6e7463890bcf4d8b77d59ee6 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 17 Mar 2021 12:10:19 +0100
Subject: [PATCH 138/433] Java: Migrate LDAP injection sinks to CSV format

---
 .../code/java/dataflow/ExternalFlow.qll       |   1 +
 .../code/java/security/LdapInjection.qll      | 107 ++++++++----------
 2 files changed, 48 insertions(+), 60 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 4bb79e84ead9..94bca372bb02 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -76,6 +76,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.ApacheHttp
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
+  private import semmle.code.java.security.LdapInjection
 }
 
 private predicate sourceModelCsv(string row) {
diff --git a/java/ql/src/semmle/code/java/security/LdapInjection.qll b/java/ql/src/semmle/code/java/security/LdapInjection.qll
index 2c1f493c6917..f5e0994c68f9 100644
--- a/java/ql/src/semmle/code/java/security/LdapInjection.qll
+++ b/java/ql/src/semmle/code/java/security/LdapInjection.qll
@@ -6,6 +6,7 @@ import semmle.code.java.frameworks.Jndi
 import semmle.code.java.frameworks.UnboundId
 import semmle.code.java.frameworks.SpringLdap
 import semmle.code.java.frameworks.ApacheLdap
+private import semmle.code.java.dataflow.ExternalFlow
 
 /** A data flow sink for unvalidated user input that is used to construct LDAP queries. */
 abstract class LdapInjectionSink extends DataFlow::Node { }
@@ -28,68 +29,54 @@ class LdapInjectionAdditionalTaintStep extends Unit {
 
 /** Default sink for LDAP injection vulnerabilities. */
 private class DefaultLdapInjectionSink extends LdapInjectionSink {
-  DefaultLdapInjectionSink() {
-    exists(MethodAccess ma, Method m, int index |
-      ma.getMethod() = m and
-      ma.getArgument(index) = this.asExpr() and
-      ldapInjectionSinkMethod(m, index)
-    )
-  }
-}
-
-/** Holds if the method parameter at `index` is susceptible to an LDAP injection attack. */
-private predicate ldapInjectionSinkMethod(Method m, int index) {
-  jndiLdapInjectionSinkMethod(m, index) or
-  unboundIdLdapInjectionSinkMethod(m, index) or
-  springLdapInjectionSinkMethod(m, index) or
-  apacheLdapInjectionSinkMethod(m, index)
-}
-
-/** Holds if the JNDI method parameter at `index` is susceptible to an LDAP injection attack. */
-private predicate jndiLdapInjectionSinkMethod(Method m, int index) {
-  m.getDeclaringType().getAnAncestor() instanceof TypeDirContext and
-  m.hasName("search") and
-  index in [0 .. 1]
-}
-
-/** Holds if the UnboundID method parameter at `index` is susceptible to an LDAP injection attack. */
-private predicate unboundIdLdapInjectionSinkMethod(Method m, int index) {
-  exists(Parameter param | m.getParameter(index) = param and not param.isVarargs() |
-    m instanceof MethodUnboundIdLDAPConnectionSearch or
-    m instanceof MethodUnboundIdLDAPConnectionAsyncSearch or
-    m instanceof MethodUnboundIdLDAPConnectionSearchForEntry
-  )
+  DefaultLdapInjectionSink() { sinkNode(this, "ldap") }
 }
 
-/** Holds if the Spring method parameter at `index` is susceptible to an LDAP injection attack. */
-private predicate springLdapInjectionSinkMethod(Method m, int index) {
-  // LdapTemplate.authenticate, LdapTemplate.find* or LdapTemplate.search* method
-  (
-    m instanceof MethodSpringLdapTemplateAuthenticate or
-    m instanceof MethodSpringLdapTemplateFind or
-    m instanceof MethodSpringLdapTemplateFindOne or
-    m instanceof MethodSpringLdapTemplateSearch or
-    m instanceof MethodSpringLdapTemplateSearchForContext or
-    m instanceof MethodSpringLdapTemplateSearchForObject
-  ) and
-  (
-    // Parameter index is 1 (DN or query) or 2 (filter) if method is not authenticate
-    index in [0 .. 1] and
-    not m instanceof MethodSpringLdapTemplateAuthenticate
-    or
-    // But it's not the last parameter in case of authenticate method (last param is password)
-    index in [0 .. 1] and
-    index < m.getNumberOfParameters() - 1 and
-    m instanceof MethodSpringLdapTemplateAuthenticate
-  )
-}
-
-/** Holds if the Apache LDAP API method parameter at `index` is susceptible to an LDAP injection attack. */
-private predicate apacheLdapInjectionSinkMethod(Method m, int index) {
-  exists(Parameter param | m.getParameter(index) = param and not param.isVarargs() |
-    m.getDeclaringType().getAnAncestor() instanceof TypeApacheLdapConnection and
-    m.hasName("search")
-  )
+private class DefaultLdapInjectionSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        // jndi
+        "javax.naming.directory;DirContext;true;search;;;Argument[0..1];ldap",
+        // apache
+        "org.apache.directory.ldap.client.api;LdapConnection;true;search;;;Argument[0..2];ldap",
+        // UnboundID: search
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(ReadOnlySearchRequest);;Argument[0];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchRequest);;Argument[0];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,DereferencePolicy,int,int,boolean,Filter,String[]);;Argument[0..7];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,DereferencePolicy,int,int,boolean,String,String[]);;Argument[0..7];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,Filter,String[]]);;Argument[0..3];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,String,String[]]);;Argument[0..3];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,Filter,String[]]);;Argument[0..6];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,String,String[]]);;Argument[0..6];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,Filter,String[]]);;Argument[0..2];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,String,String[]]);;Argument[0..2];ldap",
+        // UnboundID: searchForEntry
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(ReadOnlySearchRequest);;Argument[0];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(SearchRequest);;Argument[0];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(String,SearchScope,DereferencePolicy,int,boolean,Filter,String[]);;Argument[0..5];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(String,SearchScope,DereferencePolicy,int,boolean,String,String[]);;Argument[0..5];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(String,SearchScope,Filter,String[]);;Argument[0..2];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(String,SearchScope,String,String[]);;Argument[0..2];ldap",
+        // UnboundID: asyncSearch
+        "com.unboundid.ldap.sdk;LDAPConnection;false;asyncSearch;;;Argument[0];ldap",
+        // Spring
+        "org.springframework.ldap.core;LdapTemplate;false;find;;;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;findOne;;;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;search;;;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;searchForContext;;;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;searchForObject;;;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;;;Argument[0];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticationErrorCallback);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticationErrorCallback);;Argument[1];ldap"
+      ]
+  }
 }
 
 /** A sanitizer that clears the taint on (boxed) primitive types. */

From b9ce1aefc09f72f53a3ecc1940fe396a679433be Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 30 Mar 2021 09:31:38 +0200
Subject: [PATCH 139/433] Java: Convert unsafe URL opening sinks to CSV format

---
 java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql   | 17 ++---------------
 .../semmle/code/java/dataflow/ExternalFlow.qll  |  9 ++++++++-
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
index 306bf27ab9c0..d1bce930054a 100644
--- a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
+++ b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
@@ -13,6 +13,7 @@ import java
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.frameworks.Networking
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 class HTTPString extends StringLiteral {
   HTTPString() {
@@ -30,26 +31,12 @@ class HTTPString extends StringLiteral {
   }
 }
 
-class URLOpenMethod extends Method {
-  URLOpenMethod() {
-    this.getDeclaringType().getQualifiedName() = "java.net.URL" and
-    (
-      this.getName() = "openConnection" or
-      this.getName() = "openStream"
-    )
-  }
-}
-
 class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
   HTTPStringToURLOpenMethodFlowConfig() { this = "HttpsUrls::HTTPStringToURLOpenMethodFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HTTPString }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess m |
-      sink.asExpr() = m.getQualifier() and m.getMethod() instanceof URLOpenMethod
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "open-url") }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(UrlConstructorCall u |
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 4bb79e84ead9..ece2c7cff749 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -184,7 +184,14 @@ private predicate sourceModelCsv(string row) {
     ]
 }
 
-private predicate sinkModelCsv(string row) { none() }
+private predicate sinkModelCsv(string row) {
+  row =
+    [
+      // Open URL
+      "java.net;URL;false;openConnection;;;Argument[-1];open-url",
+      "java.net;URL;false;openStream;;;Argument[-1];open-url"
+    ]
+}
 
 private predicate summaryModelCsv(string row) {
   row =

From 9e2832a82d7e3f51c7967c8aafee2d48c01b8b2c Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 30 Mar 2021 16:24:32 +0200
Subject: [PATCH 140/433] Java: Convert zipslip sinks to CSV format

---
 java/ql/src/Security/CWE/CWE-022/ZipSlip.ql   | 31 ++-----------------
 .../code/java/dataflow/ExternalFlow.qll       | 16 +++++++++-
 2 files changed, 17 insertions(+), 30 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql b/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
index 7d74f8b79ac4..80de02d70679 100644
--- a/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
+++ b/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
@@ -17,6 +17,7 @@ import semmle.code.java.dataflow.SSA
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow
 import PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A method that returns the name of an archive entry.
@@ -33,34 +34,6 @@ class ArchiveEntryNameMethod extends Method {
   }
 }
 
-/**
- * An expression that will be treated as the destination of a write.
- */
-class WrittenFileName extends Expr {
-  WrittenFileName() {
-    // Constructors that write to their first argument.
-    exists(ConstructorCall ctr | this = ctr.getArgument(0) |
-      exists(Class c | ctr.getConstructor() = c.getAConstructor() |
-        c.hasQualifiedName("java.io", "FileOutputStream") or
-        c.hasQualifiedName("java.io", "RandomAccessFile") or
-        c.hasQualifiedName("java.io", "FileWriter")
-      )
-    )
-    or
-    // Methods that write to their n'th argument
-    exists(MethodAccess call, int n | this = call.getArgument(n) |
-      call.getMethod().getDeclaringType().hasQualifiedName("java.nio.file", "Files") and
-      (
-        call.getMethod().getName().regexpMatch("new.*Reader|newOutputStream|create.*") and n = 0
-        or
-        call.getMethod().hasName("copy") and n = 1
-        or
-        call.getMethod().hasName("move") and n = 1
-      )
-    )
-  }
-}
-
 /**
  * Holds if `n1` to `n2` is a dataflow step that converts between `String`,
  * `File`, and `Path`.
@@ -151,7 +124,7 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {
     source.asExpr().(MethodAccess).getMethod() instanceof ArchiveEntryNameMethod
   }
 
-  override predicate isSink(Node sink) { sink.asExpr() instanceof WrittenFileName }
+  override predicate isSink(Node sink) { sinkNode(sink, "create-file") }
 
   override predicate isAdditionalTaintStep(Node n1, Node n2) {
     filePathStep(n1, n2) or fileTaintStep(n1, n2)
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index ece2c7cff749..2aa0b1d14e47 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -189,7 +189,21 @@ private predicate sinkModelCsv(string row) {
     [
       // Open URL
       "java.net;URL;false;openConnection;;;Argument[-1];open-url",
-      "java.net;URL;false;openStream;;;Argument[-1];open-url"
+      "java.net;URL;false;openStream;;;Argument[-1];open-url",
+      // Create file
+      "java.io;FileOutputStream;false;FileOutputStream;;;Argument[0];create-file",
+      "java.io;RandomAccessFile;false;RandomAccessFile;;;Argument[0];create-file",
+      "java.io;FileWriter;false;FileWriter;;;Argument[0];create-file",
+      "java.nio.file;Files;false;move;;;Argument[1];create-file",
+      "java.nio.file;Files;false;copy;;;Argument[1];create-file",
+      "java.nio.file;Files;false;newOutputStream;;;Argument[0];create-file",
+      "java.nio.file;Files;false;newBufferedReader;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createDirectory;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createFile;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createLink;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createSymbolicLink;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createTempDirectory;;;Argument[0];create-file",
+      "java.nio.file;Files;false;createTempFile;;;Argument[0];create-file"
     ]
 }
 

From 0a6aef71a2f957386f895d594f227a0c67c387be Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 9 Apr 2021 12:29:13 +0200
Subject: [PATCH 141/433] C++: Respond to review comments.

---
 .../cpp/dataflow/internal/DataFlowUtil.qll    |  4 +-
 .../code/cpp/dataflow/internal/FlowVar.qll    | 76 +++++++++----------
 .../dataflow/taint-tests/localTaint.expected  |  2 -
 3 files changed, 37 insertions(+), 45 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index baf5f72b75b6..810c74e3e699 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -326,7 +326,7 @@ private class VariablePartialDefinitionNode extends PartialDefinitionNode {
  * A synthetic data flow node used for flow into a collection when an iterator
  * write occurs in a callee.
  */
-class IteratorPartialDefinitionNode extends PartialDefinitionNode {
+private class IteratorPartialDefinitionNode extends PartialDefinitionNode {
   override IteratorPartialDefinition pd;
 
   override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
@@ -338,7 +338,7 @@ class IteratorPartialDefinitionNode extends PartialDefinitionNode {
  * A synthetic data flow node used for flow into a collection when a smart pointer
  * write occurs in a callee.
  */
-class SmartPointerPartialDefinitionNode extends PartialDefinitionNode {
+private class SmartPointerPartialDefinitionNode extends PartialDefinitionNode {
   override SmartPointerPartialDefinition pd;
 
   override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index 29b6cd691a45..0e5d6ea5fa74 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -159,18 +159,14 @@ private module PartialDefinitions {
     Expr innerDefinedExpr;
 
     IteratorPartialDefinition() {
-      exists(Expr convertedInner |
-        not this instanceof Conversion and
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted() and
-        (
-          innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
-          or
-          innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
-          collection instanceof IteratorParameter
-        ) and
-        innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
-      )
+      innerDefinedExpr = getInnerDefinedExpr(this, node) and
+      (
+        innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
+        or
+        innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
+        collection instanceof IteratorParameter
+      ) and
+      innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
       or
       // iterators passed by value without a copy constructor
       exists(Call call |
@@ -208,16 +204,18 @@ private module PartialDefinitions {
     }
   }
 
+  private Expr getInnerDefinedExpr(Expr e, ControlFlowNode node) {
+    not e instanceof Conversion and
+    exists(Expr convertedInner |
+      valueToUpdate(convertedInner, e.getFullyConverted(), node) and
+      result = convertedInner.getUnconverted()
+    )
+  }
+
   class VariablePartialDefinition extends PartialDefinition {
     Expr innerDefinedExpr;
 
-    VariablePartialDefinition() {
-      not this instanceof Conversion and
-      exists(Expr convertedInner |
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted()
-      )
-    }
+    VariablePartialDefinition() { innerDefinedExpr = getInnerDefinedExpr(this, node) }
 
     deprecated override predicate partiallyDefines(Variable v) {
       innerDefinedExpr = v.getAnAccess()
@@ -249,30 +247,15 @@ private module PartialDefinitions {
     Expr innerDefinedExpr;
 
     SmartPointerPartialDefinition() {
-      exists(Expr convertedInner |
-        not this instanceof Conversion and
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted() and
-        innerDefinedExpr = getAPointerWrapperAccess(pointer)
-      )
+      innerDefinedExpr = pragma[only_bind_out](getInnerDefinedExpr(this, node)) and
+      innerDefinedExpr = getAPointerWrapperAccess(pointer, -1)
       or
-      // pointer wrappers passed by value without a copy constructor
+      // Pointer wrappers passed to a function by value.
       exists(Call call |
         call = node and
         call.getAnArgument() = innerDefinedExpr and
         innerDefinedExpr = this and
-        this = getAPointerWrapperAccess(pointer) and
-        not call instanceof OverloadedPointerDereferenceExpr
-      )
-      or
-      // pointer wrappers passed by value with a copy constructor
-      exists(Call call, ConstructorCall copy |
-        copy.getTarget() instanceof CopyConstructor and
-        call = node and
-        call.getAnArgument() = copy and
-        copy.getArgument(0) = getAPointerWrapperAccess(pointer) and
-        innerDefinedExpr = this and
-        this = copy and
+        this = getAPointerWrapperAccess(pointer, 0) and
         not call instanceof OverloadedPointerDereferenceExpr
       )
     }
@@ -893,9 +876,20 @@ module FlowVar_internal {
     )
   }
 
-  Call getAPointerWrapperAccess(Variable pointer) {
-    pointer.getUnspecifiedType() instanceof PointerWrapper and
-    [result.getQualifier(), result.getAnArgument()] = pointer.getAnAccess()
+  /**
+   * Gets either:
+   * - A call to an unwrapper function, where an access to `pointer` is the qualifier, or
+   * - A call to the `CopyConstructor` that copies the value of an access to `pointer`.
+   */
+  Call getAPointerWrapperAccess(Variable pointer, int n) {
+    exists(PointerWrapper wrapper | wrapper = pointer.getUnspecifiedType().stripType() |
+      n = -1 and
+      result.getQualifier() = pointer.getAnAccess() and
+      result.getTarget() = wrapper.getAnUnwrapperFunction()
+      or
+      result.getArgument(n) = pointer.getAnAccess() and
+      result.getTarget() instanceof CopyConstructor
+    )
   }
 
   class IteratorParameter extends Parameter {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index e10014278187..a5c8f00ecabb 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3223,7 +3223,6 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:12:10:12:10 | call to operator* [post update] | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
@@ -3234,7 +3233,6 @@
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:24:10:24:10 | call to operator* [post update] | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |

From f329c3fdab6064ffd82b2a3a54de826395c08c9e Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 31 Mar 2021 10:09:58 +0200
Subject: [PATCH 142/433] Java: Convert insecure bean validation sink to CSV
 format

---
 .../CWE/CWE-094/InsecureBeanValidation.ql     | 21 ++-----------------
 .../code/java/dataflow/ExternalFlow.qll       |  4 +++-
 2 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql b/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
index 6b8ab0851329..e4ee42008a17 100644
--- a/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
+++ b/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
@@ -13,6 +13,7 @@ import java
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.FlowSources
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A message interpolator Type that perform Expression Language (EL) evaluations
@@ -50,19 +51,6 @@ class SetMessageInterpolatorCall extends MethodAccess {
   predicate isSafe() { not this.getAnArgument().getType() instanceof ELMessageInterpolatorType }
 }
 
-/**
- * A method named `buildConstraintViolationWithTemplate` declared on a subtype
- * of `javax.validation.ConstraintValidatorContext`.
- */
-class BuildConstraintViolationWithTemplateMethod extends Method {
-  BuildConstraintViolationWithTemplateMethod() {
-    this.getDeclaringType()
-        .getASupertype*()
-        .hasQualifiedName("javax.validation", "ConstraintValidatorContext") and
-    this.hasName("buildConstraintViolationWithTemplate")
-  }
-}
-
 /**
  * Taint tracking BeanValidationConfiguration describing the flow of data from user input
  * to the argument of a method that builds constraint error messages.
@@ -72,12 +60,7 @@ class BeanValidationConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      ma.getMethod() instanceof BuildConstraintViolationWithTemplateMethod and
-      sink.asExpr() = ma.getArgument(0)
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "bean-validation") }
 }
 
 from BeanValidationConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 2aa0b1d14e47..337f26d82c63 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -203,7 +203,9 @@ private predicate sinkModelCsv(string row) {
       "java.nio.file;Files;false;createLink;;;Argument[0];create-file",
       "java.nio.file;Files;false;createSymbolicLink;;;Argument[0];create-file",
       "java.nio.file;Files;false;createTempDirectory;;;Argument[0];create-file",
-      "java.nio.file;Files;false;createTempFile;;;Argument[0];create-file"
+      "java.nio.file;Files;false;createTempFile;;;Argument[0];create-file",
+      // Bean validation
+      "javax.validation;ConstraintValidatorContext;true;buildConstraintViolationWithTemplate;;;Argument[0];bean-validation"
     ]
 }
 

From 0b7a6671dd75b8cd1ab54cac2b7d0cbd8604dd2a Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 31 Mar 2021 10:16:14 +0200
Subject: [PATCH 143/433] Java: Convert header splitting sinks to CSV format

---
 .../code/java/dataflow/ExternalFlow.qll       |  1 +
 .../code/java/security/ResponseSplitting.qll  | 43 +++++++------------
 2 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 337f26d82c63..f728c0f9fcaf 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -76,6 +76,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.ApacheHttp
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
+  private import semmle.code.java.security.ResponseSplitting
 }
 
 private predicate sourceModelCsv(string row) {
diff --git a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
index d09e6567b152..040174d50b50 100644
--- a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
+++ b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
@@ -5,41 +5,30 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.Servlets
 import semmle.code.java.frameworks.JaxWS
+private import semmle.code.java.dataflow.ExternalFlow
 
 /** A sink that is vulnerable to an HTTP header splitting attack. */
-abstract class HeaderSplittingSink extends DataFlow::Node { }
+class HeaderSplittingSink extends DataFlow::Node {
+  HeaderSplittingSink() { sinkNode(this, "header-splitting") }
+}
+
+private class HeaderSplittingSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.servlet.http;HttpServletResponse;false;addCookie;;;Argument[0];header-splitting",
+        "javax.servlet.http;HttpServletResponse;false;addHeader;;;Argument;header-splitting",
+        "javax.servlet.http;HttpServletResponse;false;setHeader;;;Argument;header-splitting",
+        "javax.ws.rs.core;ResponseBuilder;false;header;;;Argument[1];header-splitting"
+      ]
+  }
+}
 
 /** A source that introduces data considered safe to use by a header splitting source. */
 abstract class SafeHeaderSplittingSource extends DataFlow::Node {
   SafeHeaderSplittingSource() { this instanceof RemoteFlowSource }
 }
 
-/** A sink that identifies a Java Servlet or JaxWs method that is vulnerable to an HTTP header splitting attack. */
-private class ServletHeaderSplittingSink extends HeaderSplittingSink {
-  ServletHeaderSplittingSink() {
-    exists(ResponseAddCookieMethod m, MethodAccess ma |
-      ma.getMethod() = m and
-      this.asExpr() = ma.getArgument(0)
-    )
-    or
-    exists(ResponseAddHeaderMethod m, MethodAccess ma |
-      ma.getMethod() = m and
-      this.asExpr() = ma.getAnArgument()
-    )
-    or
-    exists(ResponseSetHeaderMethod m, MethodAccess ma |
-      ma.getMethod() = m and
-      this.asExpr() = ma.getAnArgument()
-    )
-    or
-    exists(JaxRsResponseBuilder builder, Method m |
-      m = builder.getAMethod() and m.getName() = "header"
-    |
-      this.asExpr() = m.getAReference().getArgument(1)
-    )
-  }
-}
-
 /** A default source that introduces data considered safe to use by a header splitting source. */
 private class DefaultSafeHeaderSplittingSource extends SafeHeaderSplittingSource {
   DefaultSafeHeaderSplittingSource() {

From 17fd758df1ec1c600ef8aef4454485b6c2bf5123 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 31 Mar 2021 10:31:21 +0200
Subject: [PATCH 144/433] Java: Convert XSS sinks to CSV format

---
 .../code/java/dataflow/ExternalFlow.qll       |  1 +
 java/ql/src/semmle/code/java/security/XSS.qll | 28 ++++++++-----------
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index f728c0f9fcaf..402bb7fd7476 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -77,6 +77,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
   private import semmle.code.java.security.ResponseSplitting
+  private import semmle.code.java.security.XSS
 }
 
 private predicate sourceModelCsv(string row) {
diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll
index f51bc0bbdf56..9791eed203b8 100644
--- a/java/ql/src/semmle/code/java/security/XSS.qll
+++ b/java/ql/src/semmle/code/java/security/XSS.qll
@@ -29,33 +29,29 @@ class XssAdditionalTaintStep extends Unit {
   abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
 }
 
+private class DefaultXssSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.servlet.http;HttpServletResponse;false;sendError;(int,String);;Argument[1];xss",
+        "android.webkit;WebView;false;loadData;;;Argument[0];xss",
+        "android.webkit;WebView;false;loadUrl;;;Argument[0];xss",
+        "android.webkit;WebView;false;loadDataWithBaseURL;;;Argument[1];xss"
+      ]
+  }
+}
+
 /** A default sink representing methods susceptible to XSS attacks. */
 private class DefaultXssSink extends XssSink {
   DefaultXssSink() {
     sinkNode(this, "xss")
     or
-    exists(HttpServletResponseSendErrorMethod m, MethodAccess ma |
-      ma.getMethod() = m and
-      this.asExpr() = ma.getArgument(1)
-    )
-    or
     exists(ServletWriterSourceToWritingMethodFlowConfig writer, MethodAccess ma |
       ma.getMethod() instanceof WritingMethod and
       writer.hasFlowToExpr(ma.getQualifier()) and
       this.asExpr() = ma.getArgument(_)
     )
     or
-    exists(Method m |
-      m.getDeclaringType() instanceof TypeWebView and
-      (
-        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadData"
-        or
-        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadUrl"
-        or
-        m.getAReference().getArgument(1) = this.asExpr() and m.getName() = "loadDataWithBaseURL"
-      )
-    )
-    or
     exists(SpringRequestMappingMethod requestMappingMethod, ReturnStmt rs |
       requestMappingMethod = rs.getEnclosingCallable() and
       this.asExpr() = rs.getResult() and

From e544faed6de23be9821771087b22c7ffb87a5005 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 1 Apr 2021 09:11:47 +0200
Subject: [PATCH 145/433] Java: Convert unsafe hostname verification sinks to
 CSV format

---
 .../Security/CWE/CWE-297/UnsafeHostnameVerification.ql | 10 ++--------
 java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll |  5 ++++-
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
index 9c060565f284..058a1f9e1695 100644
--- a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
+++ b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
@@ -15,6 +15,7 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.Encryption
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * Holds if `m` always returns `true` ignoring any exceptional flow.
@@ -49,14 +50,7 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
     source.asExpr().(ClassInstanceExpr).getConstructedType() instanceof TrustAllHostnameVerifier
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma, Method m |
-      (m instanceof SetDefaultHostnameVerifierMethod or m instanceof SetHostnameVerifierMethod) and
-      ma.getMethod() = m
-    |
-      ma.getArgument(0) = sink.asExpr()
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname") }
 
   override predicate isBarrier(DataFlow::Node barrier) {
     // ignore nodes that are in functions that intentionally disable hostname verification
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 402bb7fd7476..ba329d99f21b 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -207,7 +207,10 @@ private predicate sinkModelCsv(string row) {
       "java.nio.file;Files;false;createTempDirectory;;;Argument[0];create-file",
       "java.nio.file;Files;false;createTempFile;;;Argument[0];create-file",
       // Bean validation
-      "javax.validation;ConstraintValidatorContext;true;buildConstraintViolationWithTemplate;;;Argument[0];bean-validation"
+      "javax.validation;ConstraintValidatorContext;true;buildConstraintViolationWithTemplate;;;Argument[0];bean-validation",
+      // Set hostname
+      "javax.net.ssl;HttpsURLConnection;true;setDefaultHostnameVerifier;;;Argument[0];set-hostname",
+      "javax.net.ssl;HttpsURLConnection;true;setHostnameVerifier;;;Argument[0];set-hostname"
     ]
 }
 

From 3e53484bb3b942c58f2bf1b90301a9779ebc34aa Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 1 Apr 2021 09:21:49 +0200
Subject: [PATCH 146/433] Java: Convert Google HTTP client API parseAs  sink to
 CSV format

---
 .../code/java/dataflow/ExternalFlow.qll       |  1 +
 .../frameworks/google/GoogleHttpClientApi.qll | 22 +++++++------------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index ba329d99f21b..154ec98f2ad8 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -76,6 +76,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.ApacheHttp
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
+  private import semmle.code.java.frameworks.google.GoogleHttpClientApi
   private import semmle.code.java.security.ResponseSplitting
   private import semmle.code.java.security.XSS
 }
diff --git a/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll b/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
index ccc446892f12..07e30711b449 100644
--- a/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
+++ b/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
@@ -2,14 +2,7 @@ import java
 import semmle.code.java.Serializability
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.DataFlow5
-
-/** The method `parseAs` in `com.google.api.client.http.HttpResponse`. */
-private class ParseAsMethod extends Method {
-  ParseAsMethod() {
-    this.getDeclaringType().hasQualifiedName("com.google.api.client.http", "HttpResponse") and
-    this.hasName("parseAs")
-  }
-}
+private import semmle.code.java.dataflow.ExternalFlow
 
 private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configuration {
   TypeLiteralToParseAsFlowConfiguration() {
@@ -18,16 +11,17 @@ private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configura
 
   override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof TypeLiteral }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      ma.getAnArgument() = sink.asExpr() and
-      ma.getMethod() instanceof ParseAsMethod
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "google-parse-as") }
 
   TypeLiteral getSourceWithFlowToParseAs() { hasFlow(DataFlow::exprNode(result), _) }
 }
 
+private class ParseAsSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["com.google.api.client.http;HttpResponse;false;parseAs;;;Argument;google-parse-as"]
+  }
+}
+
 /** A field that is deserialized by `HttpResponse.parseAs`. */
 class HttpResponseParseAsDeserializableField extends DeserializableField {
   HttpResponseParseAsDeserializableField() {

From 87d42b02c0c49ff717c941d6ea5290b6ca3c40df Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 31 Mar 2021 10:21:12 +0200
Subject: [PATCH 147/433] Java: Convert other sinks

---
 .../CWE/CWE-209/StackTraceExposure.ql         |  11 +-
 .../Security/CWE/CWE-036/OpenStream.ql        |  15 +-
 .../Security/CWE/CWE-074/XsltInjectionLib.qll |  41 +++--
 .../Security/CWE/CWE-094/JexlInjectionLib.qll | 139 +++++++--------
 .../Security/CWE/CWE-094/MvelInjectionLib.qll |  56 +++---
 .../CWE/CWE-326/InsufficientKeySize.ql        |  23 +--
 .../Security/CWE/CWE-327/SslLib.qll           |  20 ++-
 .../Security/CWE/CWE-346/UnvalidatedCors.ql   |  29 ++-
 .../Security/CWE/CWE-522/InsecureLdapAuth.ql  |  26 +--
 .../Security/CWE/CWE-643/XPathInjection.ql    |  23 +--
 .../Security/CWE/CWE-652/XQueryInjection.ql   |   7 +-
 .../CWE/CWE-652/XQueryInjectionLib.qll        |  12 ++
 .../Security/CWE/CWE-917/OgnlInjectionLib.qll |  26 ++-
 .../Security/CWE/CWE-918/RequestForgery.ql    |   5 +-
 .../Security/CWE/CWE-918/RequestForgery.qll   | 168 ++++--------------
 .../code/java/dataflow/ExternalFlow.qll       |  23 ++-
 .../java/security/UnsafeDeserialization.qll   |  32 ++--
 17 files changed, 302 insertions(+), 354 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
index c9c1e2917c0e..1f49d5cb06ac 100644
--- a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+++ b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -16,6 +16,7 @@ import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.XSS
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * One of the `printStackTrace()` overloads on `Throwable`.
@@ -37,10 +38,12 @@ class ServletWriterSourceToPrintStackTraceMethodFlowConfig extends TaintTracking
 
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof ServletWriterSource }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      sink.asExpr() = ma.getAnArgument() and ma.getMethod() instanceof PrintStackTraceMethod
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "print-stack-trace") }
+}
+
+private class PrintStackTraceSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["java.lang;Throwable;true;printStackTrace;;;Argument;print-stack-trace"]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
index 871d6bb4737c..6f75b3fc8ae5 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
@@ -15,6 +15,7 @@ import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.ExternalFlow
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 class URLConstructor extends ClassInstanceExpr {
   URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }
@@ -39,13 +40,7 @@ class RemoteURLToOpenStreamFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess m |
-      sink.asExpr() = m.getQualifier() and m.getMethod() instanceof URLOpenStreamMethod
-    )
-    or
-    sinkNode(sink, "url-open-stream")
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "url-open-stream") }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(URLConstructor u |
@@ -55,6 +50,12 @@ class RemoteURLToOpenStreamFlowConfig extends TaintTracking::Configuration {
   }
 }
 
+private class URLOpenStreamSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["java.net;URL;false;openStream;;;Argument[-1];url-open-stream"]
+  }
+}
+
 from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess call
 where
   sink.getNode().asExpr() = call.getQualifier() and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
index 4ba0eb6d0b11..bc0c8352a20f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
@@ -2,6 +2,7 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.XmlParsers
 import DataFlow
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unvalidated user input that is used in XSLT transformation.
@@ -103,15 +104,20 @@ class TypeXsltPackage extends Class {
 
 /** A data flow sink for unvalidated user input that is used in XSLT transformation. */
 class XsltInjectionSink extends DataFlow::ExprNode {
-  XsltInjectionSink() {
-    exists(MethodAccess ma, Method m | m = ma.getMethod() and ma.getQualifier() = this.getExpr() |
-      ma instanceof TransformerTransform or
-      m instanceof XsltTransformerTransformMethod or
-      m instanceof Xslt30TransformerTransformMethod or
-      m instanceof Xslt30TransformerApplyTemplatesMethod or
-      m instanceof Xslt30TransformerCallFunctionMethod or
-      m instanceof Xslt30TransformerCallTemplateMethod
-    )
+  XsltInjectionSink() { sinkNode(this, "xslt") }
+}
+
+private class XsltInjectionSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "net.sf.saxon.s9api;XsltTransformer;false;transform;;;Argument[-1];xslt",
+        "net.sf.saxon.s9api;Xslt30Transformer;false;transform;;;Argument[-1];xslt",
+        "net.sf.saxon.s9api;Xslt30Transformer;false;applyTemplates;;;Argument[-1];xslt",
+        "net.sf.saxon.s9api;Xslt30Transformer;false;callFunction;;;Argument[-1];xslt",
+        "net.sf.saxon.s9api;Xslt30Transformer;false;callTemplate;;;Argument[-1];xslt",
+        "javax.xml.transform;Transformer;false;transform;;;Argument[-1];xslt"
+      ]
   }
 }
 
@@ -186,16 +192,21 @@ private class TransformerFactoryWithSecureProcessingFeatureFlowConfig extends Da
     )
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      sink.asExpr() = ma.getQualifier() and
-      ma.getMethod().getDeclaringType() instanceof TransformerFactory
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "xslt-transformer") }
 
   override int fieldFlowBranchLimit() { result = 0 }
 }
 
+private class TransformerFactorySinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.xml.transform;TransformerFactory;false;;;;Argument[-1];xslt-transformer",
+        "javax.xml.transform.sax;SAXTransformerFactory;false;;;;Argument[-1];xslt-transformer"
+      ]
+  }
+}
+
 /** A `ParserConfig` specific to `TransformerFactory`. */
 private class TransformerFactoryFeatureConfig extends ParserConfig {
   TransformerFactoryFeatureConfig() {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
index 561d7e46ae90..8fcde750e54c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -1,6 +1,7 @@
 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe user input
@@ -21,7 +22,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
 }
 
 /**
- * A sink for Expresssion Language injection vulnerabilities via Jexl,
+ * A sink for Expression Language injection vulnerabilities via Jexl,
  * i.e. method calls that run evaluation of a JEXL expression.
  *
  * Creating a `Callable` from a tainted JEXL expression or script is considered as a sink
@@ -30,18 +31,41 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
  * maybe stored in an object field and then reached by a different flow.
  */
 private class JexlEvaluationSink extends DataFlow::ExprNode {
-  JexlEvaluationSink() {
-    exists(MethodAccess ma, Method m, Expr taintFrom |
-      ma.getMethod() = m and taintFrom = this.asExpr()
-    |
-      m instanceof DirectJexlEvaluationMethod and ma.getQualifier() = taintFrom
-      or
-      m instanceof CreateJexlCallableMethod and ma.getQualifier() = taintFrom
-      or
-      m instanceof JexlEngineGetSetPropertyMethod and
-      taintFrom.getType() instanceof TypeString and
-      ma.getAnArgument() = taintFrom
-    )
+  JexlEvaluationSink() { sinkNode(this, "jexl") }
+}
+
+private class JexlEvaluationSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        // Direct JEXL evaluation
+        "org.apache.commons.jexl2;Expression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JexlExpression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;Script;false;execute;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JexlScript;false;execute;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
+        // JEXL callable
+        "org.apache.commons.jexl2;Expression;false;callable;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JexlExpression;false;callable;;;Argument[-1];jexl",
+        "org.apache.commons.jexl2;Script;false;callable;;;Argument[-1];jexl",
+        "org.apache.commons.jexl3;JexlScript;false;callable;;;Argument[-1];jexl",
+        // Methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
+        "org.apache.commons.jexl2;JexlEngine;false;getProperty;;;Argument[1..2];jexl",
+        "org.apache.commons.jexl3;JexlEngine;false;getProperty;;;Argument[1..2];jexl",
+        "org.apache.commons.jexl2;JexlEngine;false;setProperty;;;Argument[1];jexl",
+        "org.apache.commons.jexl3;JexlEngine;false;setProperty;;;Argument[1];jexl"
+      ]
   }
 }
 
@@ -98,22 +122,36 @@ private class SandboxedJexlFlowConfig extends DataFlow2::Configuration {
 
   override predicate isSource(DataFlow::Node node) { node instanceof SandboxedJexlSource }
 
-  override predicate isSink(DataFlow::Node node) {
-    exists(MethodAccess ma, Method m | ma.getMethod() = m |
-      (
-        m instanceof CreateJexlScriptMethod or
-        m instanceof CreateJexlExpressionMethod or
-        m instanceof CreateJexlTemplateMethod
-      ) and
-      ma.getQualifier() = node.asExpr()
-    )
-  }
+  override predicate isSink(DataFlow::Node node) { sinkNode(node, "sandboxed-jexl") }
 
   override predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
     createsJexlEngine(fromNode, toNode)
   }
 }
 
+private class SandboxedJexlEvaluationSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        // CreateJexlScriptMethod
+        "org.apache.commons.jexl2;JexlEngine;false;createScript;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;JexlEngine;false;createScript;;;Argument[-1];sandboxed-jexl",
+        // CreateJexlExpressionMethod
+        "org.apache.commons.jexl2;UnifiedJEXL;false;parse;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;UnifiedJEXL;false;parse;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl2;JxltEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;JxltEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl2;JexlEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;JexlEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
+        // CreateJexlTemplateMethod
+        "org.apache.commons.jexl2;JxltEngine;false;createTemplate;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;JxltEngine;false;createTemplate;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl2;UnifiedJEXL;false;createTemplate;;;Argument[-1];sandboxed-jexl",
+        "org.apache.commons.jexl3;UnifiedJEXL;false;createTemplate;;;Argument[-1];sandboxed-jexl"
+      ]
+  }
+}
+
 /**
  * Defines a data flow source for JEXL engines configured with a sandbox.
  */
@@ -164,35 +202,6 @@ private predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node to
   )
 }
 
-/**
- * A methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
- */
-private class JexlEngineGetSetPropertyMethod extends Method {
-  JexlEngineGetSetPropertyMethod() {
-    getDeclaringType() instanceof JexlEngine and
-    hasName(["getProperty", "setProperty"])
-  }
-}
-
-/**
- * A method that triggers direct evaluation of JEXL expressions.
- */
-private class DirectJexlEvaluationMethod extends Method {
-  DirectJexlEvaluationMethod() {
-    getDeclaringType() instanceof JexlExpression and hasName("evaluate")
-    or
-    getDeclaringType() instanceof JexlScript and hasName("execute")
-    or
-    getDeclaringType() instanceof JxltEngineExpression and hasName(["evaluate", "prepare"])
-    or
-    getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate")
-    or
-    getDeclaringType() instanceof UnifiedJexlExpression and hasName(["evaluate", "prepare"])
-    or
-    getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
-  }
-}
-
 /**
  * A method that creates a JEXL script.
  */
@@ -200,16 +209,6 @@ private class CreateJexlScriptMethod extends Method {
   CreateJexlScriptMethod() { getDeclaringType() instanceof JexlEngine and hasName("createScript") }
 }
 
-/**
- * A method that creates a `Callable` for a JEXL expression or script.
- */
-private class CreateJexlCallableMethod extends Method {
-  CreateJexlCallableMethod() {
-    (getDeclaringType() instanceof JexlExpression or getDeclaringType() instanceof JexlScript) and
-    hasName("callable")
-  }
-}
-
 /**
  * A method that creates a JEXL template.
  */
@@ -267,22 +266,6 @@ private class JexlUberspect extends Interface {
   }
 }
 
-private class JxltEngineExpression extends NestedType {
-  JxltEngineExpression() { getEnclosingType() instanceof JxltEngine and hasName("Expression") }
-}
-
-private class JxltEngineTemplate extends NestedType {
-  JxltEngineTemplate() { getEnclosingType() instanceof JxltEngine and hasName("Template") }
-}
-
-private class UnifiedJexlExpression extends NestedType {
-  UnifiedJexlExpression() { getEnclosingType() instanceof UnifiedJexl and hasName("Expression") }
-}
-
-private class UnifiedJexlTemplate extends NestedType {
-  UnifiedJexlTemplate() { getEnclosingType() instanceof UnifiedJexl and hasName("Template") }
-}
-
 private class Reader extends RefType {
   Reader() { hasQualifiedName("java.io", "Reader") }
 }
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
index a6cf891330f0..dec268a2a4bc 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
@@ -1,6 +1,7 @@
 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe user input
@@ -30,36 +31,31 @@ class MvelInjectionConfig extends TaintTracking::Configuration {
  * i.e. methods that run evaluation of a MVEL expression.
  */
 class MvelEvaluationSink extends DataFlow::ExprNode {
-  MvelEvaluationSink() {
-    exists(StaticMethodAccess ma, Method m | m = ma.getMethod() |
-      (
-        m instanceof MvelEvalMethod or
-        m instanceof TemplateRuntimeEvaluationMethod
-      ) and
-      ma.getArgument(0) = asExpr()
-    )
-    or
-    exists(MethodAccess ma, Method m | m = ma.getMethod() |
-      m instanceof MvelScriptEngineEvaluationMethod and
-      ma.getArgument(0) = asExpr()
-    )
-    or
-    exists(MethodAccess ma, Method m | m = ma.getMethod() |
-      (
-        m instanceof ExecutableStatementEvaluationMethod or
-        m instanceof CompiledExpressionEvaluationMethod or
-        m instanceof CompiledAccExpressionEvaluationMethod or
-        m instanceof AccessorEvaluationMethod or
-        m instanceof CompiledScriptEvaluationMethod or
-        m instanceof MvelCompiledScriptEvaluationMethod
-      ) and
-      ma.getQualifier() = asExpr()
-    )
-    or
-    exists(StaticMethodAccess ma, Method m | m = ma.getMethod() |
-      m instanceof MvelRuntimeEvaluationMethod and
-      ma.getArgument(1) = asExpr()
-    )
+  MvelEvaluationSink() { sinkNode(this, "mvel") }
+}
+
+private class MvelEvaluationSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.mvel2.jsr223;MvelScriptEngine;false;evaluate;;;Argument[0];mvel",
+        "org.mvel2.jsr223;MvelScriptEngine;false;eval;;;Argument[0];mvel",
+        "org.mvel2.compiler;ExecutableStatement;false;getValue;;;Argument[-1];mvel",
+        "org.mvel2.compiler;CompiledExpression;false;getDirectValue;;;Argument[-1];mvel",
+        "org.mvel2.compiler;CompiledAccExpression;false;getValue;;;Argument[-1];mvel",
+        "org.mvel2.compiler;Accessor;false;getValue;;;Argument[-1];mvel",
+        "javax.script;CompiledScript;false;eval;;;Argument[-1];mvel",
+        "org.mvel2.jsr223;MvelCompiledScript;false;eval;;;Argument[-1];mvel",
+        "org.mvel2;MVEL;false;eval;;;Argument[0];mvel",
+        "org.mvel2;MVEL;false;executeExpression;;;Argument[0];mvel",
+        "org.mvel2;MVEL;false;evalToBoolean;;;Argument[0];mvel",
+        "org.mvel2;MVEL;false;evalToString;;;Argument[0];mvel",
+        "org.mvel2;MVEL;false;executeAllExpression;;;Argument[0];mvel",
+        "org.mvel2;MVEL;false;executeSetExpression;;;Argument[0];mvel",
+        "org.mvel2.templates;TemplateRuntime;false;eval;;;Argument[0];mvel",
+        "org.mvel2.templates;TemplateRuntime;false;execute;;;Argument[0];mvel",
+        "org.mvel2;MVELRuntime;false;execute;;;Argument[1];mvel"
+      ]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
index 155d05abfae3..ca86f42c561a 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
@@ -12,6 +12,7 @@
 import java
 import semmle.code.java.security.Encryption
 import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.ExternalFlow
 
 /** The Java class `java.security.spec.ECGenParameterSpec`. */
 class ECGenParameterSpec extends RefType {
@@ -55,11 +56,12 @@ class KeyGeneratorInitConfiguration extends TaintTracking::Configuration {
     exists(JavaxCryptoKeyGenerator jcg | jcg = source.asExpr())
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      ma.getMethod() instanceof KeyGeneratorInitMethod and
-      sink.asExpr() = ma.getQualifier()
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "keygen") }
+}
+
+private class KeyGeneratorInitSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["javax.crypto;KeyGenerator;false;init;;;Argument[-1];keygen"]
   }
 }
 
@@ -71,11 +73,12 @@ class KeyPairGeneratorInitConfiguration extends TaintTracking::Configuration {
     exists(JavaSecurityKeyPairGenerator jkg | jkg = source.asExpr())
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      ma.getMethod() instanceof KeyPairGeneratorInitMethod and
-      sink.asExpr() = ma.getQualifier()
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "keypairgen") }
+}
+
+private class KeyPairGeneratorInitSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["java.security;KeyPairGenerator;false;initialize;;;Argument[-1];keypairgen"]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll b/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
index bfa2530b07e7..3845953f0aab 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
@@ -3,6 +3,7 @@ import semmle.code.java.security.Encryption
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow
 import PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe SSL and TLS versions.
@@ -12,11 +13,20 @@ class UnsafeTlsVersionConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof UnsafeTlsVersion }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink instanceof SslContextGetInstanceSink or
-    sink instanceof CreateSslParametersSink or
-    sink instanceof SslParametersSetProtocolsSink or
-    sink instanceof SetEnabledProtocolsSink
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ssl") }
+}
+
+private class UnsafeTlsVersionSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.net.ssl;SSLContext;false;getInstance;;;Argument[0];ssl",
+        "javax.net.ssl;SSLParameters;false;SSLParameters;;;Argument[1];ssl",
+        "javax.net.ssl;SSLParameters;false;setProtocols;;;Argument[0];ssl",
+        "javax.net.ssl;SSLSocket;false;setEnabledProtocols;;;Argument[0];ssl",
+        "javax.net.ssl;SSLServerSocket;false;setEnabledProtocols;;;Argument[0];ssl",
+        "javax.net.ssl;SSLEngine;false;setEnabledProtocols;;;Argument[0];ssl"
+      ]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
index c5a6c36d6a61..2fe6569318fc 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
@@ -15,6 +15,7 @@ import semmle.code.java.frameworks.Servlets
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.TaintTracking2
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  *  Holds if `header` sets `Access-Control-Allow-Credentials` to `true`. This ensures fair chances of exploitability.
@@ -29,33 +30,29 @@ private predicate setsAllowCredentials(MethodAccess header) {
   header.getArgument(1).(CompileTimeConstantExpr).getStringValue().toLowerCase() = "true"
 }
 
-private class CorsProbableCheckAccess extends MethodAccess {
-  CorsProbableCheckAccess() {
-    getMethod().hasName("contains") and
-    getMethod().getDeclaringType().getASourceSupertype*() instanceof CollectionType
-    or
-    getMethod().hasName("containsKey") and
-    getMethod().getDeclaringType().getASourceSupertype*() instanceof MapType
-    or
-    getMethod().hasName("equals") and
-    getQualifier().getType() instanceof TypeString
-  }
-}
-
 private Expr getAccessControlAllowOriginHeaderName() {
   result.(CompileTimeConstantExpr).getStringValue().toLowerCase() = "access-control-allow-origin"
 }
 
 /**
- * This taintflow2 configuration checks if there is a flow from source node towards CorsProbableCheckAccess methods.
+ * This taintflow2 configuration checks if there is a flow from source node towards probably CORS checking methods.
  */
 class CorsSourceReachesCheckConfig extends TaintTracking2::Configuration {
   CorsSourceReachesCheckConfig() { this = "CorsOriginConfig" }
 
   override predicate isSource(DataFlow::Node source) { any(CorsOriginConfig c).hasFlow(source, _) }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() = any(CorsProbableCheckAccess check).getAnArgument()
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "cors") }
+}
+
+private class CorsProbableCheckAccessSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "java.util;Collection;true;contains;;;Argument;cors",
+        "java.util;Map;true;containsKey;;;Argument;cors",
+        "java.lang;String;true;equals;;;Argument;cors"
+      ]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
index 4ce2b8b7134c..3c445934ad33 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
@@ -16,6 +16,7 @@ import semmle.code.java.frameworks.Jndi
 import semmle.code.java.frameworks.Networking
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * Insecure (non-SSL, non-private) LDAP URL string literal.
@@ -145,12 +146,7 @@ class InsecureUrlFlowConfig extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof InsecureLdapUrl }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) {
-    exists(ConstructorCall cc |
-      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
-      sink.asExpr() = cc.getArgument(0)
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
 
   /** Method call of `env.put()`. */
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
@@ -176,11 +172,12 @@ class BasicAuthFlowConfig extends DataFlow::Configuration {
   }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) {
-    exists(ConstructorCall cc |
-      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
-      sink.asExpr() = cc.getArgument(0)
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
+}
+
+private class LdapSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row = ["javax.naming.directory;DirContext;true;.ctor;;;Argument[0];ldap"]
   }
 }
 
@@ -198,12 +195,7 @@ class SSLFlowConfig extends DataFlow::Configuration {
   }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) {
-    exists(ConstructorCall cc |
-      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
-      sink.asExpr() = cc.getArgument(0)
-    )
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
 }
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureUrlFlowConfig config
diff --git a/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
index e5a29df46d59..598f42b0c703 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
@@ -15,6 +15,7 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.XmlParsers
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 class XPathInjectionConfiguration extends TaintTracking::Configuration {
   XPathInjectionConfiguration() { this = "XPathInjection" }
@@ -25,16 +26,18 @@ class XPathInjectionConfiguration extends TaintTracking::Configuration {
 }
 
 class XPathInjectionSink extends DataFlow::ExprNode {
-  XPathInjectionSink() {
-    exists(Method m, MethodAccess ma | ma.getMethod() = m |
-      m.getDeclaringType().hasQualifiedName("javax.xml.xpath", "XPath") and
-      (m.hasName("evaluate") or m.hasName("compile")) and
-      ma.getArgument(0) = this.getExpr()
-      or
-      m.getDeclaringType().hasQualifiedName("org.dom4j", "Node") and
-      (m.hasName("selectNodes") or m.hasName("selectSingleNode")) and
-      ma.getArgument(0) = this.getExpr()
-    )
+  XPathInjectionSink() { sinkNode(this, "xpath") }
+}
+
+private class XPathInjectionSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.xml.xpath;XPath;false;compile;;;Argument[0];xpath",
+        "javax.xml.xpath;XPath;false;evaluate;;;Argument[0];xpath",
+        "org.dom4j;Node;false;selectNodes;;;Argument[0];xpath",
+        "org.dom4j;Node;false;selectSingleNode;;;Argument[0];xpath"
+      ]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
index 0bb85272f085..3b8e43c5d7d2 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
@@ -14,6 +14,7 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import XQueryInjectionLib
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration tracing flow from remote sources, through an XQuery parser, to its eventual execution.
@@ -23,11 +24,7 @@ class XQueryInjectionConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() = any(XQueryPreparedExecuteCall xpec).getPreparedExpression() or
-    sink.asExpr() = any(XQueryExecuteCall xec).getExecuteQueryArgument() or
-    sink.asExpr() = any(XQueryExecuteCommandCall xecc).getExecuteCommandArgument()
-  }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "xquery") }
 
   /**
    * Holds if taint from the input `pred` to a `prepareExpression` call flows to the returned prepared expression `succ`.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
index 2a4019f2c9a9..13452e4e55dc 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
@@ -1,4 +1,5 @@
 import java
+private import semmle.code.java.dataflow.ExternalFlow
 
 /** A call to `XQConnection.prepareExpression`. */
 class XQueryParserCall extends MethodAccess {
@@ -66,3 +67,14 @@ class XQueryExecuteCommandCall extends MethodAccess {
   /** Return this execute command argument. */
   Expr getExecuteCommandArgument() { result = this.getArgument(0) }
 }
+
+private class XQuerySinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.xml.xquery;XQPreparedExpression;true;executeQuery;;;Argument[-1];xquery",
+        "javax.xml.xquery;XQExpression;true;executeQuery;;;Argument[0];xquery",
+        "javax.xml.xquery;XQExpression;true;executeCommand;;;Argument[0];xquery"
+      ]
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
index 569e18a29c38..002e06aaafdc 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
@@ -2,6 +2,7 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import DataFlow
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
@@ -82,12 +83,25 @@ predicate ognlInjectionSinkMethod(Method m, int index) {
 
 /** A data flow sink for unvalidated user input that is used in OGNL EL evaluation. */
 class OgnlInjectionSink extends DataFlow::ExprNode {
-  OgnlInjectionSink() {
-    exists(MethodAccess ma, Method m, int index |
-      ma.getMethod() = m and
-      (ma.getArgument(index) = this.getExpr() or ma.getQualifier() = this.getExpr()) and
-      ognlInjectionSinkMethod(m, index)
-    )
+  OgnlInjectionSink() { sinkNode(this, "ognl") }
+}
+
+private class OgnlInjectionSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.ognl;Ognl;false;setValue;;;Argument[-1..0];ognl",
+        "org.apache.commons.ognl;Ognl;false;getValue;;;Argument[-1..0];ognl",
+        "ognl;Ognl;false;setValue;;;Argument[-1..0];ognl",
+        "ognl;Ognl;false;getValue;;;Argument[-1..0];ognl",
+        "org.apache.commons.ognl;Node;true;setValue;;;Argument[-1..0];ognl",
+        "org.apache.commons.ognl;Node;true;getValue;;;Argument[-1..0];ognl",
+        "ognl;Node;true;setValue;;;Argument[-1..0];ognl",
+        "ognl;Node;true;getValue;;;Argument[-1..0];ognl",
+        "com.opensymphony.xwork2.ognl;OgnlUtil;false;setValue;;;Argument[-1..0];ognl",
+        "com.opensymphony.xwork2.ognl;OgnlUtil;false;getValue;;;Argument[-1..0];ognl",
+        "com.opensymphony.xwork2.ognl;OgnlUtil;false;callMethod;;;Argument[-1..0];ognl"
+      ]
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
index c3bf787881fa..6b0333da4709 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
@@ -14,13 +14,16 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import RequestForgery
 import DataFlow::PathGraph
+private import semmle.code.java.dataflow.ExternalFlow
 
 class RequestForgeryConfiguration extends TaintTracking::Configuration {
   RequestForgeryConfiguration() { this = "Server Side Request Forgery" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof RequestForgerySink or sinkNode(sink, "request-forgery-sink")
+  }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
     requestForgeryStep(pred, succ)
diff --git a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
index 3fc52ddca766..fa784baa7f23 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
@@ -5,6 +5,7 @@ import semmle.code.java.frameworks.spring.Spring
 import semmle.code.java.frameworks.JaxWS
 import semmle.code.java.frameworks.javase.Http
 import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.ExternalFlow
 
 predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
   // propagate to a URI when its host is assigned to
@@ -38,119 +39,42 @@ predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
   )
 }
 
-/** A data flow sink for request forgery vulnerabilities. */
-abstract class RequestForgerySink extends DataFlow::Node { }
-
-/**
- * An argument to an url `openConnection` or `openStream` call
- *  taken as a sink for request forgery vulnerabilities.
- */
-private class UrlOpen extends RequestForgerySink {
-  UrlOpen() {
-    exists(MethodAccess ma |
-      ma.getMethod() instanceof UrlOpenConnectionMethod or
-      ma.getMethod() instanceof UrlOpenStreamMethod
-    |
-      this.asExpr() = ma.getQualifier()
-    )
-  }
-}
-
-/**
- * An argument to an Apache `setURI` call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class ApacheSetUri extends RequestForgerySink {
-  ApacheSetUri() {
-    exists(MethodAccess ma |
-      ma.getReceiverType() instanceof ApacheHttpRequest and
-      ma.getMethod().hasName("setURI")
-    |
-      this.asExpr() = ma.getArgument(0)
-    )
-  }
-}
-
-/**
- * An argument to any Apache Request Instantiation call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class ApacheHttpRequestInstantiation extends RequestForgerySink {
-  ApacheHttpRequestInstantiation() {
-    exists(ClassInstanceExpr c | c.getConstructedType() instanceof ApacheHttpRequest |
-      this.asExpr() = c.getArgument(0)
-    )
-  }
-}
-
-/**
- * An argument to a Apache RequestBuilder method call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class ApacheHttpRequestBuilderArgument extends RequestForgerySink {
-  ApacheHttpRequestBuilderArgument() {
-    exists(MethodAccess ma |
-      ma.getReceiverType() instanceof TypeApacheHttpRequestBuilder and
-      ma.getMethod().hasName(["setURI", "get", "post", "put", "optons", "head", "delete"])
-    |
-      this.asExpr() = ma.getArgument(0)
-    )
-  }
-}
-
-/**
- * An argument to any Java.net.http.request Instantiation call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class HttpRequestNewBuilder extends RequestForgerySink {
-  HttpRequestNewBuilder() {
-    exists(MethodAccess call |
-      call.getCallee().hasName("newBuilder") and
-      call.getMethod().getDeclaringType().getName() = "HttpRequest"
-    |
-      this.asExpr() = call.getArgument(0)
-    )
-  }
-}
-
-/**
- * An argument to an Http Builder `uri` call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class HttpBuilderUriArgument extends RequestForgerySink {
-  HttpBuilderUriArgument() {
-    exists(MethodAccess ma | ma.getMethod() instanceof HttpBuilderUri |
-      this.asExpr() = ma.getArgument(0)
-    )
-  }
-}
-
-/**
- * An argument to a Spring Rest Template method call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class SpringRestTemplateArgument extends RequestForgerySink {
-  SpringRestTemplateArgument() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getMethod().(SpringRestTemplateUrlMethods).getUrlArgument(ma)
-    )
+private class RequestForgerySinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "java.net;URL;false;openConnection;;;Argument[-1];request-forgery-sink",
+        "java.net;URL;false;openStream;;;Argument[-1];request-forgery-sink",
+        "org.apache.http.client.methods;HttpRequestBase;true;setURI;;;Argument[0];request-forgery-sink",
+        "org.apache.http.message;BasicHttpRequest;true;setURI;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;HttpRequestBase;true;.ctor;;;Argument[0];request-forgery-sink",
+        "org.apache.http.message;BasicHttpRequest;true;.ctor;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;setURI;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;get;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;post;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;put;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;options;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;head;;;Argument[0];request-forgery-sink",
+        "org.apache.http.client.methods;RequestBuilder;false;delete;;;Argument[0];request-forgery-sink",
+        "java.net.http;HttpRequest$Builder;false;uri;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;patchForObject;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;getForObject;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;getForEntity;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;execute;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;exchange;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;put;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;postForObject;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;postForLocation;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;postForEntity;;;Argument[0];request-forgery-sink",
+        "org.springframework.web.client;RestTemplate;false;doExecute;;;Argument[0];request-forgery-sink",
+        "javax.ws.rs.client;Client;false;target;;;Argument[0];request-forgery-sink",
+        "java.net.http;HttpRequest;false;newBuilder;;;Argument[0];request-forgery-sink" // todo: this might be stricter than before. Previously the package name was not checked.
+      ]
   }
 }
 
-/**
- * An argument to `javax.ws.rs.Client`s `target` method call taken as a
- *   sink for request forgery vulnerabilities.
- */
-private class JaxRsClientTarget extends RequestForgerySink {
-  JaxRsClientTarget() {
-    exists(MethodAccess ma |
-      ma.getMethod().getDeclaringType() instanceof JaxRsClient and
-      ma.getMethod().hasName("target")
-    |
-      this.asExpr() = ma.getArgument(0)
-    )
-  }
-}
+/** A data flow sink for request forgery vulnerabilities. */
+abstract class RequestForgerySink extends DataFlow::Node { }
 
 /**
  * An argument to `org.springframework.http.RequestEntity`s constructor call
@@ -166,27 +90,3 @@ private class RequestEntityUriArg extends RequestForgerySink {
     )
   }
 }
-
-/**
- * A class representing all Spring Rest Template methods
- * which take an URL as an argument.
- */
-private class SpringRestTemplateUrlMethods extends Method {
-  SpringRestTemplateUrlMethods() {
-    this.getDeclaringType() instanceof SpringRestTemplate and
-    this.hasName([
-        "doExecute", "postForEntity", "postForLocation", "postForObject", "put", "exchange",
-        "execute", "getForEntity", "getForObject", "patchForObject"
-      ])
-  }
-
-  /**
-   * Gets the argument which corresponds to a URL argument
-   * passed as a `java.net.URL` object or as a string or the like
-   */
-  Argument getUrlArgument(MethodAccess ma) {
-    // doExecute(URI url, HttpMethod method, RequestCallback requestCallback,
-    //  ResponseExtractor<T> responseExtractor)
-    result = ma.getArgument(0)
-  }
-}
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 154ec98f2ad8..3cda09c14889 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -472,7 +472,7 @@ module CsvValidation {
       not type.regexpMatch("[a-zA-Z0-9_\\$]+") and
       msg = "Dubious type \"" + type + "\" in " + pred + " model."
       or
-      not name.regexpMatch("[a-zA-Z0-9_]*") and
+      not (name.regexpMatch("[a-zA-Z0-9_]*") or name = ".ctor") and
       msg = "Dubious name \"" + name + "\" in " + pred + " model."
       or
       not signature.regexpMatch("|\\([a-zA-Z0-9_\\.\\$<>,\\[\\]]*\\)") and
@@ -562,23 +562,34 @@ private string paramsString(Callable c) {
 }
 
 private Element interpretElement0(
-  string namespace, string type, boolean subtypes, string name, string signature
+  string namespace, string type, boolean subtypes, string name, string signature, string ext
 ) {
   elementSpec(namespace, type, subtypes, name, signature, _) and
   exists(RefType t | t = interpretType(namespace, type, subtypes) |
     exists(Member m |
       result = m and
       m.getDeclaringType() = t and
-      m.hasName(name)
+      (
+        m.hasName(name)
+        or
+        name = ".ctor" and m.hasName(t.getName())
+      )
     |
       signature = "" or
       m.(Callable).getSignature() = any(string nameprefix) + signature or
       paramsString(m) = signature
-    )
+    ) and
+    ext = ""
     or
     result = t and
     name = "" and
-    signature = ""
+    signature = "" and
+    ext = "Annotated"
+    or
+    result = t.getAMember() and
+    name = "" and
+    signature = "" and
+    ext = ""
   )
 }
 
@@ -586,7 +597,7 @@ private Element interpretElement(
   string namespace, string type, boolean subtypes, string name, string signature, string ext
 ) {
   elementSpec(namespace, type, subtypes, name, signature, ext) and
-  exists(Element e | e = interpretElement0(namespace, type, subtypes, name, signature) |
+  exists(Element e | e = interpretElement0(namespace, type, subtypes, name, signature, ext) |
     ext = "" and result = e
     or
     ext = "Annotated" and result.(Annotatable).getAnAnnotation().getType() = e
diff --git a/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
index ab809f07d6d1..d84ee67bca5c 100644
--- a/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
+++ b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
@@ -3,6 +3,7 @@ import semmle.code.java.frameworks.XStream
 import semmle.code.java.frameworks.SnakeYaml
 import semmle.code.java.frameworks.FastJson
 import semmle.code.java.frameworks.apache.Lang
+private import semmle.code.java.dataflow.ExternalFlow
 
 class ObjectInputStreamReadObjectMethod extends Method {
   ObjectInputStreamReadObjectMethod() {
@@ -26,11 +27,16 @@ class SafeXStream extends DataFlow2::Configuration {
       src.asExpr()
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      sink.asExpr() = ma.getQualifier() and
-      ma.getMethod() instanceof XStreamReadObjectMethod
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "safe-xstream") }
+}
+
+private class SafeXStreamSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "com.thoughtworks.xstream;XStream;false;unmarshal;;;Argument[-1];safe-xstream",
+        "com.thoughtworks.xstream;XStream;false;fromXML;;;Argument[-1];safe-xstream"
+      ]
   }
 }
 
@@ -42,11 +48,17 @@ class SafeKryo extends DataFlow2::Configuration {
       src.asExpr()
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma |
-      sink.asExpr() = ma.getQualifier() and
-      ma.getMethod() instanceof KryoReadObjectMethod
-    )
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "safe-kryo") }
+}
+
+private class SafeKryoSinkModel extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "com.esotericsoftware.kryo;Kryo;false;readObjectOrNull;;;Argument[-1];safe-kryo",
+        "com.esotericsoftware.kryo;Kryo;false;readObject;;;Argument[-1];safe-kryo",
+        "com.esotericsoftware.kryo;Kryo;false;readClassAndObject;;;Argument[-1];safe-kryo"
+      ]
   }
 }
 

From 351f35d9bce68e79b921511ba91f9f17172de7c5 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 9 Apr 2021 13:13:49 +0200
Subject: [PATCH 148/433] Revert "Java: Convert other sinks"

This reverts commit 87d42b02c0c49ff717c941d6ea5290b6ca3c40df.
---
 .../CWE/CWE-209/StackTraceExposure.ql         |  11 +-
 .../Security/CWE/CWE-036/OpenStream.ql        |  15 +-
 .../Security/CWE/CWE-074/XsltInjectionLib.qll |  41 ++---
 .../Security/CWE/CWE-094/JexlInjectionLib.qll | 139 ++++++++-------
 .../Security/CWE/CWE-094/MvelInjectionLib.qll |  56 +++---
 .../CWE/CWE-326/InsufficientKeySize.ql        |  23 ++-
 .../Security/CWE/CWE-327/SslLib.qll           |  20 +--
 .../Security/CWE/CWE-346/UnvalidatedCors.ql   |  29 +--
 .../Security/CWE/CWE-522/InsecureLdapAuth.ql  |  26 ++-
 .../Security/CWE/CWE-643/XPathInjection.ql    |  23 ++-
 .../Security/CWE/CWE-652/XQueryInjection.ql   |   7 +-
 .../CWE/CWE-652/XQueryInjectionLib.qll        |  12 --
 .../Security/CWE/CWE-917/OgnlInjectionLib.qll |  26 +--
 .../Security/CWE/CWE-918/RequestForgery.ql    |   5 +-
 .../Security/CWE/CWE-918/RequestForgery.qll   | 168 ++++++++++++++----
 .../code/java/dataflow/ExternalFlow.qll       |  23 +--
 .../java/security/UnsafeDeserialization.qll   |  32 ++--
 17 files changed, 354 insertions(+), 302 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
index 1f49d5cb06ac..c9c1e2917c0e 100644
--- a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+++ b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -16,7 +16,6 @@ import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.XSS
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * One of the `printStackTrace()` overloads on `Throwable`.
@@ -38,12 +37,10 @@ class ServletWriterSourceToPrintStackTraceMethodFlowConfig extends TaintTracking
 
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof ServletWriterSource }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "print-stack-trace") }
-}
-
-private class PrintStackTraceSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["java.lang;Throwable;true;printStackTrace;;;Argument;print-stack-trace"]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      sink.asExpr() = ma.getAnArgument() and ma.getMethod() instanceof PrintStackTraceMethod
+    )
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
index 6f75b3fc8ae5..871d6bb4737c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
@@ -15,7 +15,6 @@ import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.ExternalFlow
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 class URLConstructor extends ClassInstanceExpr {
   URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }
@@ -40,7 +39,13 @@ class RemoteURLToOpenStreamFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "url-open-stream") }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess m |
+      sink.asExpr() = m.getQualifier() and m.getMethod() instanceof URLOpenStreamMethod
+    )
+    or
+    sinkNode(sink, "url-open-stream")
+  }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(URLConstructor u |
@@ -50,12 +55,6 @@ class RemoteURLToOpenStreamFlowConfig extends TaintTracking::Configuration {
   }
 }
 
-private class URLOpenStreamSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["java.net;URL;false;openStream;;;Argument[-1];url-open-stream"]
-  }
-}
-
 from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess call
 where
   sink.getNode().asExpr() = call.getQualifier() and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
index bc0c8352a20f..4ba0eb6d0b11 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-074/XsltInjectionLib.qll
@@ -2,7 +2,6 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.XmlParsers
 import DataFlow
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unvalidated user input that is used in XSLT transformation.
@@ -104,20 +103,15 @@ class TypeXsltPackage extends Class {
 
 /** A data flow sink for unvalidated user input that is used in XSLT transformation. */
 class XsltInjectionSink extends DataFlow::ExprNode {
-  XsltInjectionSink() { sinkNode(this, "xslt") }
-}
-
-private class XsltInjectionSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "net.sf.saxon.s9api;XsltTransformer;false;transform;;;Argument[-1];xslt",
-        "net.sf.saxon.s9api;Xslt30Transformer;false;transform;;;Argument[-1];xslt",
-        "net.sf.saxon.s9api;Xslt30Transformer;false;applyTemplates;;;Argument[-1];xslt",
-        "net.sf.saxon.s9api;Xslt30Transformer;false;callFunction;;;Argument[-1];xslt",
-        "net.sf.saxon.s9api;Xslt30Transformer;false;callTemplate;;;Argument[-1];xslt",
-        "javax.xml.transform;Transformer;false;transform;;;Argument[-1];xslt"
-      ]
+  XsltInjectionSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() and ma.getQualifier() = this.getExpr() |
+      ma instanceof TransformerTransform or
+      m instanceof XsltTransformerTransformMethod or
+      m instanceof Xslt30TransformerTransformMethod or
+      m instanceof Xslt30TransformerApplyTemplatesMethod or
+      m instanceof Xslt30TransformerCallFunctionMethod or
+      m instanceof Xslt30TransformerCallTemplateMethod
+    )
   }
 }
 
@@ -192,21 +186,16 @@ private class TransformerFactoryWithSecureProcessingFeatureFlowConfig extends Da
     )
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "xslt-transformer") }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      sink.asExpr() = ma.getQualifier() and
+      ma.getMethod().getDeclaringType() instanceof TransformerFactory
+    )
+  }
 
   override int fieldFlowBranchLimit() { result = 0 }
 }
 
-private class TransformerFactorySinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "javax.xml.transform;TransformerFactory;false;;;;Argument[-1];xslt-transformer",
-        "javax.xml.transform.sax;SAXTransformerFactory;false;;;;Argument[-1];xslt-transformer"
-      ]
-  }
-}
-
 /** A `ParserConfig` specific to `TransformerFactory`. */
 private class TransformerFactoryFeatureConfig extends ParserConfig {
   TransformerFactoryFeatureConfig() {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
index 8fcde750e54c..561d7e46ae90 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -1,7 +1,6 @@
 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe user input
@@ -22,7 +21,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
 }
 
 /**
- * A sink for Expression Language injection vulnerabilities via Jexl,
+ * A sink for Expresssion Language injection vulnerabilities via Jexl,
  * i.e. method calls that run evaluation of a JEXL expression.
  *
  * Creating a `Callable` from a tainted JEXL expression or script is considered as a sink
@@ -31,41 +30,18 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
  * maybe stored in an object field and then reached by a different flow.
  */
 private class JexlEvaluationSink extends DataFlow::ExprNode {
-  JexlEvaluationSink() { sinkNode(this, "jexl") }
-}
-
-private class JexlEvaluationSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        // Direct JEXL evaluation
-        "org.apache.commons.jexl2;Expression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JexlExpression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;Script;false;execute;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JexlScript;false;execute;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
-        // JEXL callable
-        "org.apache.commons.jexl2;Expression;false;callable;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JexlExpression;false;callable;;;Argument[-1];jexl",
-        "org.apache.commons.jexl2;Script;false;callable;;;Argument[-1];jexl",
-        "org.apache.commons.jexl3;JexlScript;false;callable;;;Argument[-1];jexl",
-        // Methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
-        "org.apache.commons.jexl2;JexlEngine;false;getProperty;;;Argument[1..2];jexl",
-        "org.apache.commons.jexl3;JexlEngine;false;getProperty;;;Argument[1..2];jexl",
-        "org.apache.commons.jexl2;JexlEngine;false;setProperty;;;Argument[1];jexl",
-        "org.apache.commons.jexl3;JexlEngine;false;setProperty;;;Argument[1];jexl"
-      ]
+  JexlEvaluationSink() {
+    exists(MethodAccess ma, Method m, Expr taintFrom |
+      ma.getMethod() = m and taintFrom = this.asExpr()
+    |
+      m instanceof DirectJexlEvaluationMethod and ma.getQualifier() = taintFrom
+      or
+      m instanceof CreateJexlCallableMethod and ma.getQualifier() = taintFrom
+      or
+      m instanceof JexlEngineGetSetPropertyMethod and
+      taintFrom.getType() instanceof TypeString and
+      ma.getAnArgument() = taintFrom
+    )
   }
 }
 
@@ -122,36 +98,22 @@ private class SandboxedJexlFlowConfig extends DataFlow2::Configuration {
 
   override predicate isSource(DataFlow::Node node) { node instanceof SandboxedJexlSource }
 
-  override predicate isSink(DataFlow::Node node) { sinkNode(node, "sandboxed-jexl") }
+  override predicate isSink(DataFlow::Node node) {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      (
+        m instanceof CreateJexlScriptMethod or
+        m instanceof CreateJexlExpressionMethod or
+        m instanceof CreateJexlTemplateMethod
+      ) and
+      ma.getQualifier() = node.asExpr()
+    )
+  }
 
   override predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
     createsJexlEngine(fromNode, toNode)
   }
 }
 
-private class SandboxedJexlEvaluationSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        // CreateJexlScriptMethod
-        "org.apache.commons.jexl2;JexlEngine;false;createScript;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;JexlEngine;false;createScript;;;Argument[-1];sandboxed-jexl",
-        // CreateJexlExpressionMethod
-        "org.apache.commons.jexl2;UnifiedJEXL;false;parse;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;UnifiedJEXL;false;parse;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl2;JxltEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;JxltEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl2;JexlEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;JexlEngine;false;createExpression;;;Argument[-1];sandboxed-jexl",
-        // CreateJexlTemplateMethod
-        "org.apache.commons.jexl2;JxltEngine;false;createTemplate;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;JxltEngine;false;createTemplate;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl2;UnifiedJEXL;false;createTemplate;;;Argument[-1];sandboxed-jexl",
-        "org.apache.commons.jexl3;UnifiedJEXL;false;createTemplate;;;Argument[-1];sandboxed-jexl"
-      ]
-  }
-}
-
 /**
  * Defines a data flow source for JEXL engines configured with a sandbox.
  */
@@ -202,6 +164,35 @@ private predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node to
   )
 }
 
+/**
+ * A methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
+ */
+private class JexlEngineGetSetPropertyMethod extends Method {
+  JexlEngineGetSetPropertyMethod() {
+    getDeclaringType() instanceof JexlEngine and
+    hasName(["getProperty", "setProperty"])
+  }
+}
+
+/**
+ * A method that triggers direct evaluation of JEXL expressions.
+ */
+private class DirectJexlEvaluationMethod extends Method {
+  DirectJexlEvaluationMethod() {
+    getDeclaringType() instanceof JexlExpression and hasName("evaluate")
+    or
+    getDeclaringType() instanceof JexlScript and hasName("execute")
+    or
+    getDeclaringType() instanceof JxltEngineExpression and hasName(["evaluate", "prepare"])
+    or
+    getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate")
+    or
+    getDeclaringType() instanceof UnifiedJexlExpression and hasName(["evaluate", "prepare"])
+    or
+    getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
+  }
+}
+
 /**
  * A method that creates a JEXL script.
  */
@@ -209,6 +200,16 @@ private class CreateJexlScriptMethod extends Method {
   CreateJexlScriptMethod() { getDeclaringType() instanceof JexlEngine and hasName("createScript") }
 }
 
+/**
+ * A method that creates a `Callable` for a JEXL expression or script.
+ */
+private class CreateJexlCallableMethod extends Method {
+  CreateJexlCallableMethod() {
+    (getDeclaringType() instanceof JexlExpression or getDeclaringType() instanceof JexlScript) and
+    hasName("callable")
+  }
+}
+
 /**
  * A method that creates a JEXL template.
  */
@@ -266,6 +267,22 @@ private class JexlUberspect extends Interface {
   }
 }
 
+private class JxltEngineExpression extends NestedType {
+  JxltEngineExpression() { getEnclosingType() instanceof JxltEngine and hasName("Expression") }
+}
+
+private class JxltEngineTemplate extends NestedType {
+  JxltEngineTemplate() { getEnclosingType() instanceof JxltEngine and hasName("Template") }
+}
+
+private class UnifiedJexlExpression extends NestedType {
+  UnifiedJexlExpression() { getEnclosingType() instanceof UnifiedJexl and hasName("Expression") }
+}
+
+private class UnifiedJexlTemplate extends NestedType {
+  UnifiedJexlTemplate() { getEnclosingType() instanceof UnifiedJexl and hasName("Template") }
+}
+
 private class Reader extends RefType {
   Reader() { hasQualifiedName("java.io", "Reader") }
 }
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
index dec268a2a4bc..a6cf891330f0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
@@ -1,7 +1,6 @@
 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe user input
@@ -31,31 +30,36 @@ class MvelInjectionConfig extends TaintTracking::Configuration {
  * i.e. methods that run evaluation of a MVEL expression.
  */
 class MvelEvaluationSink extends DataFlow::ExprNode {
-  MvelEvaluationSink() { sinkNode(this, "mvel") }
-}
-
-private class MvelEvaluationSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "org.mvel2.jsr223;MvelScriptEngine;false;evaluate;;;Argument[0];mvel",
-        "org.mvel2.jsr223;MvelScriptEngine;false;eval;;;Argument[0];mvel",
-        "org.mvel2.compiler;ExecutableStatement;false;getValue;;;Argument[-1];mvel",
-        "org.mvel2.compiler;CompiledExpression;false;getDirectValue;;;Argument[-1];mvel",
-        "org.mvel2.compiler;CompiledAccExpression;false;getValue;;;Argument[-1];mvel",
-        "org.mvel2.compiler;Accessor;false;getValue;;;Argument[-1];mvel",
-        "javax.script;CompiledScript;false;eval;;;Argument[-1];mvel",
-        "org.mvel2.jsr223;MvelCompiledScript;false;eval;;;Argument[-1];mvel",
-        "org.mvel2;MVEL;false;eval;;;Argument[0];mvel",
-        "org.mvel2;MVEL;false;executeExpression;;;Argument[0];mvel",
-        "org.mvel2;MVEL;false;evalToBoolean;;;Argument[0];mvel",
-        "org.mvel2;MVEL;false;evalToString;;;Argument[0];mvel",
-        "org.mvel2;MVEL;false;executeAllExpression;;;Argument[0];mvel",
-        "org.mvel2;MVEL;false;executeSetExpression;;;Argument[0];mvel",
-        "org.mvel2.templates;TemplateRuntime;false;eval;;;Argument[0];mvel",
-        "org.mvel2.templates;TemplateRuntime;false;execute;;;Argument[0];mvel",
-        "org.mvel2;MVELRuntime;false;execute;;;Argument[1];mvel"
-      ]
+  MvelEvaluationSink() {
+    exists(StaticMethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof MvelEvalMethod or
+        m instanceof TemplateRuntimeEvaluationMethod
+      ) and
+      ma.getArgument(0) = asExpr()
+    )
+    or
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      m instanceof MvelScriptEngineEvaluationMethod and
+      ma.getArgument(0) = asExpr()
+    )
+    or
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof ExecutableStatementEvaluationMethod or
+        m instanceof CompiledExpressionEvaluationMethod or
+        m instanceof CompiledAccExpressionEvaluationMethod or
+        m instanceof AccessorEvaluationMethod or
+        m instanceof CompiledScriptEvaluationMethod or
+        m instanceof MvelCompiledScriptEvaluationMethod
+      ) and
+      ma.getQualifier() = asExpr()
+    )
+    or
+    exists(StaticMethodAccess ma, Method m | m = ma.getMethod() |
+      m instanceof MvelRuntimeEvaluationMethod and
+      ma.getArgument(1) = asExpr()
+    )
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
index ca86f42c561a..155d05abfae3 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
@@ -12,7 +12,6 @@
 import java
 import semmle.code.java.security.Encryption
 import semmle.code.java.dataflow.TaintTracking
-private import semmle.code.java.dataflow.ExternalFlow
 
 /** The Java class `java.security.spec.ECGenParameterSpec`. */
 class ECGenParameterSpec extends RefType {
@@ -56,12 +55,11 @@ class KeyGeneratorInitConfiguration extends TaintTracking::Configuration {
     exists(JavaxCryptoKeyGenerator jcg | jcg = source.asExpr())
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "keygen") }
-}
-
-private class KeyGeneratorInitSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["javax.crypto;KeyGenerator;false;init;;;Argument[-1];keygen"]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof KeyGeneratorInitMethod and
+      sink.asExpr() = ma.getQualifier()
+    )
   }
 }
 
@@ -73,12 +71,11 @@ class KeyPairGeneratorInitConfiguration extends TaintTracking::Configuration {
     exists(JavaSecurityKeyPairGenerator jkg | jkg = source.asExpr())
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "keypairgen") }
-}
-
-private class KeyPairGeneratorInitSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["java.security;KeyPairGenerator;false;initialize;;;Argument[-1];keypairgen"]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof KeyPairGeneratorInitMethod and
+      sink.asExpr() = ma.getQualifier()
+    )
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll b/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
index 3845953f0aab..bfa2530b07e7 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
@@ -3,7 +3,6 @@ import semmle.code.java.security.Encryption
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow
 import PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unsafe SSL and TLS versions.
@@ -13,20 +12,11 @@ class UnsafeTlsVersionConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof UnsafeTlsVersion }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ssl") }
-}
-
-private class UnsafeTlsVersionSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "javax.net.ssl;SSLContext;false;getInstance;;;Argument[0];ssl",
-        "javax.net.ssl;SSLParameters;false;SSLParameters;;;Argument[1];ssl",
-        "javax.net.ssl;SSLParameters;false;setProtocols;;;Argument[0];ssl",
-        "javax.net.ssl;SSLSocket;false;setEnabledProtocols;;;Argument[0];ssl",
-        "javax.net.ssl;SSLServerSocket;false;setEnabledProtocols;;;Argument[0];ssl",
-        "javax.net.ssl;SSLEngine;false;setEnabledProtocols;;;Argument[0];ssl"
-      ]
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof SslContextGetInstanceSink or
+    sink instanceof CreateSslParametersSink or
+    sink instanceof SslParametersSetProtocolsSink or
+    sink instanceof SetEnabledProtocolsSink
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
index 2fe6569318fc..c5a6c36d6a61 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
@@ -15,7 +15,6 @@ import semmle.code.java.frameworks.Servlets
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.TaintTracking2
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  *  Holds if `header` sets `Access-Control-Allow-Credentials` to `true`. This ensures fair chances of exploitability.
@@ -30,29 +29,33 @@ private predicate setsAllowCredentials(MethodAccess header) {
   header.getArgument(1).(CompileTimeConstantExpr).getStringValue().toLowerCase() = "true"
 }
 
+private class CorsProbableCheckAccess extends MethodAccess {
+  CorsProbableCheckAccess() {
+    getMethod().hasName("contains") and
+    getMethod().getDeclaringType().getASourceSupertype*() instanceof CollectionType
+    or
+    getMethod().hasName("containsKey") and
+    getMethod().getDeclaringType().getASourceSupertype*() instanceof MapType
+    or
+    getMethod().hasName("equals") and
+    getQualifier().getType() instanceof TypeString
+  }
+}
+
 private Expr getAccessControlAllowOriginHeaderName() {
   result.(CompileTimeConstantExpr).getStringValue().toLowerCase() = "access-control-allow-origin"
 }
 
 /**
- * This taintflow2 configuration checks if there is a flow from source node towards probably CORS checking methods.
+ * This taintflow2 configuration checks if there is a flow from source node towards CorsProbableCheckAccess methods.
  */
 class CorsSourceReachesCheckConfig extends TaintTracking2::Configuration {
   CorsSourceReachesCheckConfig() { this = "CorsOriginConfig" }
 
   override predicate isSource(DataFlow::Node source) { any(CorsOriginConfig c).hasFlow(source, _) }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "cors") }
-}
-
-private class CorsProbableCheckAccessSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "java.util;Collection;true;contains;;;Argument;cors",
-        "java.util;Map;true;containsKey;;;Argument;cors",
-        "java.lang;String;true;equals;;;Argument;cors"
-      ]
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(CorsProbableCheckAccess check).getAnArgument()
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
index 3c445934ad33..4ce2b8b7134c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
@@ -16,7 +16,6 @@ import semmle.code.java.frameworks.Jndi
 import semmle.code.java.frameworks.Networking
 import semmle.code.java.dataflow.TaintTracking
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * Insecure (non-SSL, non-private) LDAP URL string literal.
@@ -146,7 +145,12 @@ class InsecureUrlFlowConfig extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof InsecureLdapUrl }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(ConstructorCall cc |
+      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
+      sink.asExpr() = cc.getArgument(0)
+    )
+  }
 
   /** Method call of `env.put()`. */
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
@@ -172,12 +176,11 @@ class BasicAuthFlowConfig extends DataFlow::Configuration {
   }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
-}
-
-private class LdapSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["javax.naming.directory;DirContext;true;.ctor;;;Argument[0];ldap"]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(ConstructorCall cc |
+      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
+      sink.asExpr() = cc.getArgument(0)
+    )
   }
 }
 
@@ -195,7 +198,12 @@ class SSLFlowConfig extends DataFlow::Configuration {
   }
 
   /** Sink of directory context creation. */
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "ldap") }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(ConstructorCall cc |
+      cc.getConstructedType().getASupertype*() instanceof TypeDirContext and
+      sink.asExpr() = cc.getArgument(0)
+    )
+  }
 }
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureUrlFlowConfig config
diff --git a/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
index 598f42b0c703..e5a29df46d59 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-643/XPathInjection.ql
@@ -15,7 +15,6 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.XmlParsers
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 class XPathInjectionConfiguration extends TaintTracking::Configuration {
   XPathInjectionConfiguration() { this = "XPathInjection" }
@@ -26,18 +25,16 @@ class XPathInjectionConfiguration extends TaintTracking::Configuration {
 }
 
 class XPathInjectionSink extends DataFlow::ExprNode {
-  XPathInjectionSink() { sinkNode(this, "xpath") }
-}
-
-private class XPathInjectionSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "javax.xml.xpath;XPath;false;compile;;;Argument[0];xpath",
-        "javax.xml.xpath;XPath;false;evaluate;;;Argument[0];xpath",
-        "org.dom4j;Node;false;selectNodes;;;Argument[0];xpath",
-        "org.dom4j;Node;false;selectSingleNode;;;Argument[0];xpath"
-      ]
+  XPathInjectionSink() {
+    exists(Method m, MethodAccess ma | ma.getMethod() = m |
+      m.getDeclaringType().hasQualifiedName("javax.xml.xpath", "XPath") and
+      (m.hasName("evaluate") or m.hasName("compile")) and
+      ma.getArgument(0) = this.getExpr()
+      or
+      m.getDeclaringType().hasQualifiedName("org.dom4j", "Node") and
+      (m.hasName("selectNodes") or m.hasName("selectSingleNode")) and
+      ma.getArgument(0) = this.getExpr()
+    )
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
index 3b8e43c5d7d2..0bb85272f085 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
@@ -14,7 +14,6 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import XQueryInjectionLib
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration tracing flow from remote sources, through an XQuery parser, to its eventual execution.
@@ -24,7 +23,11 @@ class XQueryInjectionConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "xquery") }
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(XQueryPreparedExecuteCall xpec).getPreparedExpression() or
+    sink.asExpr() = any(XQueryExecuteCall xec).getExecuteQueryArgument() or
+    sink.asExpr() = any(XQueryExecuteCommandCall xecc).getExecuteCommandArgument()
+  }
 
   /**
    * Holds if taint from the input `pred` to a `prepareExpression` call flows to the returned prepared expression `succ`.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
index 13452e4e55dc..2a4019f2c9a9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
@@ -1,5 +1,4 @@
 import java
-private import semmle.code.java.dataflow.ExternalFlow
 
 /** A call to `XQConnection.prepareExpression`. */
 class XQueryParserCall extends MethodAccess {
@@ -67,14 +66,3 @@ class XQueryExecuteCommandCall extends MethodAccess {
   /** Return this execute command argument. */
   Expr getExecuteCommandArgument() { result = this.getArgument(0) }
 }
-
-private class XQuerySinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "javax.xml.xquery;XQPreparedExpression;true;executeQuery;;;Argument[-1];xquery",
-        "javax.xml.xquery;XQExpression;true;executeQuery;;;Argument[0];xquery",
-        "javax.xml.xquery;XQExpression;true;executeCommand;;;Argument[0];xquery"
-      ]
-  }
-}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
index 002e06aaafdc..569e18a29c38 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-917/OgnlInjectionLib.qll
@@ -2,7 +2,6 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import DataFlow
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 /**
  * A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
@@ -83,25 +82,12 @@ predicate ognlInjectionSinkMethod(Method m, int index) {
 
 /** A data flow sink for unvalidated user input that is used in OGNL EL evaluation. */
 class OgnlInjectionSink extends DataFlow::ExprNode {
-  OgnlInjectionSink() { sinkNode(this, "ognl") }
-}
-
-private class OgnlInjectionSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "org.apache.commons.ognl;Ognl;false;setValue;;;Argument[-1..0];ognl",
-        "org.apache.commons.ognl;Ognl;false;getValue;;;Argument[-1..0];ognl",
-        "ognl;Ognl;false;setValue;;;Argument[-1..0];ognl",
-        "ognl;Ognl;false;getValue;;;Argument[-1..0];ognl",
-        "org.apache.commons.ognl;Node;true;setValue;;;Argument[-1..0];ognl",
-        "org.apache.commons.ognl;Node;true;getValue;;;Argument[-1..0];ognl",
-        "ognl;Node;true;setValue;;;Argument[-1..0];ognl",
-        "ognl;Node;true;getValue;;;Argument[-1..0];ognl",
-        "com.opensymphony.xwork2.ognl;OgnlUtil;false;setValue;;;Argument[-1..0];ognl",
-        "com.opensymphony.xwork2.ognl;OgnlUtil;false;getValue;;;Argument[-1..0];ognl",
-        "com.opensymphony.xwork2.ognl;OgnlUtil;false;callMethod;;;Argument[-1..0];ognl"
-      ]
+  OgnlInjectionSink() {
+    exists(MethodAccess ma, Method m, int index |
+      ma.getMethod() = m and
+      (ma.getArgument(index) = this.getExpr() or ma.getQualifier() = this.getExpr()) and
+      ognlInjectionSinkMethod(m, index)
+    )
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
index 6b0333da4709..c3bf787881fa 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
@@ -14,16 +14,13 @@ import java
 import semmle.code.java.dataflow.FlowSources
 import RequestForgery
 import DataFlow::PathGraph
-private import semmle.code.java.dataflow.ExternalFlow
 
 class RequestForgeryConfiguration extends TaintTracking::Configuration {
   RequestForgeryConfiguration() { this = "Server Side Request Forgery" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink instanceof RequestForgerySink or sinkNode(sink, "request-forgery-sink")
-  }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
     requestForgeryStep(pred, succ)
diff --git a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
index fa784baa7f23..3fc52ddca766 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
@@ -5,7 +5,6 @@ import semmle.code.java.frameworks.spring.Spring
 import semmle.code.java.frameworks.JaxWS
 import semmle.code.java.frameworks.javase.Http
 import semmle.code.java.dataflow.DataFlow
-private import semmle.code.java.dataflow.ExternalFlow
 
 predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
   // propagate to a URI when its host is assigned to
@@ -39,42 +38,119 @@ predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
   )
 }
 
-private class RequestForgerySinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "java.net;URL;false;openConnection;;;Argument[-1];request-forgery-sink",
-        "java.net;URL;false;openStream;;;Argument[-1];request-forgery-sink",
-        "org.apache.http.client.methods;HttpRequestBase;true;setURI;;;Argument[0];request-forgery-sink",
-        "org.apache.http.message;BasicHttpRequest;true;setURI;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;HttpRequestBase;true;.ctor;;;Argument[0];request-forgery-sink",
-        "org.apache.http.message;BasicHttpRequest;true;.ctor;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;setURI;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;get;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;post;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;put;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;options;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;head;;;Argument[0];request-forgery-sink",
-        "org.apache.http.client.methods;RequestBuilder;false;delete;;;Argument[0];request-forgery-sink",
-        "java.net.http;HttpRequest$Builder;false;uri;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;patchForObject;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;getForObject;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;getForEntity;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;execute;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;exchange;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;put;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;postForObject;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;postForLocation;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;postForEntity;;;Argument[0];request-forgery-sink",
-        "org.springframework.web.client;RestTemplate;false;doExecute;;;Argument[0];request-forgery-sink",
-        "javax.ws.rs.client;Client;false;target;;;Argument[0];request-forgery-sink",
-        "java.net.http;HttpRequest;false;newBuilder;;;Argument[0];request-forgery-sink" // todo: this might be stricter than before. Previously the package name was not checked.
-      ]
+/** A data flow sink for request forgery vulnerabilities. */
+abstract class RequestForgerySink extends DataFlow::Node { }
+
+/**
+ * An argument to an url `openConnection` or `openStream` call
+ *  taken as a sink for request forgery vulnerabilities.
+ */
+private class UrlOpen extends RequestForgerySink {
+  UrlOpen() {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof UrlOpenConnectionMethod or
+      ma.getMethod() instanceof UrlOpenStreamMethod
+    |
+      this.asExpr() = ma.getQualifier()
+    )
   }
 }
 
-/** A data flow sink for request forgery vulnerabilities. */
-abstract class RequestForgerySink extends DataFlow::Node { }
+/**
+ * An argument to an Apache `setURI` call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class ApacheSetUri extends RequestForgerySink {
+  ApacheSetUri() {
+    exists(MethodAccess ma |
+      ma.getReceiverType() instanceof ApacheHttpRequest and
+      ma.getMethod().hasName("setURI")
+    |
+      this.asExpr() = ma.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An argument to any Apache Request Instantiation call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class ApacheHttpRequestInstantiation extends RequestForgerySink {
+  ApacheHttpRequestInstantiation() {
+    exists(ClassInstanceExpr c | c.getConstructedType() instanceof ApacheHttpRequest |
+      this.asExpr() = c.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An argument to a Apache RequestBuilder method call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class ApacheHttpRequestBuilderArgument extends RequestForgerySink {
+  ApacheHttpRequestBuilderArgument() {
+    exists(MethodAccess ma |
+      ma.getReceiverType() instanceof TypeApacheHttpRequestBuilder and
+      ma.getMethod().hasName(["setURI", "get", "post", "put", "optons", "head", "delete"])
+    |
+      this.asExpr() = ma.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An argument to any Java.net.http.request Instantiation call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class HttpRequestNewBuilder extends RequestForgerySink {
+  HttpRequestNewBuilder() {
+    exists(MethodAccess call |
+      call.getCallee().hasName("newBuilder") and
+      call.getMethod().getDeclaringType().getName() = "HttpRequest"
+    |
+      this.asExpr() = call.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An argument to an Http Builder `uri` call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class HttpBuilderUriArgument extends RequestForgerySink {
+  HttpBuilderUriArgument() {
+    exists(MethodAccess ma | ma.getMethod() instanceof HttpBuilderUri |
+      this.asExpr() = ma.getArgument(0)
+    )
+  }
+}
+
+/**
+ * An argument to a Spring Rest Template method call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class SpringRestTemplateArgument extends RequestForgerySink {
+  SpringRestTemplateArgument() {
+    exists(MethodAccess ma |
+      this.asExpr() = ma.getMethod().(SpringRestTemplateUrlMethods).getUrlArgument(ma)
+    )
+  }
+}
+
+/**
+ * An argument to `javax.ws.rs.Client`s `target` method call taken as a
+ *   sink for request forgery vulnerabilities.
+ */
+private class JaxRsClientTarget extends RequestForgerySink {
+  JaxRsClientTarget() {
+    exists(MethodAccess ma |
+      ma.getMethod().getDeclaringType() instanceof JaxRsClient and
+      ma.getMethod().hasName("target")
+    |
+      this.asExpr() = ma.getArgument(0)
+    )
+  }
+}
 
 /**
  * An argument to `org.springframework.http.RequestEntity`s constructor call
@@ -90,3 +166,27 @@ private class RequestEntityUriArg extends RequestForgerySink {
     )
   }
 }
+
+/**
+ * A class representing all Spring Rest Template methods
+ * which take an URL as an argument.
+ */
+private class SpringRestTemplateUrlMethods extends Method {
+  SpringRestTemplateUrlMethods() {
+    this.getDeclaringType() instanceof SpringRestTemplate and
+    this.hasName([
+        "doExecute", "postForEntity", "postForLocation", "postForObject", "put", "exchange",
+        "execute", "getForEntity", "getForObject", "patchForObject"
+      ])
+  }
+
+  /**
+   * Gets the argument which corresponds to a URL argument
+   * passed as a `java.net.URL` object or as a string or the like
+   */
+  Argument getUrlArgument(MethodAccess ma) {
+    // doExecute(URI url, HttpMethod method, RequestCallback requestCallback,
+    //  ResponseExtractor<T> responseExtractor)
+    result = ma.getArgument(0)
+  }
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 3cda09c14889..154ec98f2ad8 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -472,7 +472,7 @@ module CsvValidation {
       not type.regexpMatch("[a-zA-Z0-9_\\$]+") and
       msg = "Dubious type \"" + type + "\" in " + pred + " model."
       or
-      not (name.regexpMatch("[a-zA-Z0-9_]*") or name = ".ctor") and
+      not name.regexpMatch("[a-zA-Z0-9_]*") and
       msg = "Dubious name \"" + name + "\" in " + pred + " model."
       or
       not signature.regexpMatch("|\\([a-zA-Z0-9_\\.\\$<>,\\[\\]]*\\)") and
@@ -562,34 +562,23 @@ private string paramsString(Callable c) {
 }
 
 private Element interpretElement0(
-  string namespace, string type, boolean subtypes, string name, string signature, string ext
+  string namespace, string type, boolean subtypes, string name, string signature
 ) {
   elementSpec(namespace, type, subtypes, name, signature, _) and
   exists(RefType t | t = interpretType(namespace, type, subtypes) |
     exists(Member m |
       result = m and
       m.getDeclaringType() = t and
-      (
-        m.hasName(name)
-        or
-        name = ".ctor" and m.hasName(t.getName())
-      )
+      m.hasName(name)
     |
       signature = "" or
       m.(Callable).getSignature() = any(string nameprefix) + signature or
       paramsString(m) = signature
-    ) and
-    ext = ""
+    )
     or
     result = t and
     name = "" and
-    signature = "" and
-    ext = "Annotated"
-    or
-    result = t.getAMember() and
-    name = "" and
-    signature = "" and
-    ext = ""
+    signature = ""
   )
 }
 
@@ -597,7 +586,7 @@ private Element interpretElement(
   string namespace, string type, boolean subtypes, string name, string signature, string ext
 ) {
   elementSpec(namespace, type, subtypes, name, signature, ext) and
-  exists(Element e | e = interpretElement0(namespace, type, subtypes, name, signature, ext) |
+  exists(Element e | e = interpretElement0(namespace, type, subtypes, name, signature) |
     ext = "" and result = e
     or
     ext = "Annotated" and result.(Annotatable).getAnAnnotation().getType() = e
diff --git a/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
index d84ee67bca5c..ab809f07d6d1 100644
--- a/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
+++ b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
@@ -3,7 +3,6 @@ import semmle.code.java.frameworks.XStream
 import semmle.code.java.frameworks.SnakeYaml
 import semmle.code.java.frameworks.FastJson
 import semmle.code.java.frameworks.apache.Lang
-private import semmle.code.java.dataflow.ExternalFlow
 
 class ObjectInputStreamReadObjectMethod extends Method {
   ObjectInputStreamReadObjectMethod() {
@@ -27,16 +26,11 @@ class SafeXStream extends DataFlow2::Configuration {
       src.asExpr()
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "safe-xstream") }
-}
-
-private class SafeXStreamSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "com.thoughtworks.xstream;XStream;false;unmarshal;;;Argument[-1];safe-xstream",
-        "com.thoughtworks.xstream;XStream;false;fromXML;;;Argument[-1];safe-xstream"
-      ]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      sink.asExpr() = ma.getQualifier() and
+      ma.getMethod() instanceof XStreamReadObjectMethod
+    )
   }
 }
 
@@ -48,17 +42,11 @@ class SafeKryo extends DataFlow2::Configuration {
       src.asExpr()
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "safe-kryo") }
-}
-
-private class SafeKryoSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row =
-      [
-        "com.esotericsoftware.kryo;Kryo;false;readObjectOrNull;;;Argument[-1];safe-kryo",
-        "com.esotericsoftware.kryo;Kryo;false;readObject;;;Argument[-1];safe-kryo",
-        "com.esotericsoftware.kryo;Kryo;false;readClassAndObject;;;Argument[-1];safe-kryo"
-      ]
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      sink.asExpr() = ma.getQualifier() and
+      ma.getMethod() instanceof KryoReadObjectMethod
+    )
   }
 }
 

From affdedd840743f7ad814e08d0a9ccb5a4b659725 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Fri, 9 Apr 2021 12:02:07 +0000
Subject: [PATCH 149/433] Python: Add missing builtins to `API::builtin`

We were missing out on `None`, `True`, and `False` as these do not
appear as actual attributes of the `builtins` module in Python 3
(because they are elevated to the status of keywords there)

The simple solution, then, is to just always include them directly.
---
 python/ql/src/semmle/python/ApiGraphs.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 5aab059d58e6..5f1fbbb96269 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -363,7 +363,7 @@ module API {
           n.isGlobal() and
           n.isLoad() and
           name = n.getId() and
-          name = any(Builtins::Builtin b).getName()
+          name in [any(Builtins::Builtin b).getName(), "None", "True", "False"]
         )
     }
 

From 6874b8d4b3a899cb38db47fb460f4f93c256f272 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 9 Apr 2021 14:23:10 +0200
Subject: [PATCH 150/433] Data flow: Prevent bad join-order in `pathStep`

---
 .../code/cpp/dataflow/internal/DataFlowImpl.qll       | 11 ++++-------
 .../code/cpp/dataflow/internal/DataFlowImpl2.qll      | 11 ++++-------
 .../code/cpp/dataflow/internal/DataFlowImpl3.qll      | 11 ++++-------
 .../code/cpp/dataflow/internal/DataFlowImpl4.qll      | 11 ++++-------
 .../code/cpp/dataflow/internal/DataFlowImplLocal.qll  | 11 ++++-------
 .../code/cpp/ir/dataflow/internal/DataFlowImpl.qll    | 11 ++++-------
 .../code/cpp/ir/dataflow/internal/DataFlowImpl2.qll   | 11 ++++-------
 .../code/cpp/ir/dataflow/internal/DataFlowImpl3.qll   | 11 ++++-------
 .../code/cpp/ir/dataflow/internal/DataFlowImpl4.qll   | 11 ++++-------
 .../code/csharp/dataflow/internal/DataFlowImpl.qll    | 11 ++++-------
 .../code/csharp/dataflow/internal/DataFlowImpl2.qll   | 11 ++++-------
 .../code/csharp/dataflow/internal/DataFlowImpl3.qll   | 11 ++++-------
 .../code/csharp/dataflow/internal/DataFlowImpl4.qll   | 11 ++++-------
 .../code/csharp/dataflow/internal/DataFlowImpl5.qll   | 11 ++++-------
 .../code/java/dataflow/internal/DataFlowImpl.qll      | 11 ++++-------
 .../code/java/dataflow/internal/DataFlowImpl2.qll     | 11 ++++-------
 .../code/java/dataflow/internal/DataFlowImpl3.qll     | 11 ++++-------
 .../code/java/dataflow/internal/DataFlowImpl4.qll     | 11 ++++-------
 .../code/java/dataflow/internal/DataFlowImpl5.qll     | 11 ++++-------
 .../python/dataflow/new/internal/DataFlowImpl.qll     | 11 ++++-------
 .../python/dataflow/new/internal/DataFlowImpl2.qll    | 11 ++++-------
 .../python/dataflow/new/internal/DataFlowImpl3.qll    | 11 ++++-------
 .../python/dataflow/new/internal/DataFlowImpl4.qll    | 11 ++++-------
 23 files changed, 92 insertions(+), 161 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
index 8b446d28b86d..ab29838988dd 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -2132,12 +2132,9 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and

From d2b874f21764b93dad29e2f950b3e0f95f882bad Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Fri, 9 Apr 2021 14:19:00 +0000
Subject: [PATCH 151/433] Python: Use API graphs in PEP249 support

Because the replacement extension point now extends `API::Node`, I
modified the `toString` method of the latter to have an empty body.
The alternative would be to require everyone to provide a `toString`
predicate for their extensions, but seeing as these will usually be
pointing to already existing API graph nodes, this seems silly.

(This may be the reason why the equivalent method in the JS libs has
such an implementation.)
---
 python/ql/src/semmle/python/ApiGraphs.qll     |  2 +-
 .../src/semmle/python/frameworks/Django.qll   |  7 ++-
 .../src/semmle/python/frameworks/MySQLdb.qll  | 16 +-----
 .../frameworks/MysqlConnectorPython.qll       | 55 +------------------
 .../src/semmle/python/frameworks/PEP249.qll   | 35 ++++++------
 .../src/semmle/python/frameworks/Psycopg2.qll | 16 +-----
 .../src/semmle/python/frameworks/PyMySQL.qll  | 16 +-----
 .../src/semmle/python/frameworks/Stdlib.qll   | 15 +----
 8 files changed, 37 insertions(+), 125 deletions(-)

diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 5aab059d58e6..9689fb06a77c 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -157,7 +157,7 @@ module API {
     /**
      * Gets a textual representation of this element.
      */
-    abstract string toString();
+    string toString() { none() }
 
     /**
      * Gets a path of the given `length` from the root to this node.
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 02d5030bb1e8..56dc12edbf4d 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -78,8 +78,11 @@ private module Django {
     /** Gets a reference to the `django.db` module. */
     DataFlow::Node db() { result = django_attr("db") }
 
-    class DjangoDb extends PEP249Module {
-      DjangoDb() { this = db() }
+    /**
+     * `django.db` implements PEP249, providing ways to execute SQL statements against a database.
+     */
+    private class DjangoDb extends PEP249ModuleApiNode {
+      DjangoDb() { this = API::moduleImport("django").getMember("db") }
     }
 
     /** Provides models for the `django.db` module. */
diff --git a/python/ql/src/semmle/python/frameworks/MySQLdb.qll b/python/ql/src/semmle/python/frameworks/MySQLdb.qll
index 7013c6f5d02b..b36bf87c7d9f 100644
--- a/python/ql/src/semmle/python/frameworks/MySQLdb.qll
+++ b/python/ql/src/semmle/python/frameworks/MySQLdb.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,19 +22,8 @@ private module MySQLdb {
   // ---------------------------------------------------------------------------
   // MySQLdb
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `MySQLdb` module. */
-  private DataFlow::Node moduleMySQLdb(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("MySQLdb")
-    or
-    exists(DataFlow::TypeTracker t2 | result = moduleMySQLdb(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `MySQLdb` module. */
-  DataFlow::Node moduleMySQLdb() { result = moduleMySQLdb(DataFlow::TypeTracker::end()) }
-
   /** MySQLdb implements PEP 249, providing ways to execute SQL statements against a database. */
-  class MySQLdb extends PEP249Module {
-    MySQLdb() { this = moduleMySQLdb() }
+  class MySQLdb extends PEP249ModuleApiNode {
+    MySQLdb() { this = API::moduleImport("MySQLdb") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll b/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
index 1722bdcb51ee..97cd4fd162ce 100644
--- a/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
+++ b/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,64 +22,14 @@ private module MysqlConnectorPython {
   // ---------------------------------------------------------------------------
   // mysql
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `mysql` module. */
-  private DataFlow::Node mysql(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("mysql")
-    or
-    exists(DataFlow::TypeTracker t2 | result = mysql(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `mysql` module. */
-  DataFlow::Node mysql() { result = mysql(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `mysql` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node mysql_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["connector"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("mysql" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = mysql()
-    )
-    or
-    // Due to bad performance when using normal setup with `mysql_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        mysql_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate mysql_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(mysql_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `mysql` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node mysql_attr(string attr_name) {
-    result = mysql_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
-
   /** Provides models for the `mysql` module. */
   module mysql {
     /**
      * The mysql.connector module
      * See https://dev.mysql.com/doc/connector-python/en/connector-python-example-connecting.html
      */
-    class MysqlConnector extends PEP249Module {
-      MysqlConnector() { this = mysql_attr("connector") }
+    class MysqlConnector extends PEP249ModuleApiNode {
+      MysqlConnector() { this = API::moduleImport("mysql").getMember("connector") }
     }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/PEP249.qll b/python/ql/src/semmle/python/frameworks/PEP249.qll
index 1a5d888949f0..c449ae92bf24 100644
--- a/python/ql/src/semmle/python/frameworks/PEP249.qll
+++ b/python/ql/src/semmle/python/frameworks/PEP249.qll
@@ -7,20 +7,23 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
-/** A module implementing PEP 249. Extend this class for implementations. */
-abstract class PEP249Module extends DataFlow::Node { }
+/**
+ * A module implementing PEP 249. Extend this class for implementations.
+ *
+ * DEPRECATED: Extend `PEP249ModuleApiNode` instead.
+ */
+abstract deprecated class PEP249Module extends DataFlow::Node { }
 
-/** Gets a reference to a connect call. */
-private DataFlow::Node connect(DataFlow::TypeTracker t) {
-  t.startInAttr("connect") and
-  result instanceof PEP249Module
-  or
-  exists(DataFlow::TypeTracker t2 | result = connect(t2).track(t2, t))
-}
+/**
+ * An abstract class encompassing API graph nodes that implement PEP 249.
+ * Extend this class for implementations.
+ */
+abstract class PEP249ModuleApiNode extends API::Node { }
 
 /** Gets a reference to a connect call. */
-DataFlow::Node connect() { result = connect(DataFlow::TypeTracker::end()) }
+DataFlow::Node connect() { result = any(PEP249ModuleApiNode a).getMember("connect").getAUse() }
 
 /**
  * Provides models for the `db.Connection` class
@@ -43,10 +46,8 @@ module Connection {
   abstract class InstanceSource extends DataFlow::Node { }
 
   /** A direct instantiation of `db.Connection`. */
-  private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-    override CallNode node;
-
-    ClassInstantiation() { node.getFunction() = connect().asCfgNode() }
+  private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+    ClassInstantiation() { this.getFunction() = connect() }
   }
 
   /** Gets a reference to an instance of `db.Connection`. */
@@ -115,10 +116,8 @@ private DataFlow::Node execute(DataFlow::TypeTracker t) {
 DataFlow::Node execute() { result = execute(DataFlow::TypeTracker::end()) }
 
 /** A call to the `execute` method on a cursor (or on a connection). */
-private class ExecuteCall extends SqlExecution::Range, DataFlow::CfgNode {
-  override CallNode node;
-
-  ExecuteCall() { node.getFunction() = execute().asCfgNode() }
+private class ExecuteCall extends SqlExecution::Range, DataFlow::CallCfgNode {
+  ExecuteCall() { this.getFunction() = execute() }
 
   override DataFlow::Node getSql() {
     result.asCfgNode() in [node.getArg(0), node.getArgByName("sql")]
diff --git a/python/ql/src/semmle/python/frameworks/Psycopg2.qll b/python/ql/src/semmle/python/frameworks/Psycopg2.qll
index 96beee3f0111..1cc20026801b 100644
--- a/python/ql/src/semmle/python/frameworks/Psycopg2.qll
+++ b/python/ql/src/semmle/python/frameworks/Psycopg2.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,19 +22,8 @@ private module Psycopg2 {
   // ---------------------------------------------------------------------------
   // Psycopg
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `psycopg2` module. */
-  private DataFlow::Node psycopg2(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("psycopg2")
-    or
-    exists(DataFlow::TypeTracker t2 | result = psycopg2(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `psycopg2` module. */
-  DataFlow::Node psycopg2() { result = psycopg2(DataFlow::TypeTracker::end()) }
-
   /** psycopg2 implements PEP 249, providing ways to execute SQL statements against a database. */
-  class Psycopg2 extends PEP249Module {
-    Psycopg2() { this = psycopg2() }
+  class Psycopg2 extends PEP249ModuleApiNode {
+    Psycopg2() { this = API::moduleImport("psycopg2") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/PyMySQL.qll b/python/ql/src/semmle/python/frameworks/PyMySQL.qll
index 954d2f690dd7..c078302b73f1 100644
--- a/python/ql/src/semmle/python/frameworks/PyMySQL.qll
+++ b/python/ql/src/semmle/python/frameworks/PyMySQL.qll
@@ -7,6 +7,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -14,19 +15,8 @@ private import PEP249
  * See https://pypi.org/project/PyMySQL/
  */
 private module PyMySQL {
-  /** Gets a reference to the `pymysql` module. */
-  private DataFlow::Node pymysql(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("pymysql")
-    or
-    exists(DataFlow::TypeTracker t2 | result = pymysql(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `pymysql` module. */
-  DataFlow::Node pymysql() { result = pymysql(DataFlow::TypeTracker::end()) }
-
   /** PyMySQL implements PEP 249, providing ways to execute SQL statements against a database. */
-  class PyMySQLPEP249 extends PEP249Module {
-    PyMySQLPEP249() { this = pymysql() }
+  class PyMySQLPEP249 extends PEP249ModuleApiNode {
+    PyMySQLPEP249() { this = API::moduleImport("pymysql") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 2626d1585ff0..718da24aa88c 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -1523,24 +1523,13 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // sqlite3
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `sqlite3` module. */
-  private DataFlow::Node sqlite3(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("sqlite3")
-    or
-    exists(DataFlow::TypeTracker t2 | result = sqlite3(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `sqlite3` module. */
-  DataFlow::Node sqlite3() { result = sqlite3(DataFlow::TypeTracker::end()) }
-
   /**
    * sqlite3 implements PEP 249, providing ways to execute SQL statements against a database.
    *
    * See https://devdocs.io/python~3.9/library/sqlite3
    */
-  class Sqlite3 extends PEP249Module {
-    Sqlite3() { this = sqlite3() }
+  class Sqlite3 extends PEP249ModuleApiNode {
+    Sqlite3() { this = API::moduleImport("sqlite3") }
   }
 }
 

From f1306163692e580df95f0bbc65fa0821729d7132 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 9 Apr 2021 16:22:58 +0200
Subject: [PATCH 152/433] Data flow: Make `getLocalCc` private again

---
 cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll   | 2 +-
 cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll  | 2 +-
 cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll  | 2 +-
 cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll  | 2 +-
 .../src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll | 2 +-
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll   | 2 +-
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll  | 2 +-
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll  | 2 +-
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll  | 2 +-
 .../src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll   | 2 +-
 .../src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll  | 2 +-
 .../src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll  | 2 +-
 .../src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll  | 2 +-
 .../src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll  | 2 +-
 java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll | 2 +-
 .../ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll | 2 +-
 .../ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll | 2 +-
 .../ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll | 2 +-
 .../ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll | 2 +-
 .../ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll | 2 +-
 .../src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll   | 2 +-
 .../src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll   | 2 +-
 .../src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll   | 2 +-
 23 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
index ab29838988dd..9498e51e7e61 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
index ab29838988dd..9498e51e7e61 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
index ab29838988dd..9498e51e7e61 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
index ab29838988dd..9498e51e7e61 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
index ab29838988dd..9498e51e7e61 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
index ab29838988dd..9498e51e7e61 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
index ab29838988dd..9498e51e7e61 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
index ab29838988dd..9498e51e7e61 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
index ab29838988dd..9498e51e7e61 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
index ab29838988dd..9498e51e7e61 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
index ab29838988dd..9498e51e7e61 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
index ab29838988dd..9498e51e7e61 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
index ab29838988dd..9498e51e7e61 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
index ab29838988dd..9498e51e7e61 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
index ab29838988dd..9498e51e7e61 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -2132,7 +2132,7 @@ private module Stage4 {
   }
 
   bindingset[node, cc, config]
-  LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
     localFlowEntry(node, config) and
     result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }

From fd8f745468736006884dcabceebf9377567209d7 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Wed, 17 Mar 2021 13:35:44 +0100
Subject: [PATCH 153/433] Java: Adopt shared flow summary library and refactor
 data-flow nodes.

---
 config/identical-files.json                   |   4 +
 .../semmle/code/java/dataflow/FlowSummary.qll |  49 ++
 .../dataflow/internal/DataFlowDispatch.qll    |  24 +-
 .../java/dataflow/internal/DataFlowNodes.qll  | 445 ++++++++++++
 .../dataflow/internal/DataFlowPrivate.qll     |  80 +--
 .../java/dataflow/internal/DataFlowUtil.qll   | 310 +-------
 .../dataflow/internal/FlowSummaryImpl.qll     | 674 ++++++++++++++++++
 .../internal/FlowSummaryImplSpecific.qll      |  51 ++
 .../dataflow/internal/TaintTrackingUtil.qll   |   8 +-
 .../localAdditionalTaintStep.ql               |   4 +-
 10 files changed, 1285 insertions(+), 364 deletions(-)
 create mode 100644 java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
 create mode 100644 java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll
 create mode 100644 java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
 create mode 100644 java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll

diff --git a/config/identical-files.json b/config/identical-files.json
index 6c1c0c7409d9..3916e95a0cf0 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -56,6 +56,10 @@
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
     "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
   ],
+  "DataFlow Java/C# Flow Summaries": [
+    "java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
+  ],
   "SsaReadPosition Java/C#": [
     "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
new file mode 100644
index 000000000000..02e9548c544e
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
@@ -0,0 +1,49 @@
+/**
+ * Provides classes and predicates for definining flow summaries.
+ */
+
+import java
+private import internal.FlowSummaryImpl as Impl
+private import internal.DataFlowDispatch
+private import internal.DataFlowPrivate
+
+// import all instances below
+private module Summaries { }
+
+class SummaryComponent = Impl::Public::SummaryComponent;
+
+/** Provides predicates for constructing summary components. */
+module SummaryComponent {
+  import Impl::Public::SummaryComponent
+
+  /** Gets a summary component that represents a qualifier. */
+  SummaryComponent qualifier() { result = argument(-1) }
+
+  /** Gets a summary component for field `f`. */
+  SummaryComponent field(Field f) { result = content(any(FieldContent c | c.getField() = f)) }
+
+  /** Gets a summary component that represents the return value of a call. */
+  SummaryComponent return() { result = return(_) }
+}
+
+class SummaryComponentStack = Impl::Public::SummaryComponentStack;
+
+/** Provides predicates for constructing stacks of summary components. */
+module SummaryComponentStack {
+  import Impl::Public::SummaryComponentStack
+
+  /** Gets a singleton stack representing a qualifier. */
+  SummaryComponentStack qualifier() { result = singleton(SummaryComponent::qualifier()) }
+
+  /** Gets a stack representing a field `f` of `object`. */
+  SummaryComponentStack fieldOf(Field f, SummaryComponentStack object) {
+    result = push(SummaryComponent::field(f), object)
+  }
+
+  /** Gets a singleton stack representing a (normal) return. */
+  SummaryComponentStack return() { result = singleton(SummaryComponent::return()) }
+}
+
+class SummarizedCallable = Impl::Public::SummarizedCallable;
+
+class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
index 223af728fe45..3a98ed628471 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
@@ -2,9 +2,17 @@ private import java
 private import DataFlowPrivate
 private import DataFlowUtil
 private import semmle.code.java.dataflow.InstanceAccess
-import semmle.code.java.dispatch.VirtualDispatch
+private import semmle.code.java.dataflow.FlowSummary
+private import semmle.code.java.dispatch.VirtualDispatch as VirtualDispatch
 
 private module DispatchImpl {
+  /** Gets a viable implementation of the target of the given `Call`. */
+  Callable viableCallable(Call c) {
+    result = VirtualDispatch::viableCallable(c)
+    or
+    result.(SummarizedCallable) = c.getCallee().getSourceDeclaration()
+  }
+
   /**
    * Holds if the set of viable implementations that can be called by `ma`
    * might be improved by knowing the call context. This is the case if the
@@ -12,7 +20,7 @@ private module DispatchImpl {
    */
   private predicate mayBenefitFromCallContext(MethodAccess ma, Callable c, int i) {
     exists(Parameter p |
-      2 <= strictcount(viableImpl(ma)) and
+      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
       ma.getQualifier().(VarAccess).getVariable() = p and
       p.getPosition() = i and
       c.getAParameter() = p and
@@ -21,7 +29,7 @@ private module DispatchImpl {
     )
     or
     exists(OwnInstanceAccess ia |
-      2 <= strictcount(viableImpl(ma)) and
+      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
       (ia.isExplicit(ma.getQualifier()) or ia.isImplicitMethodQualifier(ma)) and
       i = -1 and
       c = ma.getEnclosingCallable()
@@ -60,7 +68,7 @@ private module DispatchImpl {
         or
         ctx.getArgument(i) = arg
       |
-        src = variableTrack(arg) and
+        src = VirtualDispatch::variableTrack(arg) and
         srctype = getPreciseType(src) and
         if src instanceof ClassInstanceExpr then exact = true else exact = false
       )
@@ -93,18 +101,18 @@ private module DispatchImpl {
    * restricted to those `ma`s for which a context might make a difference.
    */
   Method viableImplInCallContext(MethodAccess ma, Call ctx) {
-    result = viableImpl(ma) and
+    result = VirtualDispatch::viableImpl(ma) and
     exists(int i, Callable c, Method def, RefType t, boolean exact |
       mayBenefitFromCallContext(ma, c, i) and
       c = viableCallable(ctx) and
       contextArgHasType(ctx, i, t, exact) and
       ma.getMethod() = def
     |
-      exact = true and result = exactMethodImpl(def, t.getSourceDeclaration())
+      exact = true and result = VirtualDispatch::exactMethodImpl(def, t.getSourceDeclaration())
       or
       exact = false and
       exists(RefType t2 |
-        result = viableMethodImpl(def, t.getSourceDeclaration(), t2) and
+        result = VirtualDispatch::viableMethodImpl(def, t.getSourceDeclaration(), t2) and
         not failsUnification(t, t2)
       )
     )
@@ -117,7 +125,7 @@ private module DispatchImpl {
 
   pragma[noinline]
   private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-    exists(viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
+    exists(VirtualDispatch::viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
   }
 
   private predicate unificationTargets(Type t1, Type t2) {
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll
new file mode 100644
index 000000000000..552849c2c34c
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll
@@ -0,0 +1,445 @@
+private import java
+private import semmle.code.java.dataflow.InstanceAccess
+private import semmle.code.java.dataflow.FlowSummary
+private import semmle.code.java.dataflow.TypeFlow
+private import DataFlowPrivate
+private import FlowSummaryImpl as FlowSummaryImpl
+
+cached
+private module Cached {
+  cached
+  newtype TNode =
+    TExprNode(Expr e) {
+      not e.getType() instanceof VoidType and
+      not e.getParent*() instanceof Annotation
+    } or
+    TExplicitParameterNode(Parameter p) {
+      exists(p.getCallable().getBody()) or p.getCallable() instanceof SummarizedCallable
+    } or
+    TImplicitVarargsArray(Call c) {
+      c.getCallee().isVarargs() and
+      not exists(Argument arg | arg.getCall() = c and arg.isExplicitVarargsArray())
+    } or
+    TInstanceParameterNode(Callable c) {
+      (exists(c.getBody()) or c instanceof SummarizedCallable) and
+      not c.isStatic()
+    } or
+    TImplicitInstanceAccess(InstanceAccessExt ia) { not ia.isExplicit(_) } or
+    TMallocNode(ClassInstanceExpr cie) or
+    TExplicitExprPostUpdate(Expr e) {
+      explicitInstanceArgument(_, e)
+      or
+      e instanceof Argument and not e.getType() instanceof ImmutableType
+      or
+      exists(FieldAccess fa | fa.getField() instanceof InstanceField and e = fa.getQualifier())
+      or
+      exists(ArrayAccess aa | e = aa.getArray())
+    } or
+    TImplicitExprPostUpdate(InstanceAccessExt ia) {
+      implicitInstanceArgument(_, ia)
+      or
+      exists(FieldAccess fa |
+        fa.getField() instanceof InstanceField and ia.isImplicitFieldQualifier(fa)
+      )
+    } or
+    TSummaryInternalNode(SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+      FlowSummaryImpl::Private::summaryNodeRange(c, state)
+    }
+
+  cached
+  predicate summaryOutNodeCached(DataFlowCall c, Node out) {
+    FlowSummaryImpl::Private::summaryOutNode(c, out, _)
+  }
+
+  cached
+  predicate summaryArgumentNodeCached(DataFlowCall c, Node arg, int i) {
+    FlowSummaryImpl::Private::summaryArgumentNode(c, arg, i)
+  }
+
+  cached
+  predicate summaryPostUpdateNodeCached(Node post, ParameterNode pre) {
+    FlowSummaryImpl::Private::summaryPostUpdateNode(post, pre)
+  }
+
+  cached
+  predicate summaryReturnNodeCached(Node ret) {
+    FlowSummaryImpl::Private::summaryReturnNode(ret, _)
+  }
+}
+
+private import Cached
+
+private predicate explicitInstanceArgument(Call call, Expr instarg) {
+  call instanceof MethodAccess and
+  instarg = call.getQualifier() and
+  not call.getCallee().isStatic()
+}
+
+private predicate implicitInstanceArgument(Call call, InstanceAccessExt ia) {
+  ia.isImplicitMethodQualifier(call) or
+  ia.isImplicitThisConstructorArgument(call)
+}
+
+module Public {
+  /**
+   * An element, viewed as a node in a data flow graph. Either an expression,
+   * a parameter, or an implicit varargs array creation.
+   */
+  class Node extends TNode {
+    /** Gets a textual representation of this element. */
+    string toString() { none() }
+
+    /** Gets the source location for this element. */
+    Location getLocation() { none() }
+
+    /** Gets the expression corresponding to this node, if any. */
+    Expr asExpr() { result = this.(ExprNode).getExpr() }
+
+    /** Gets the parameter corresponding to this node, if any. */
+    Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
+
+    /** Gets the type of this node. */
+    Type getType() {
+      result = this.asExpr().getType()
+      or
+      result = this.asParameter().getType()
+      or
+      exists(Parameter p |
+        result = p.getType() and
+        p.isVarargs() and
+        p = this.(ImplicitVarargsArray).getCall().getCallee().getAParameter()
+      )
+      or
+      result = this.(InstanceParameterNode).getCallable().getDeclaringType()
+      or
+      result = this.(ImplicitInstanceAccess).getInstanceAccess().getType()
+      or
+      result = this.(MallocNode).getClassInstanceExpr().getType()
+      or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getType()
+    }
+
+    /** Gets the callable in which this node occurs. */
+    Callable getEnclosingCallable() {
+      result = this.asExpr().getEnclosingCallable() or
+      result = this.asParameter().getCallable() or
+      result = this.(ImplicitVarargsArray).getCall().getEnclosingCallable() or
+      result = this.(InstanceParameterNode).getCallable() or
+      result = this.(ImplicitInstanceAccess).getInstanceAccess().getEnclosingCallable() or
+      result = this.(MallocNode).getClassInstanceExpr().getEnclosingCallable() or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getEnclosingCallable() or
+      this = TSummaryInternalNode(result, _)
+    }
+
+    private Type getImprovedTypeBound() {
+      exprTypeFlow(this.asExpr(), result, _) or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getImprovedTypeBound()
+    }
+
+    /**
+     * Gets an upper bound on the type of this node.
+     */
+    Type getTypeBound() {
+      result = getImprovedTypeBound()
+      or
+      result = getType() and not exists(getImprovedTypeBound())
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+  }
+
+  /**
+   * An expression, viewed as a node in a data flow graph.
+   */
+  class ExprNode extends Node, TExprNode {
+    Expr expr;
+
+    ExprNode() { this = TExprNode(expr) }
+
+    override string toString() { result = expr.toString() }
+
+    override Location getLocation() { result = expr.getLocation() }
+
+    /** Gets the expression corresponding to this node. */
+    Expr getExpr() { result = expr }
+  }
+
+  /** Gets the node corresponding to `e`. */
+  ExprNode exprNode(Expr e) { result.getExpr() = e }
+
+  /** An explicit or implicit parameter. */
+  abstract class ParameterNode extends Node {
+    /**
+     * Holds if this node is the parameter of `c` at the specified (zero-based)
+     * position. The implicit `this` parameter is considered to have index `-1`.
+     */
+    abstract predicate isParameterOf(Callable c, int pos);
+  }
+
+  /**
+   * A parameter, viewed as a node in a data flow graph.
+   */
+  class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
+    Parameter param;
+
+    ExplicitParameterNode() { this = TExplicitParameterNode(param) }
+
+    override string toString() { result = param.toString() }
+
+    override Location getLocation() { result = param.getLocation() }
+
+    /** Gets the parameter corresponding to this node. */
+    Parameter getParameter() { result = param }
+
+    override predicate isParameterOf(Callable c, int pos) { c.getParameter(pos) = param }
+  }
+
+  /** Gets the node corresponding to `p`. */
+  ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+
+  /**
+   * An implicit varargs array creation expression.
+   *
+   * A call `f(x1, x2)` to a method `f(A... xs)` desugars to `f(new A[]{x1, x2})`,
+   * and this node corresponds to such an implicit array creation.
+   */
+  class ImplicitVarargsArray extends Node, TImplicitVarargsArray {
+    Call call;
+
+    ImplicitVarargsArray() { this = TImplicitVarargsArray(call) }
+
+    override string toString() { result = "new ..[] { .. }" }
+
+    override Location getLocation() { result = call.getLocation() }
+
+    /** Gets the call containing this varargs array creation argument. */
+    Call getCall() { result = call }
+  }
+
+  /**
+   * An instance parameter for an instance method or constructor.
+   */
+  class InstanceParameterNode extends ParameterNode, TInstanceParameterNode {
+    Callable callable;
+
+    InstanceParameterNode() { this = TInstanceParameterNode(callable) }
+
+    override string toString() { result = "parameter this" }
+
+    override Location getLocation() { result = callable.getLocation() }
+
+    /** Gets the callable containing this `this` parameter. */
+    Callable getCallable() { result = callable }
+
+    override predicate isParameterOf(Callable c, int pos) { callable = c and pos = -1 }
+  }
+
+  /**
+   * An implicit read of `this` or `A.this`.
+   */
+  class ImplicitInstanceAccess extends Node, TImplicitInstanceAccess {
+    InstanceAccessExt ia;
+
+    ImplicitInstanceAccess() { this = TImplicitInstanceAccess(ia) }
+
+    override string toString() { result = ia.toString() }
+
+    override Location getLocation() { result = ia.getLocation() }
+
+    /** Gets the instance access corresponding to this node. */
+    InstanceAccessExt getInstanceAccess() { result = ia }
+  }
+
+  /**
+   * A node associated with an object after an operation that might have
+   * changed its state.
+   *
+   * This can be either the argument to a callable after the callable returns
+   * (which might have mutated the argument), or the qualifier of a field after
+   * an update to the field.
+   *
+   * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
+   * to the value before the update with the exception of `ClassInstanceExpr`,
+   * which represents the value after the constructor has run.
+   */
+  abstract class PostUpdateNode extends Node {
+    /**
+     * Gets the node before the state update.
+     */
+    abstract Node getPreUpdateNode();
+  }
+
+  /**
+   * Gets the node that occurs as the qualifier of `fa`.
+   */
+  Node getFieldQualifier(FieldAccess fa) {
+    fa.getField() instanceof InstanceField and
+    (
+      result.asExpr() = fa.getQualifier() or
+      result.(ImplicitInstanceAccess).getInstanceAccess().isImplicitFieldQualifier(fa)
+    )
+  }
+
+  /** Gets the instance argument of a non-static call. */
+  Node getInstanceArgument(Call call) {
+    result.(MallocNode).getClassInstanceExpr() = call or
+    explicitInstanceArgument(call, result.asExpr()) or
+    implicitInstanceArgument(call, result.(ImplicitInstanceAccess).getInstanceAccess())
+  }
+}
+
+private import Public
+
+private class NewExpr extends PostUpdateNode, TExprNode {
+  NewExpr() { exists(ClassInstanceExpr cie | this = TExprNode(cie)) }
+
+  override Node getPreUpdateNode() { this = TExprNode(result.(MallocNode).getClassInstanceExpr()) }
+}
+
+/**
+ * A `PostUpdateNode` that is not a `ClassInstanceExpr`.
+ */
+abstract private class ImplicitPostUpdateNode extends PostUpdateNode {
+  override Location getLocation() { result = getPreUpdateNode().getLocation() }
+
+  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
+}
+
+private class ExplicitExprPostUpdate extends ImplicitPostUpdateNode, TExplicitExprPostUpdate {
+  override Node getPreUpdateNode() { this = TExplicitExprPostUpdate(result.asExpr()) }
+}
+
+private class ImplicitExprPostUpdate extends ImplicitPostUpdateNode, TImplicitExprPostUpdate {
+  override Node getPreUpdateNode() {
+    this = TImplicitExprPostUpdate(result.(ImplicitInstanceAccess).getInstanceAccess())
+  }
+}
+
+module Private {
+  /**
+   * A data flow node that occurs as the argument of a call and is passed as-is
+   * to the callable. Arguments that are wrapped in an implicit varargs array
+   * creation are not included, but the implicitly created array is.
+   * Instance arguments are also included.
+   */
+  class ArgumentNode extends Node {
+    ArgumentNode() {
+      exists(Argument arg | this.asExpr() = arg | not arg.isVararg())
+      or
+      this instanceof ImplicitVarargsArray
+      or
+      this = getInstanceArgument(_)
+      or
+      this.(SummaryNode).isArgumentOf(_, _)
+    }
+
+    /**
+     * Holds if this argument occurs at the given position in the given call.
+     * The instance argument is considered to have index `-1`.
+     */
+    predicate argumentOf(DataFlowCall call, int pos) {
+      exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
+      or
+      call = this.(ImplicitVarargsArray).getCall() and
+      pos = call.getCallee().getNumberOfParameters() - 1
+      or
+      pos = -1 and this = getInstanceArgument(call)
+      or
+      this.(SummaryNode).isArgumentOf(call, pos)
+    }
+
+    /** Gets the call in which this node is an argument. */
+    DataFlowCall getCall() { this.argumentOf(result, _) }
+  }
+
+  /** A data flow node that occurs as the result of a `ReturnStmt`. */
+  class ReturnNode extends Node {
+    ReturnNode() {
+      exists(ReturnStmt ret | this.asExpr() = ret.getResult()) or
+      this.(SummaryNode).isReturn()
+    }
+
+    /** Gets the kind of this returned value. */
+    ReturnKind getKind() { any() }
+  }
+
+  /** A data flow node that represents the output of a call. */
+  class OutNode extends Node {
+    OutNode() {
+      this.asExpr() instanceof MethodAccess
+      or
+      this.(SummaryNode).isOut(_)
+    }
+
+    /** Gets the underlying call. */
+    DataFlowCall getCall() {
+      result = this.asExpr()
+      or
+      this.(SummaryNode).isOut(result)
+    }
+  }
+
+  /**
+   * A data-flow node used to model flow summaries.
+   */
+  class SummaryNode extends Node, TSummaryInternalNode {
+    private SummarizedCallable c;
+    private FlowSummaryImpl::Private::SummaryNodeState state;
+
+    SummaryNode() { this = TSummaryInternalNode(c, state) }
+
+    override Location getLocation() { result = c.getLocation() }
+
+    override string toString() { result = "[summary] " + state + " in " + c }
+
+    /** Holds if this summary node is the `i`th argument of `call`. */
+    predicate isArgumentOf(DataFlowCall call, int i) { summaryArgumentNodeCached(call, this, i) }
+
+    /** Holds if this summary node is a return node. */
+    predicate isReturn() { summaryReturnNodeCached(this) }
+
+    /** Holds if this summary node is an out node for `call`. */
+    predicate isOut(DataFlowCall call) { summaryOutNodeCached(call, this) }
+  }
+
+  SummaryNode getSummaryNode(SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+    result = TSummaryInternalNode(c, state)
+  }
+}
+
+private import Private
+
+/**
+ * A node that corresponds to the value of a `ClassInstanceExpr` before the
+ * constructor has run.
+ */
+private class MallocNode extends Node, TMallocNode {
+  ClassInstanceExpr cie;
+
+  MallocNode() { this = TMallocNode(cie) }
+
+  override string toString() { result = cie.toString() + " [pre constructor]" }
+
+  override Location getLocation() { result = cie.getLocation() }
+
+  ClassInstanceExpr getClassInstanceExpr() { result = cie }
+}
+
+private class SummaryPostUpdateNode extends SummaryNode, PostUpdateNode {
+  private Node pre;
+
+  SummaryPostUpdateNode() { summaryPostUpdateNodeCached(this, pre) }
+
+  override Node getPreUpdateNode() { result = pre }
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
index f49ca8d75d9f..c425eaa11857 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
@@ -4,7 +4,8 @@ private import DataFlowImplCommon
 private import DataFlowDispatch
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.SSA
-private import semmle.code.java.dataflow.TypeFlow
+private import FlowSummaryImpl as FlowSummaryImpl
+import DataFlowNodes::Private
 
 private newtype TReturnKind = TNormalReturnKind()
 
@@ -26,54 +27,6 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
   kind = TNormalReturnKind()
 }
 
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Arguments that are wrapped in an implicit varargs array
- * creation are not included, but the implicitly created array is.
- * Instance arguments are also included.
- */
-class ArgumentNode extends Node {
-  ArgumentNode() {
-    exists(Argument arg | this.asExpr() = arg | not arg.isVararg())
-    or
-    this instanceof ImplicitVarargsArray
-    or
-    this = getInstanceArgument(_)
-  }
-
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  predicate argumentOf(DataFlowCall call, int pos) {
-    exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
-    or
-    call = this.(ImplicitVarargsArray).getCall() and
-    pos = call.getCallee().getNumberOfParameters() - 1
-    or
-    pos = -1 and this = getInstanceArgument(call)
-  }
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-/** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends ExprNode {
-  ReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getResult()) }
-
-  /** Gets the kind of this returned value. */
-  ReturnKind getKind() { any() }
-}
-
-/** A data flow node that represents the output of a call. */
-class OutNode extends ExprNode {
-  OutNode() { this.getExpr() instanceof MethodAccess }
-
-  /** Gets the underlying call. */
-  DataFlowCall getCall() { result = this.getExpr() }
-}
-
 /**
  * Holds if data can flow from `node1` to `node2` through a static field.
  */
@@ -147,7 +100,7 @@ class Content extends TContent {
   }
 }
 
-private class FieldContent extends Content, TFieldContent {
+class FieldContent extends Content, TFieldContent {
   InstanceField f;
 
   FieldContent() { this = TFieldContent(f) }
@@ -161,11 +114,11 @@ private class FieldContent extends Content, TFieldContent {
   }
 }
 
-private class CollectionContent extends Content, TCollectionContent {
+class CollectionContent extends Content, TCollectionContent {
   override string toString() { result = "collection" }
 }
 
-private class ArrayContent extends Content, TArrayContent {
+class ArrayContent extends Content, TArrayContent {
   override string toString() { result = "array" }
 }
 
@@ -180,6 +133,8 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
     node2.getPreUpdateNode() = getFieldQualifier(fa) and
     f.(FieldContent).getField() = fa.getField()
   )
+  or
+  FlowSummaryImpl::Private::Steps::summaryStoreStep(node1, f, node2)
 }
 
 /**
@@ -205,6 +160,8 @@ predicate readStep(Node node1, Content f, Node node2) {
     node1.asExpr() = get.getQualifier() and
     node2.asExpr() = get
   )
+  or
+  FlowSummaryImpl::Private::Steps::summaryReadStep(node1, f, node2)
 }
 
 /**
@@ -213,7 +170,14 @@ predicate readStep(Node node1, Content f, Node node2) {
  * in `x.f = newValue`.
  */
 predicate clearsContent(Node n, Content c) {
-  n = any(PostUpdateNode pun | storeStep(_, c, pun)).getPreUpdateNode()
+  c instanceof FieldContent and
+  (
+    n = any(PostUpdateNode pun | storeStep(_, c, pun)).getPreUpdateNode()
+    or
+    FlowSummaryImpl::Private::Steps::summaryStoresIntoArg(c, n)
+  )
+  or
+  FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
 }
 
 /**
@@ -221,7 +185,7 @@ predicate clearsContent(Node n, Content c) {
  * possible flow. A single type is used for all numeric types to account for
  * numeric conversions, and otherwise the erasure is used.
  */
-private DataFlowType getErasedRepr(Type t) {
+DataFlowType getErasedRepr(Type t) {
   exists(Type e | e = t.getErasure() |
     if e instanceof NumericOrCharType
     then result.(BoxedType).getPrimitiveType().getName() = "double"
@@ -235,7 +199,11 @@ private DataFlowType getErasedRepr(Type t) {
 }
 
 pragma[noinline]
-DataFlowType getNodeType(Node n) { result = getErasedRepr(n.getTypeBound()) }
+DataFlowType getNodeType(Node n) {
+  result = getErasedRepr(n.getTypeBound())
+  or
+  result = FlowSummaryImpl::Private::summaryNodeType(n)
+}
 
 /** Gets a string representation of a type returned by `getErasedRepr`. */
 string ppReprType(Type t) {
@@ -337,7 +305,7 @@ predicate isImmutableOrUnobservable(Node n) {
 }
 
 /** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { none() }
+predicate nodeIsHidden(Node n) { n instanceof SummaryNode }
 
 class LambdaCallKind = Unit;
 
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 828f2624ea67..030bf30bd49b 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -5,280 +5,13 @@
 private import java
 private import DataFlowPrivate
 private import semmle.code.java.dataflow.SSA
-private import semmle.code.java.dataflow.TypeFlow
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSteps
+private import semmle.code.java.dataflow.FlowSummary
 import semmle.code.java.dataflow.InstanceAccess
-
-cached
-private newtype TNode =
-  TExprNode(Expr e) {
-    not e.getType() instanceof VoidType and
-    not e.getParent*() instanceof Annotation
-  } or
-  TExplicitParameterNode(Parameter p) { exists(p.getCallable().getBody()) } or
-  TImplicitVarargsArray(Call c) {
-    c.getCallee().isVarargs() and
-    not exists(Argument arg | arg.getCall() = c and arg.isExplicitVarargsArray())
-  } or
-  TInstanceParameterNode(Callable c) { exists(c.getBody()) and not c.isStatic() } or
-  TImplicitInstanceAccess(InstanceAccessExt ia) { not ia.isExplicit(_) } or
-  TMallocNode(ClassInstanceExpr cie) or
-  TExplicitExprPostUpdate(Expr e) {
-    explicitInstanceArgument(_, e)
-    or
-    e instanceof Argument and not e.getType() instanceof ImmutableType
-    or
-    exists(FieldAccess fa | fa.getField() instanceof InstanceField and e = fa.getQualifier())
-    or
-    exists(ArrayAccess aa | e = aa.getArray())
-  } or
-  TImplicitExprPostUpdate(InstanceAccessExt ia) {
-    implicitInstanceArgument(_, ia)
-    or
-    exists(FieldAccess fa |
-      fa.getField() instanceof InstanceField and ia.isImplicitFieldQualifier(fa)
-    )
-  }
-
-/**
- * An element, viewed as a node in a data flow graph. Either an expression,
- * a parameter, or an implicit varargs array creation.
- */
-class Node extends TNode {
-  /** Gets a textual representation of this element. */
-  string toString() { none() }
-
-  /** Gets the source location for this element. */
-  Location getLocation() { none() }
-
-  /** Gets the expression corresponding to this node, if any. */
-  Expr asExpr() { result = this.(ExprNode).getExpr() }
-
-  /** Gets the parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
-
-  /** Gets the type of this node. */
-  Type getType() {
-    result = this.asExpr().getType()
-    or
-    result = this.asParameter().getType()
-    or
-    exists(Parameter p |
-      result = p.getType() and
-      p.isVarargs() and
-      p = this.(ImplicitVarargsArray).getCall().getCallee().getAParameter()
-    )
-    or
-    result = this.(InstanceParameterNode).getCallable().getDeclaringType()
-    or
-    result = this.(ImplicitInstanceAccess).getInstanceAccess().getType()
-    or
-    result = this.(MallocNode).getClassInstanceExpr().getType()
-    or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getType()
-  }
-
-  /** Gets the callable in which this node occurs. */
-  Callable getEnclosingCallable() {
-    result = this.asExpr().getEnclosingCallable() or
-    result = this.asParameter().getCallable() or
-    result = this.(ImplicitVarargsArray).getCall().getEnclosingCallable() or
-    result = this.(InstanceParameterNode).getCallable() or
-    result = this.(ImplicitInstanceAccess).getInstanceAccess().getEnclosingCallable() or
-    result = this.(MallocNode).getClassInstanceExpr().getEnclosingCallable() or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getEnclosingCallable()
-  }
-
-  private Type getImprovedTypeBound() {
-    exprTypeFlow(this.asExpr(), result, _) or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getImprovedTypeBound()
-  }
-
-  /**
-   * Gets an upper bound on the type of this node.
-   */
-  Type getTypeBound() {
-    result = getImprovedTypeBound()
-    or
-    result = getType() and not exists(getImprovedTypeBound())
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-}
-
-/**
- * An expression, viewed as a node in a data flow graph.
- */
-class ExprNode extends Node, TExprNode {
-  Expr expr;
-
-  ExprNode() { this = TExprNode(expr) }
-
-  override string toString() { result = expr.toString() }
-
-  override Location getLocation() { result = expr.getLocation() }
-
-  /** Gets the expression corresponding to this node. */
-  Expr getExpr() { result = expr }
-}
-
-/** Gets the node corresponding to `e`. */
-ExprNode exprNode(Expr e) { result.getExpr() = e }
-
-/** An explicit or implicit parameter. */
-abstract class ParameterNode extends Node {
-  /**
-   * Holds if this node is the parameter of `c` at the specified (zero-based)
-   * position. The implicit `this` parameter is considered to have index `-1`.
-   */
-  abstract predicate isParameterOf(Callable c, int pos);
-}
-
-/**
- * A parameter, viewed as a node in a data flow graph.
- */
-class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
-  Parameter param;
-
-  ExplicitParameterNode() { this = TExplicitParameterNode(param) }
-
-  override string toString() { result = param.toString() }
-
-  override Location getLocation() { result = param.getLocation() }
-
-  /** Gets the parameter corresponding to this node. */
-  Parameter getParameter() { result = param }
-
-  override predicate isParameterOf(Callable c, int pos) { c.getParameter(pos) = param }
-}
-
-/** Gets the node corresponding to `p`. */
-ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
-
-/**
- * An implicit varargs array creation expression.
- *
- * A call `f(x1, x2)` to a method `f(A... xs)` desugars to `f(new A[]{x1, x2})`,
- * and this node corresponds to such an implicit array creation.
- */
-class ImplicitVarargsArray extends Node, TImplicitVarargsArray {
-  Call call;
-
-  ImplicitVarargsArray() { this = TImplicitVarargsArray(call) }
-
-  override string toString() { result = "new ..[] { .. }" }
-
-  override Location getLocation() { result = call.getLocation() }
-
-  /** Gets the call containing this varargs array creation argument. */
-  Call getCall() { result = call }
-}
-
-/**
- * An instance parameter for an instance method or constructor.
- */
-class InstanceParameterNode extends ParameterNode, TInstanceParameterNode {
-  Callable callable;
-
-  InstanceParameterNode() { this = TInstanceParameterNode(callable) }
-
-  override string toString() { result = "parameter this" }
-
-  override Location getLocation() { result = callable.getLocation() }
-
-  /** Gets the callable containing this `this` parameter. */
-  Callable getCallable() { result = callable }
-
-  override predicate isParameterOf(Callable c, int pos) { callable = c and pos = -1 }
-}
-
-/**
- * An implicit read of `this` or `A.this`.
- */
-class ImplicitInstanceAccess extends Node, TImplicitInstanceAccess {
-  InstanceAccessExt ia;
-
-  ImplicitInstanceAccess() { this = TImplicitInstanceAccess(ia) }
-
-  override string toString() { result = ia.toString() }
-
-  override Location getLocation() { result = ia.getLocation() }
-
-  InstanceAccessExt getInstanceAccess() { result = ia }
-}
-
-/**
- * A node that corresponds to the value of a `ClassInstanceExpr` before the
- * constructor has run.
- */
-private class MallocNode extends Node, TMallocNode {
-  ClassInstanceExpr cie;
-
-  MallocNode() { this = TMallocNode(cie) }
-
-  override string toString() { result = cie.toString() + " [pre constructor]" }
-
-  override Location getLocation() { result = cie.getLocation() }
-
-  ClassInstanceExpr getClassInstanceExpr() { result = cie }
-}
-
-/**
- * A node associated with an object after an operation that might have
- * changed its state.
- *
- * This can be either the argument to a callable after the callable returns
- * (which might have mutated the argument), or the qualifier of a field after
- * an update to the field.
- *
- * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
- * to the value before the update with the exception of `ClassInstanceExpr`,
- * which represents the value after the constructor has run.
- */
-abstract class PostUpdateNode extends Node {
-  /**
-   * Gets the node before the state update.
-   */
-  abstract Node getPreUpdateNode();
-}
-
-private class NewExpr extends PostUpdateNode, TExprNode {
-  NewExpr() { exists(ClassInstanceExpr cie | this = TExprNode(cie)) }
-
-  override Node getPreUpdateNode() { this = TExprNode(result.(MallocNode).getClassInstanceExpr()) }
-}
-
-/**
- * A `PostUpdateNode` that is not a `ClassInstanceExpr`.
- */
-abstract private class ImplicitPostUpdateNode extends PostUpdateNode {
-  override Location getLocation() { result = getPreUpdateNode().getLocation() }
-
-  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
-}
-
-private class ExplicitExprPostUpdate extends ImplicitPostUpdateNode, TExplicitExprPostUpdate {
-  override Node getPreUpdateNode() { this = TExplicitExprPostUpdate(result.asExpr()) }
-}
-
-private class ImplicitExprPostUpdate extends ImplicitPostUpdateNode, TImplicitExprPostUpdate {
-  override Node getPreUpdateNode() {
-    this = TImplicitExprPostUpdate(result.(ImplicitInstanceAccess).getInstanceAccess())
-  }
-}
+private import FlowSummaryImpl as FlowSummaryImpl
+import DataFlowNodes::Public
 
 /** Holds if `n` is an access to an unqualified `this` at `cfgnode`. */
 private predicate thisAccess(Node n, ControlFlowNode cfgnode) {
@@ -363,7 +96,13 @@ predicate hasNonlocalValue(FieldRead fr) {
 /**
  * Holds if data can flow from `node1` to `node2` in one local step.
  */
-predicate localFlowStep(Node node1, Node node2) { simpleLocalFlowStep(node1, node2) }
+predicate localFlowStep(Node node1, Node node2) {
+  simpleLocalFlowStep(node1, node2)
+  or
+  // Simple flow through library code is included in the exposed local
+  // step relation, even though flow is technically inter-procedural
+  FlowSummaryImpl::Private::Steps::summaryThroughStep(node1, node2, true)
+}
 
 /**
  * INTERNAL: do not use.
@@ -411,33 +150,8 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
     node2.asExpr() = ma and
     node1.(ArgumentNode).argumentOf(ma, argNo)
   )
-}
-
-/**
- * Gets the node that occurs as the qualifier of `fa`.
- */
-Node getFieldQualifier(FieldAccess fa) {
-  fa.getField() instanceof InstanceField and
-  (
-    result.asExpr() = fa.getQualifier() or
-    result.(ImplicitInstanceAccess).getInstanceAccess().isImplicitFieldQualifier(fa)
-  )
-}
-
-private predicate explicitInstanceArgument(Call call, Expr instarg) {
-  call instanceof MethodAccess and instarg = call.getQualifier() and not call.getCallee().isStatic()
-}
-
-private predicate implicitInstanceArgument(Call call, InstanceAccessExt ia) {
-  ia.isImplicitMethodQualifier(call) or
-  ia.isImplicitThisConstructorArgument(call)
-}
-
-/** Gets the instance argument of a non-static call. */
-Node getInstanceArgument(Call call) {
-  result.(MallocNode).getClassInstanceExpr() = call or
-  explicitInstanceArgument(call, result.asExpr()) or
-  implicitInstanceArgument(call, result.(ImplicitInstanceAccess).getInstanceAccess())
+  or
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2, true)
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
new file mode 100644
index 000000000000..3c8c94c913c3
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -0,0 +1,674 @@
+/**
+ * Provides classes and predicates for defining flow summaries.
+ *
+ * The definitions in this file are language-independent, and language-specific
+ * definitions are passed in via the `DataFlowImplSpecific` and
+ * `FlowSummaryImplSpecific` modules.
+ */
+
+private import FlowSummaryImplSpecific
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
+
+/** Provides classes and predicates for defining flow summaries. */
+module Public {
+  private import Private
+
+  /**
+   * A component used in a flow summary.
+   *
+   * Either a parameter or an argument at a given position, a specific
+   * content type, or a return kind.
+   */
+  class SummaryComponent extends TSummaryComponent {
+    /** Gets a textual representation of this summary component. */
+    string toString() {
+      exists(Content c | this = TContentSummaryComponent(c) and result = c.toString())
+      or
+      exists(int i | this = TParameterSummaryComponent(i) and result = "parameter " + i)
+      or
+      exists(int i | this = TArgumentSummaryComponent(i) and result = "argument " + i)
+      or
+      exists(ReturnKind rk | this = TReturnSummaryComponent(rk) and result = "return (" + rk + ")")
+    }
+  }
+
+  /** Provides predicates for constructing summary components. */
+  module SummaryComponent {
+    /** Gets a summary component for content `c`. */
+    SummaryComponent content(Content c) { result = TContentSummaryComponent(c) }
+
+    /** Gets a summary component for parameter `i`. */
+    SummaryComponent parameter(int i) { result = TParameterSummaryComponent(i) }
+
+    /** Gets a summary component for argument `i`. */
+    SummaryComponent argument(int i) { result = TArgumentSummaryComponent(i) }
+
+    /** Gets a summary component for a return of kind `rk`. */
+    SummaryComponent return(ReturnKind rk) { result = TReturnSummaryComponent(rk) }
+  }
+
+  /**
+   * A (non-empty) stack of summary components.
+   *
+   * A stack is used to represent where data is read from (input) or where it
+   * is written to (output). For example, an input stack `[Field f, Argument 0]`
+   * means that data is read from field `f` from the `0`th argument, while an
+   * output stack `[Field g, Return]` means that data is written to the field
+   * `g` of the returned object.
+   */
+  class SummaryComponentStack extends TSummaryComponentStack {
+    /** Gets the head of this stack. */
+    SummaryComponent head() {
+      this = TSingletonSummaryComponentStack(result) or
+      this = TConsSummaryComponentStack(result, _)
+    }
+
+    /** Gets the tail of this stack, if any. */
+    SummaryComponentStack tail() { this = TConsSummaryComponentStack(_, result) }
+
+    /** Gets the length of this stack. */
+    int length() {
+      this = TSingletonSummaryComponentStack(_) and result = 1
+      or
+      result = 1 + this.tail().length()
+    }
+
+    /** Gets the stack obtained by dropping the first `i` elements, if any. */
+    SummaryComponentStack drop(int i) {
+      i = 0 and result = this
+      or
+      result = this.tail().drop(i - 1)
+    }
+
+    /** Holds if this stack contains summary component `c`. */
+    predicate contains(SummaryComponent c) { c = this.drop(_).head() }
+
+    /** Gets a textual representation of this stack. */
+    string toString() {
+      exists(SummaryComponent head, SummaryComponentStack tail |
+        head = this.head() and
+        tail = this.tail() and
+        result = head + " of " + tail
+      )
+      or
+      exists(SummaryComponent c |
+        this = TSingletonSummaryComponentStack(c) and
+        result = c.toString()
+      )
+    }
+  }
+
+  /** Provides predicates for constructing stacks of summary components. */
+  module SummaryComponentStack {
+    /** Gets a singleton stack containing `c`. */
+    SummaryComponentStack singleton(SummaryComponent c) {
+      result = TSingletonSummaryComponentStack(c)
+    }
+
+    /**
+     * Gets the stack obtained by pushing `head` onto `tail`.
+     *
+     * Make sure to override `RequiredSummaryComponentStack::required()` in order
+     * to ensure that the constructed stack exists.
+     */
+    SummaryComponentStack push(SummaryComponent head, SummaryComponentStack tail) {
+      result = TConsSummaryComponentStack(head, tail)
+    }
+
+    /** Gets a singleton stack for argument `i`. */
+    SummaryComponentStack argument(int i) { result = singleton(SummaryComponent::argument(i)) }
+
+    /** Gets a singleton stack representing a return of kind `rk`. */
+    SummaryComponentStack return(ReturnKind rk) { result = singleton(SummaryComponent::return(rk)) }
+  }
+
+  /**
+   * A class that exists for QL technical reasons only (the IPA type used
+   * to represent component stacks needs to be bounded).
+   */
+  abstract class RequiredSummaryComponentStack extends SummaryComponentStack {
+    /**
+     * Holds if the stack obtained by pushing `head` onto `tail` is required.
+     */
+    abstract predicate required(SummaryComponent c);
+  }
+
+  /** A callable with a flow summary. */
+  abstract class SummarizedCallable extends DataFlowCallable {
+    /**
+     * Holds if data may flow from `input` to `output` through this callable.
+     *
+     * `preservesValue` indicates whether this is a value-preserving step
+     * or a taint-step.
+     *
+     * Input specifications are restricted to stacks that end with
+     * `SummaryComponent::argument(_)`, preceded by zero or more
+     * `SummaryComponent::return(_)` or `SummaryComponent::content(_)` components.
+     *
+     * Output specifications are restricted to stacks that end with
+     * `SummaryComponent::return(_)` or `SummaryComponent::argument(_)`.
+     *
+     * Output stacks ending with `SummaryComponent::return(_)` can be preceded by zero
+     * or more `SummaryComponent::content(_)` components.
+     *
+     * Output stacks ending with `SummaryComponent::argument(_)` can be preceded by an
+     * optional `SummaryComponent::parameter(_)` component, which in turn can be preceded
+     * by zero or more `SummaryComponent::content(_)` components.
+     */
+    pragma[nomagic]
+    predicate propagatesFlow(
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+    ) {
+      none()
+    }
+
+    /**
+     * Holds if values stored inside `content` are cleared on objects passed as
+     * the `i`th argument to this callable.
+     */
+    pragma[nomagic]
+    predicate clearsContent(int i, Content content) { none() }
+  }
+}
+
+/**
+ * Provides predicates for compiling flow summaries down to atomic local steps,
+ * read steps, and store steps.
+ */
+module Private {
+  private import Public
+  private import DataFlowImplCommon as DataFlowImplCommon
+
+  newtype TSummaryComponent =
+    TContentSummaryComponent(Content c) or
+    TParameterSummaryComponent(int i) { parameterPosition(i) } or
+    TArgumentSummaryComponent(int i) { parameterPosition(i) } or
+    TReturnSummaryComponent(ReturnKind rk)
+
+  newtype TSummaryComponentStack =
+    TSingletonSummaryComponentStack(SummaryComponent c) or
+    TConsSummaryComponentStack(SummaryComponent head, SummaryComponentStack tail) {
+      tail.(RequiredSummaryComponentStack).required(head)
+    }
+
+  pragma[nomagic]
+  private predicate summary(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output,
+    boolean preservesValue
+  ) {
+    c.propagatesFlow(input, output, preservesValue)
+  }
+
+  private newtype TSummaryNodeState =
+    TSummaryNodeInputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack input |
+        summary(_, input, _, _) and
+        s = input.drop(_)
+      )
+    } or
+    TSummaryNodeOutputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack output |
+        summary(_, _, output, _) and
+        s = output.drop(_)
+      )
+    }
+
+  /**
+   * A state used to break up (complex) flow summaries into atomic flow steps.
+   * For a flow summary
+   *
+   * ```ql
+   * propagatesFlow(
+   *   SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+   * )
+   * ```
+   *
+   * the following states are used:
+   *
+   * - `TSummaryNodeInputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _have been read_ from the
+   *   input.
+   * - `TSummaryNodeOutputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _remain to be written_ to
+   *   the output.
+   */
+  class SummaryNodeState extends TSummaryNodeState {
+    /** Holds if this state is a valid input state for `c`. */
+    pragma[nomagic]
+    predicate isInputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeInputState(s) and
+      exists(SummaryComponentStack input |
+        summary(c, input, _, _) and
+        s = input.drop(_)
+      )
+    }
+
+    /** Holds if this state is a valid output state for `c`. */
+    pragma[nomagic]
+    predicate isOutputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeOutputState(s) and
+      exists(SummaryComponentStack output |
+        summary(c, _, output, _) and
+        s = output.drop(_)
+      )
+    }
+
+    /** Gets a textual representation of this state. */
+    string toString() {
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeInputState(s) and
+        result = "read: " + s
+      )
+      or
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeOutputState(s) and
+        result = "to write: " + s
+      )
+    }
+  }
+
+  /**
+   * Holds if `state` represents having read the `i`th argument for `c`. In this case
+   * we are not synthesizing a data-flow node, but instead assume that a relevant
+   * parameter node already exists.
+   */
+  private predicate parameterReadState(SummarizedCallable c, SummaryNodeState state, int i) {
+    state.isInputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /**
+   * Holds if a synthesized summary node is needed for the state `state` in summarized
+   * callable `c`.
+   */
+  predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
+    state.isInputState(c, _) and
+    not parameterReadState(c, state, _)
+    or
+    state.isOutputState(c, _)
+  }
+
+  pragma[noinline]
+  private Node summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state | state.isInputState(c, s) |
+      result = summaryNode(c, state)
+      or
+      exists(int i |
+        parameterReadState(c, state, i) and
+        result.(ParameterNode).isParameterOf(c, i)
+      )
+    )
+  }
+
+  pragma[noinline]
+  private Node summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state |
+      state.isOutputState(c, s) and
+      result = summaryNode(c, state)
+    )
+  }
+
+  /**
+   * Holds if a write targets `post`, which is a post-update node for the `i`th
+   * parameter of `c`.
+   */
+  private predicate isParameterPostUpdate(Node post, SummarizedCallable c, int i) {
+    post = summaryNodeOutputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /** Holds if a parameter node is required for the `i`th parameter of `c`. */
+  predicate summaryParameterNodeRange(SummarizedCallable c, int i) {
+    parameterReadState(c, _, i)
+    or
+    isParameterPostUpdate(_, c, i)
+  }
+
+  private predicate callbackOutput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ReturnKind rk
+  ) {
+    any(SummaryNodeState state).isInputState(c, s) and
+    s.head() = TReturnSummaryComponent(rk) and
+    receiver = summaryNodeInputState(c, s.drop(1))
+  }
+
+  private Node pre(Node post) {
+    summaryPostUpdateNode(post, result)
+    or
+    not summaryPostUpdateNode(post, _) and
+    result = post
+  }
+
+  private predicate callbackInput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, int i
+  ) {
+    any(SummaryNodeState state).isOutputState(c, s) and
+    s.head() = TParameterSummaryComponent(i) and
+    receiver = pre(summaryNodeOutputState(c, s.drop(1)))
+  }
+
+  /** Holds if a call targeting `receiver` should be synthesized inside `c`. */
+  predicate summaryCallbackRange(SummarizedCallable c, Node receiver) {
+    callbackOutput(c, _, receiver, _)
+    or
+    callbackInput(c, _, receiver, _)
+  }
+
+  /**
+   * Gets the type of synthesized summary node `n`.
+   *
+   * The type is computed based on the language-specific predicates
+   * `getContentType()`, `getReturnType()`, `getCallbackParameterType()`, and
+   * `getCallbackReturnType()`.
+   */
+  DataFlowType summaryNodeType(Node n) {
+    exists(Node pre |
+      summaryPostUpdateNode(n, pre) and
+      result = getNodeType(pre)
+    )
+    or
+    exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
+      n = summaryNodeInputState(c, s) and
+      (
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
+        or
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getCallbackReturnType(getNodeType(summaryNodeInputState(c, s.drop(1))), rk)
+        )
+      )
+      or
+      n = summaryNodeOutputState(c, s) and
+      (
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
+        or
+        s.length() = 1 and
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getReturnType(c, rk)
+        )
+        or
+        exists(int i | head = TParameterSummaryComponent(i) |
+          result = getCallbackParameterType(getNodeType(summaryNodeOutputState(c, s.drop(1))), i)
+        )
+      )
+    )
+  }
+
+  /** Holds if summary node `out` contains output of kind `rk` from call `c`. */
+  predicate summaryOutNode(DataFlowCall c, Node out, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackOutput(callable, s, receiver, rk) and
+      out = summaryNodeInputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `arg` is the `i`th argument of call `c`. */
+  predicate summaryArgumentNode(DataFlowCall c, Node arg, int i) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackInput(callable, s, receiver, i) and
+      arg = summaryNodeOutputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `post` is a post-update node with pre-update node `pre`. */
+  predicate summaryPostUpdateNode(Node post, ParameterNode pre) {
+    exists(SummarizedCallable c, int i |
+      isParameterPostUpdate(post, c, i) and
+      pre.isParameterOf(c, i)
+    )
+  }
+
+  /** Holds if summary node `ret` is a return node of kind `rk`. */
+  predicate summaryReturnNode(Node ret, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s |
+      ret = summaryNodeOutputState(callable, s) and
+      s = TSingletonSummaryComponentStack(TReturnSummaryComponent(rk))
+    )
+  }
+
+  /** Provides a compilation of flow summaries to atomic data-flow steps. */
+  module Steps {
+    /**
+     * Holds if there is a local step from `pred` to `succ`, which is synthesized
+     * from a flow summary.
+     */
+    predicate summaryLocalStep(Node pred, Node succ, boolean preservesValue) {
+      exists(
+        SummarizedCallable c, SummaryComponentStack inputContents,
+        SummaryComponentStack outputContents
+      |
+        summary(c, inputContents, outputContents, preservesValue) and
+        pred = summaryNodeInputState(c, inputContents) and
+        succ = summaryNodeOutputState(c, outputContents)
+      )
+    }
+
+    /**
+     * Holds if there is a read step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryReadStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeInputState(sc, s.drop(1)) and
+        succ = summaryNodeInputState(sc, s) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if there is a store step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryStoreStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeOutputState(sc, s) and
+        succ = summaryNodeOutputState(sc, s.drop(1)) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if values stored inside content `c` are cleared when passed as
+     * input of type `input` in `call`.
+     */
+    predicate summaryClearsContent(ArgumentNode arg, Content c) {
+      exists(DataFlowCall call, int i |
+        viableCallable(call).(SummarizedCallable).clearsContent(i, c) and
+        arg.argumentOf(call, i)
+      )
+    }
+
+    pragma[nomagic]
+    private ParameterNode summaryArgParam(
+      ArgumentNode arg, DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::OutNodeExt out
+    ) {
+      exists(DataFlowCall call, int pos, SummarizedCallable callable |
+        arg.argumentOf(call, pos) and
+        viableCallable(call) = callable and
+        result.isParameterOf(callable, pos) and
+        out = rk.getAnOutNode(call)
+      )
+    }
+
+    /**
+     * Holds if `arg` flows to `out` using a simple flow summary, that is, a flow
+     * summary without reads and stores.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryThroughStep(ArgumentNode arg, Node out, boolean preservesValue) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), ret, preservesValue) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a read(+taint) of `c` from `arg` to `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryGetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryReadStep(summaryArgParam(arg, rk, out), c, mid) and
+        summaryLocalStep(mid, ret, _) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a (taint+)store of `arg` into content `c` of `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summarySetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), mid, _) and
+        summaryStoreStep(mid, c, ret) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if data is written into content `c` of argument `arg` using a flow summary.
+     *
+     * Depending on the type of `c`, this predicate may be relevant to include in the
+     * definition of `clearsContent()`.
+     */
+    predicate summaryStoresIntoArg(Content c, Node arg) {
+      exists(
+        DataFlowImplCommon::ParamUpdateReturnKind rk, DataFlowImplCommon::ReturnNodeExt ret,
+        PostUpdateNode out
+      |
+        exists(DataFlowCall call, SummarizedCallable callable |
+          DataFlowImplCommon::getNodeEnclosingCallable(ret) = callable and
+          viableCallable(call) = callable and
+          summaryStoreStep(_, c, ret) and
+          ret.getKind() = pragma[only_bind_into](rk) and
+          out = rk.getAnOutNode(call) and
+          arg = out.getPreUpdateNode()
+        )
+      )
+    }
+  }
+
+  /**
+   * Provides a means of translating externally (e.g., CSV) defined flow
+   * summaries into a `SummarizedCallable`s.
+   */
+  module External {
+    /**
+     * Provides a means of translating an externally (e.g., CSV) defined flow
+     * summary into a `SummarizedCallable`.
+     */
+    abstract class ExternalSummaryCompilation extends string {
+      bindingset[this]
+      ExternalSummaryCompilation() { any() }
+
+      /** Holds if this flow summary is for callable `c`. */
+      abstract predicate callable(DataFlowCallable c, boolean preservesValue);
+
+      /** Holds if the `i`th input component is `c`. */
+      abstract predicate input(int i, SummaryComponent c);
+
+      /** Holds if the `i`th output component is `c`. */
+      abstract predicate output(int i, SummaryComponent c);
+
+      /**
+       * Holds if the input components starting from index `i` translate into `suffix`.
+       */
+      final predicate translateInput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.input(i, comp) |
+          i = max(int j | this.input(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateInputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      final predicate translateInputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.input(i, head) and
+        this.translateInput(i + 1, tail)
+      }
+
+      /**
+       * Holds if the output components starting from index `i` translate into `suffix`.
+       */
+      predicate translateOutput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.output(i, comp) |
+          i = max(int j | this.output(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateOutputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      predicate translateOutputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.output(i, head) and
+        this.translateOutput(i + 1, tail)
+      }
+    }
+
+    private class ExternalRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+      private SummaryComponent head;
+
+      ExternalRequiredSummaryComponentStack() {
+        any(ExternalSummaryCompilation s).translateInputCons(_, head, this) or
+        any(ExternalSummaryCompilation s).translateOutputCons(_, head, this)
+      }
+
+      override predicate required(SummaryComponent c) { c = head }
+    }
+
+    class ExternalSummarizedCallableAdaptor extends SummarizedCallable {
+      ExternalSummarizedCallableAdaptor() { any(ExternalSummaryCompilation s).callable(this, _) }
+
+      override predicate propagatesFlow(
+        SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+      ) {
+        exists(ExternalSummaryCompilation s |
+          s.callable(this, preservesValue) and
+          s.translateInput(0, input) and
+          s.translateOutput(0, output)
+        )
+      }
+    }
+  }
+
+  /** Provides a query predicate for outputting a set of relevant flow summaries. */
+  module TestOutput {
+    /** A flow summary to include in the `summary/3` query predicate. */
+    abstract class RelevantSummarizedCallable extends SummarizedCallable {
+      /** Gets the string representation of this callable used by `summary/3`. */
+      string getFullString() { result = this.toString() }
+    }
+
+    /** A query predicate for outputting flow summaries in QL tests. */
+    query predicate summary(string callable, string flow, boolean preservesValue) {
+      exists(
+        RelevantSummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output
+      |
+        callable = c.getFullString() and
+        c.propagatesFlow(input, output, preservesValue) and
+        flow = input + " -> " + output
+      )
+    }
+  }
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
new file mode 100644
index 000000000000..dae0571f0fa8
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -0,0 +1,51 @@
+/**
+ * Provides Java specific classes and predicates for definining flow summaries.
+ */
+
+private import java
+private import DataFlowPrivate
+private import DataFlowUtil
+private import FlowSummaryImpl::Private
+private import FlowSummaryImpl::Public
+
+private module FlowSummaries {
+  private import semmle.code.java.dataflow.FlowSummary as F
+}
+
+/** Holds is `i` is a valid parameter position. */
+predicate parameterPosition(int i) { i in [-1 .. any(Parameter p).getPosition()] }
+
+/** Gets the synthesized summary data-flow node for the given values. */
+Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = getSummaryNode(c, state) }
+
+/** Gets the synthesized data-flow call for `receiver`. */
+DataFlowCall summaryDataFlowCall(Node receiver) { none() }
+
+/** Gets the type of content `c`. */
+DataFlowType getContentType(Content c) {
+  result = getErasedRepr(c.(FieldContent).getField().getType())
+  or
+  c instanceof CollectionContent and
+  result instanceof TypeObject
+  or
+  c instanceof ArrayContent and
+  result instanceof TypeObject
+}
+
+/** Gets the return type of kind `rk` for callable `c`. */
+DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
+  result = getErasedRepr(c.getReturnType()) and
+  exists(rk)
+}
+
+/**
+ * Gets the type of the `i`th parameter in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackParameterType(DataFlowType t, int i) { none() }
+
+/**
+ * Gets the return type of kind `rk` in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { none() }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index d7cf0a8440ae..0f20ffe62dbe 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -13,6 +13,7 @@ private import semmle.code.java.frameworks.Networking
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.internal.DataFlowPrivate
 import semmle.code.java.dataflow.FlowSteps
+private import FlowSummaryImpl as FlowSummaryImpl
 
 /**
  * Holds if taint can flow from `src` to `sink` in zero or more
@@ -33,7 +34,10 @@ predicate localExprTaint(Expr src, Expr sink) {
  */
 predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   DataFlow::localFlowStep(src, sink) or
-  localAdditionalTaintStep(src, sink)
+  localAdditionalTaintStep(src, sink) or
+  // Simple flow through library code is included in the exposed local
+  // step relation, even though flow is technically inter-procedural
+  FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
 }
 
 /**
@@ -61,6 +65,8 @@ private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::No
     arg.isVararg() and
     sink.(DataFlow::ImplicitVarargsArray).getCall() = arg.getCall()
   )
+  or
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
 }
 
 /**
diff --git a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
index e8cd912e58a8..41b5a413386c 100644
--- a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
+++ b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
@@ -2,5 +2,7 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.internal.TaintTrackingUtil
 
 from DataFlow::Node src, DataFlow::Node sink
-where localAdditionalTaintStep(src, sink)
+where
+  localAdditionalTaintStep(src, sink) and
+  src.getLocation().getFile().getExtension() = "java"
 select src, sink

From 04b0682bbf9dd698f02a20946a310a9531e65921 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 9 Apr 2021 16:14:51 +0000
Subject: [PATCH 154/433] Use isAdditionalTaintStep and make the query more
 readable

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 146 +++++++++---------
 1 file changed, 75 insertions(+), 71 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index d566bd539453..cb8f7412014e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -1,14 +1,22 @@
 /**
  * @name Sensitive cookies without the HttpOnly response header set
  * @description Sensitive cookies without the 'HttpOnly' flag set leaves session cookies vulnerable to
- *              an XSS attack. This query checks whether 'HttpOnly' is not set in a Java Cookie object
- *              or the 'Set-Cookie' HTTP header.
+ *              an XSS attack.
  * @kind path-problem
  * @id java/sensitive-cookie-not-httponly
  * @tags security
  *       external/cwe/cwe-1004
  */
 
+/*
+ * Sketch of the structure of this query: we track cookie names that appear to be sensitive
+ * (e.g. `session` or `token`) to a `ServletResponse.addHeader(...)` or `.addCookie(...)`
+ * method that does not set the `httpOnly` flag. Subsidiary configurations
+ * `MatchesHttpOnlyConfiguration` and `SetHttpOnlyInCookieConfiguration` are used to establish
+ * when the `httpOnly` flag is likely to have been set, before configuration
+ * `MissingHttpOnlyConfiguration` establishes that a non-`httpOnly` cookie has a sensitive-seeming name.
+ */
+
 import java
 import semmle.code.java.dataflow.FlowSteps
 import semmle.code.java.frameworks.Servlets
@@ -34,6 +42,11 @@ predicate isSensitiveCookieNameExpr(Expr expr) {
   isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
 }
 
+/** A sensitive cookie name. */
+class SensitiveCookieNameExpr extends Expr {
+  SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
+}
+
 /** A method call that sets a `Set-Cookie` header. */
 class SetCookieMethodAccess extends MethodAccess {
   SetCookieMethodAccess() {
@@ -70,36 +83,55 @@ class CookieClass extends RefType {
 }
 
 /** Holds if the `expr` is `true` or a variable that is ever assigned `true`. */
+// This could be a very large result set if computed out of context
+pragma[inline]
 predicate mayBeBooleanTrue(Expr expr) {
-  expr.(CompileTimeConstantExpr).getBooleanValue() = true or
-  expr.(VarAccess).getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getBooleanValue() =
-    true
+  expr.getType() instanceof BooleanType and
+  not expr.(CompileTimeConstantExpr).getBooleanValue() = false
 }
 
-/** Holds if the method call sets the `HttpOnly` flag. */
+/** Holds if the method call may set the `HttpOnly` flag. */
 predicate setsCookieHttpOnly(MethodAccess ma) {
   ma.getMethod().getName() = "setHttpOnly" and
-  (
-    ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
-    or
-    // any use of setHttpOnly(x) where x isn't false is probably safe
-    not exists(VarAccess va |
-      ma.getArgument(0).(VarAccess).getVariable().getAnAccess() = va and
-      va.getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getBooleanValue() = false
+  // any use of setHttpOnly(x) where x isn't false is probably safe
+  mayBeBooleanTrue(ma.getArgument(0))
+}
+
+/** Holds if `ma` removes a cookie. */
+predicate removesCookie(MethodAccess ma) {
+  ma.getMethod().getName() = "setMaxAge" and
+  ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
+}
+
+/**
+ * Holds if the MethodAccess `ma` is a test method call indicated by:
+ *    a) in a test directory such as `src/test/java`
+ *    b) in a test package whose name has the word `test`
+ *    c) in a test class whose name has the word `test`
+ *    d) in a test class implementing a test framework such as JUnit or TestNG
+ */
+predicate isTestMethod(MethodAccess ma) {
+  exists(Method m |
+    m = ma.getEnclosingCallable() and
+    (
+      m.getDeclaringType().getName().toLowerCase().matches("%test%") or // Simple check to exclude test classes to reduce FPs
+      m.getDeclaringType().getPackage().getName().toLowerCase().matches("%test%") or // Simple check to exclude classes in test packages to reduce FPs
+      exists(m.getLocation().getFile().getAbsolutePath().indexOf("/src/test/java")) or //  Match test directory structure of build tools like maven
+      m instanceof TestMethod // Test method of a test case implementing a test framework such as JUnit or TestNG
     )
   )
 }
 
 /**
- * A taint configuration tracking flow of a method or a wrapper method that sets
- * the `HttpOnly` flag.
+ * A taint configuration tracking flow of a method or a wrapper method that sets the `HttpOnly`
+ * flag, or one that removes a cookie, to a `ServletResponse.addCookie` call.
  */
 class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
   SetHttpOnlyInCookieConfiguration() { this = "SetHttpOnlyInCookieConfiguration" }
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr() =
-      any(MethodAccess ma | setsCookieHttpOnly(ma) or removeCookie(ma)).getQualifier()
+      any(MethodAccess ma | setsCookieHttpOnly(ma) or removesCookie(ma)).getQualifier()
   }
 
   override predicate isSink(DataFlow::Node sink) {
@@ -108,18 +140,10 @@ class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
   }
 }
 
-/** Holds if `ma` removes a cookie. */
-predicate removeCookie(MethodAccess ma) {
-  ma.getMethod().getName() = "setMaxAge" and
-  ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
-}
-
-/** A sensitive cookie name. */
-class SensitiveCookieNameExpr extends Expr {
-  SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
-}
-
-/** A cookie that is added to an HTTP response, used as a sink in `MissingHttpOnlyConfiguration`. */
+/**
+ * A cookie that is added to an HTTP response and which doesn't have `httpOnly` set, used as a sink
+ * in `MissingHttpOnlyConfiguration`.
+ */
 class CookieResponseSink extends DataFlow::ExprNode {
   CookieResponseSink() {
     exists(MethodAccess ma |
@@ -137,11 +161,8 @@ class CookieResponseSink extends DataFlow::ExprNode {
   }
 }
 
-/**
- * Holds if `ClassInstanceExpr` cie is an invocation of a JAX-RS `NewCookie` constructor
- * that sets `HttpOnly` to true.
- */
-predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
+/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+predicate setsHttpOnlyInNewCookie(ClassInstanceExpr cie) {
   cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
   (
     cie.getNumArgument() = 6 and
@@ -156,42 +177,6 @@ predicate setHttpOnlyInNewCookie(ClassInstanceExpr cie) {
   )
 }
 
-/** The cookie constructor. */
-class CookieTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
-  CookieTaintPreservingConstructor() { this.getDeclaringType() instanceof CookieClass }
-
-  override predicate returnsTaintFrom(int arg) { arg = 0 }
-}
-
-/** The method call `toString` to get a stringified cookie representation. */
-class CookieToString extends TaintPreservingCallable {
-  CookieToString() {
-    this.getDeclaringType() instanceof CookieClass and
-    this.hasName("toString")
-  }
-
-  override predicate returnsTaintFrom(int arg) { arg = -1 }
-}
-
-/**
- * Holds if the MethodAccess `ma` is a test method call indicated by:
- *    a) in a test directory such as `src/test/java`
- *    b) in a test package whose name has the word `test`
- *    c) in a test class whose name has the word `test`
- *    d) in a test class implementing a test framework such as JUnit or TestNG
- */
-predicate isTestMethod(MethodAccess ma) {
-  exists(Method m |
-    m = ma.getEnclosingCallable() and
-    (
-      m.getDeclaringType().getName().toLowerCase().matches("%test%") or // Simple check to exclude test classes to reduce FPs
-      m.getDeclaringType().getPackage().getName().toLowerCase().matches("%test%") or // Simple check to exclude classes in test packages to reduce FPs
-      exists(m.getLocation().getFile().getAbsolutePath().indexOf("/src/test/java")) or //  Match test directory structure of build tools like maven
-      m instanceof TestMethod // Test method of a test case implementing a test framework such as JUnit or TestNG
-    )
-  )
-}
-
 /**
  * A taint configuration tracking flow from a sensitive cookie without the `HttpOnly` flag
  * set to its HTTP response.
@@ -206,8 +191,27 @@ class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof CookieResponseSink }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    // new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)
-    setHttpOnlyInNewCookie(node.asExpr())
+    // JAX-RS's `new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)` and similar
+    setsHttpOnlyInNewCookie(node.asExpr())
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(
+      ConstructorCall cc // new Cookie(...)
+    |
+      cc.getConstructedType() instanceof CookieClass and
+      pred.asExpr() = cc.getAnArgument() and
+      succ.asExpr() = cc
+    )
+    or
+    exists(
+      MethodAccess ma // cookie.toString()
+    |
+      ma.getMethod().getName() = "toString" and
+      ma.getQualifier().getType() instanceof CookieClass and
+      pred.asExpr() = ma.getQualifier() and
+      succ.asExpr() = ma
+    )
   }
 }
 

From cc4827600bf8c1a77c342c7f82548fd910d159ea Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Fri, 9 Apr 2021 17:11:47 +0000
Subject: [PATCH 155/433] Python: Use API graphs in `Stdlib.qll`

Eliminates _almost_ all of the bespoke type trackers found here. The
ones that remain do not fit easily inside the framework of API graphs
(at least, not yet), and I did not see any easy ways to clean them up.
They have, however, been rewritten to use `LocalSourceNode` internally,
which was the primary goal of this exercise.

I'm sure we could also clean up many of the inner modules given the more
lean presentation we have now, but this can wait for a different PR.
---
 .../src/semmle/python/frameworks/Stdlib.qll   | 857 +++---------------
 1 file changed, 143 insertions(+), 714 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 2626d1585ff0..3441c670fde8 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -17,57 +17,7 @@ private module Stdlib {
   // os
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `os` module. */
-  private DataFlow::Node os(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("os")
-    or
-    exists(DataFlow::TypeTracker t2 | result = os(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `os` module. */
-  DataFlow::Node os() { result = os(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `os` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "system"` will get all uses of `os.system`.
-   */
-  private DataFlow::Node os_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "system", "popen", "popen2", "popen3", "popen4",
-        // exec
-        "execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe",
-        // spawn
-        "spawnl", "spawnle", "spawnlp", "spawnlpe", "spawnv", "spawnve", "spawnvp", "spawnvpe",
-        "posix_spawn", "posix_spawnp",
-        // modules
-        "path"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("os." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("os")
-    )
-    or
-    // Due to bad performance when using normal setup with `os_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        os_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate os_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(os_attr(t2, attr_name), res, summary)
-  }
+  API::Node os() { result = API::moduleImport("os") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `os` module.
@@ -75,14 +25,12 @@ private module Stdlib {
    *
    * For example, using `"system"` will get all uses of `os.system`.
    */
-  private DataFlow::Node os_attr(string attr_name) {
-    result = os_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node os_attr(string attr_name) { result = os().getMember(attr_name) }
 
   /** Provides models for the `os` module. */
   module os {
     /** Gets a reference to the `os.path` module. */
-    DataFlow::Node path() { result = os_attr("path") }
+    API::Node path() { result = os_attr("path") }
 
     /** Provides models for the `os.path` module */
     module path {
@@ -92,46 +40,10 @@ private module Stdlib {
        *
        * For example, using `attr_name = "join"` will get all uses of `os.path.join`.
        */
-      private DataFlow::Node path_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["join", "normpath", "realpath", "abspath"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("os.path." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = os::path()
-        )
-        or
-        // Due to bad performance when using normal setup with `path_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            path_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate path_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(path_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `os.path` module.
-       * WARNING: Only holds for a few predefined attributes.
-       *
-       * For example, using `attr_name = "join"` will get all uses of `os.path.join`.
-       */
-      DataFlow::Node path_attr(string attr_name) {
-        result = path_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      API::Node path_attr(string attr_name) { result = path().getMember(attr_name) }
 
       /** Gets a reference to the `os.path.join` function. */
-      DataFlow::Node join() { result = path_attr("join") }
+      API::Node join() { result = path_attr("join") }
     }
   }
 
@@ -139,10 +51,8 @@ private module Stdlib {
    * A call to `os.path.normpath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.normpath
    */
-  private class OsPathNormpathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathNormpathCall() { node.getFunction() = os::path::path_attr("normpath").asCfgNode() }
+  private class OsPathNormpathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathNormpathCall() { this = os::path::path_attr("normpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -166,7 +76,7 @@ private module Stdlib {
   private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
     override CallNode node;
 
-    OsPathAbspathCall() { node.getFunction() = os::path::path_attr("abspath").asCfgNode() }
+    OsPathAbspathCall() { this = os::path::path_attr("abspath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -190,7 +100,7 @@ private module Stdlib {
   private class OsPathRealpathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
     override CallNode node;
 
-    OsPathRealpathCall() { node.getFunction() = os::path::path_attr("realpath").asCfgNode() }
+    OsPathRealpathCall() { this = os::path::path_attr("realpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -214,7 +124,7 @@ private module Stdlib {
   private class OsSystemCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
     override CallNode node;
 
-    OsSystemCall() { node.getFunction() = os_attr("system").asCfgNode() }
+    OsSystemCall() { this = os_attr("system").getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -233,7 +143,7 @@ private module Stdlib {
 
     OsPopenCall() {
       name in ["popen", "popen2", "popen3", "popen4"] and
-      node.getFunction() = os_attr(name).asCfgNode()
+      this = os_attr(name).getACall()
     }
 
     override DataFlow::Node getCommand() {
@@ -254,7 +164,7 @@ private module Stdlib {
     OsExecCall() {
       exists(string name |
         name in ["execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe"] and
-        node.getFunction() = os_attr(name).asCfgNode()
+        this = os_attr(name).getACall()
       )
     }
 
@@ -273,7 +183,7 @@ private module Stdlib {
         name in [
             "spawnl", "spawnle", "spawnlp", "spawnlpe", "spawnv", "spawnve", "spawnvp", "spawnvpe"
           ] and
-        node.getFunction() = os_attr(name).asCfgNode()
+        this = os_attr(name).getACall()
       )
     }
 
@@ -287,7 +197,7 @@ private module Stdlib {
   private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
     override CallNode node;
 
-    OsPosixSpawnCall() { node.getFunction() = os_attr(["posix_spawn", "posix_spawnp"]).asCfgNode() }
+    OsPosixSpawnCall() { this = os_attr(["posix_spawn", "posix_spawnp"]).getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -297,7 +207,7 @@ private module Stdlib {
     override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
       exists(CallNode call |
         nodeTo.asCfgNode() = call and
-        call.getFunction() = os::path::join().asCfgNode() and
+        call = os::path::join().getACall().asCfgNode() and
         call.getAnArg() = nodeFrom.asCfgNode()
       )
       // TODO: Handle pathlib (like we do for os.path.join)
@@ -308,48 +218,7 @@ private module Stdlib {
   // subprocess
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `subprocess` module. */
-  private DataFlow::Node subprocess(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("subprocess")
-    or
-    exists(DataFlow::TypeTracker t2 | result = subprocess(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `subprocess` module. */
-  DataFlow::Node subprocess() { result = subprocess(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `subprocess` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "Popen"` will get all uses of `subprocess.Popen`.
-   */
-  private DataFlow::Node subprocess_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["Popen", "call", "check_call", "check_output", "run"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("subprocess." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = subprocess()
-    )
-    or
-    // Due to bad performance when using normal setup with `subprocess_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        subprocess_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate subprocess_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(subprocess_attr(t2, attr_name), res, summary)
-  }
+  deprecated DataFlow::Node subprocess() { result = API::moduleImport("subprocess").getAUse() }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `subprocess` module.
@@ -358,7 +227,7 @@ private module Stdlib {
    * For example, using `attr_name = "Popen"` will get all uses of `subprocess.Popen`.
    */
   private DataFlow::Node subprocess_attr(string attr_name) {
-    result = subprocess_attr(DataFlow::TypeTracker::end(), attr_name)
+    result = API::moduleImport("subprocess").getMember(attr_name).getAUse()
   }
 
   /**
@@ -443,45 +312,26 @@ private module Stdlib {
   // marshal
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `marshal` module. */
-  private DataFlow::Node marshal(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("marshal")
-    or
-    exists(DataFlow::TypeTracker t2 | result = marshal(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `marshal` module. */
-  DataFlow::Node marshal() { result = marshal(DataFlow::TypeTracker::end()) }
+  deprecated DataFlow::Node marshal() { result = API::moduleImport("marshal").getAUse() }
 
   /** Provides models for the `marshal` module. */
   module marshal {
     /** Gets a reference to the `marshal.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode("marshal.loads")
-      or
-      t.startInAttr("loads") and
-      result = marshal()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
+    deprecated DataFlow::Node loads() {
+      result = API::moduleImport("marshal").getMember("loads").getAUse()
     }
-
-    /** Gets a reference to the `marshal.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
   }
 
   /**
    * A call to `marshal.loads`
    * See https://docs.python.org/3/library/marshal.html#marshal.loads
    */
-  private class MarshalLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    MarshalLoadsCall() { node.getFunction() = marshal::loads().asCfgNode() }
+  private class MarshalLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    MarshalLoadsCall() { this = API::moduleImport("marshal").getMember("loads").getACall() }
 
     override predicate mayExecuteInput() { any() }
 
-    override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+    override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
     override DataFlow::Node getOutput() { result = this }
 
@@ -494,45 +344,28 @@ private module Stdlib {
   private string pickleModuleName() { result in ["pickle", "cPickle", "_pickle"] }
 
   /** Gets a reference to the `pickle` module. */
-  private DataFlow::Node pickle(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode(pickleModuleName())
-    or
-    exists(DataFlow::TypeTracker t2 | result = pickle(t2).track(t2, t))
+  deprecated DataFlow::Node pickle() {
+    result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse()
   }
 
-  /** Gets a reference to the `pickle` module. */
-  DataFlow::Node pickle() { result = pickle(DataFlow::TypeTracker::end()) }
-
   /** Provides models for the `pickle` module. */
   module pickle {
     /** Gets a reference to the `pickle.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode(pickleModuleName() + ".loads")
-      or
-      t.startInAttr("loads") and
-      result = pickle()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
+    DataFlow::Node loads() {
+      result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getMember("loads").getAUse()
     }
-
-    /** Gets a reference to the `pickle.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
   }
 
   /**
    * A call to `pickle.loads`
    * See https://docs.python.org/3/library/pickle.html#pickle.loads
    */
-  private class PickleLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    PickleLoadsCall() { node.getFunction() = pickle::loads().asCfgNode() }
+  private class PickleLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    PickleLoadsCall() { this.getFunction() = pickle::loads() }
 
     override predicate mayExecuteInput() { any() }
 
-    override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+    override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
     override DataFlow::Node getOutput() { result = this }
 
@@ -543,57 +376,14 @@ private module Stdlib {
   // popen2
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `popen2` module (only available in Python 2). */
-  private DataFlow::Node popen2(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("popen2")
-    or
-    exists(DataFlow::TypeTracker t2 | result = popen2(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `popen2` module (only available in Python 2). */
-  DataFlow::Node popen2() { result = popen2(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `popen2` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node popen2_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "popen2", "popen3", "popen4",
-        // classes
-        "Popen3", "Popen4"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("popen2." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("popen2")
-    )
-    or
-    // Due to bad performance when using normal setup with `popen2_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        popen2_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate popen2_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(popen2_attr(t2, attr_name), res, summary)
-  }
+  API::Node popen2() { result = API::moduleImport("popen2") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `popen2` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node popen2_attr(string attr_name) {
-    result = popen2_attr(DataFlow::TypeTracker::end(), attr_name)
+  private API::Node popen2_attr(string attr_name) {
+    result = API::moduleImport("popen2").getMember(attr_name)
   }
 
   /**
@@ -606,7 +396,7 @@ private module Stdlib {
     Popen2PopenCall() {
       exists(string name |
         name in ["popen2", "popen3", "popen4", "Popen3", "Popen4"] and
-        node.getFunction() = popen2_attr(name).asCfgNode()
+        this = popen2_attr(name).getACall()
       )
     }
 
@@ -619,63 +409,20 @@ private module Stdlib {
   // platform
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `platform` module. */
-  private DataFlow::Node platform(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("platform")
-    or
-    exists(DataFlow::TypeTracker t2 | result = platform(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `platform` module. */
-  DataFlow::Node platform() { result = platform(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `platform` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node platform_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["popen"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("platform." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("platform")
-    )
-    or
-    // Due to bad performance when using normal setup with `platform_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        platform_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate platform_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(platform_attr(t2, attr_name), res, summary)
-  }
+  API::Node platform() { result = API::moduleImport("platform") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `platform` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node platform_attr(string attr_name) {
-    result = platform_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node platform_attr(string attr_name) { result = platform().getMember(attr_name) }
 
   /**
    * A call to the `platform.popen` function.
    * See https://docs.python.org/2.7/library/platform.html#platform.popen
    */
-  private class PlatformPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    PlatformPopenCall() { node.getFunction() = platform_attr("popen").asCfgNode() }
+  private class PlatformPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    PlatformPopenCall() { this = platform_attr("popen").getACall() }
 
     override DataFlow::Node getCommand() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("cmd")]
@@ -753,72 +500,24 @@ private module Stdlib {
   // base64
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `base64` module. */
-  private DataFlow::Node base64(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("base64")
-    or
-    exists(DataFlow::TypeTracker t2 | result = base64(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `base64` module. */
-  DataFlow::Node base64() { result = base64(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `base64` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node base64_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "b64encode", "b64decode", "standard_b64encode", "standard_b64decode", "urlsafe_b64encode",
-        "urlsafe_b64decode", "b32encode", "b32decode", "b16encode", "b16decode", "encodestring",
-        "decodestring", "a85encode", "a85decode", "b85encode", "b85decode", "encodebytes",
-        "decodebytes"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("base64" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = base64()
-    )
-    or
-    // Due to bad performance when using normal setup with `base64_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        base64_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate base64_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(base64_attr(t2, attr_name), res, summary)
-  }
+  API::Node base64() { result = API::moduleImport("base64") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `base64` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node base64_attr(string attr_name) {
-    result = base64_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node base64_attr(string attr_name) { result = base64().getMember(attr_name) }
 
   /** A call to any of the encode functions in the `base64` module. */
-  private class Base64EncodeCall extends Encoding::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class Base64EncodeCall extends Encoding::Range, DataFlow::CallCfgNode {
+    string name;
 
     Base64EncodeCall() {
-      exists(string name |
-        name in [
-            "b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
-            "encodestring", "a85encode", "b85encode", "encodebytes"
-          ] and
-        node.getFunction() = base64_attr(name).asCfgNode()
-      )
+      name in [
+          "b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
+          "encodestring", "a85encode", "b85encode", "encodebytes"
+        ] and
+      this = base64_attr(name).getACall()
     }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
@@ -826,35 +525,31 @@ private module Stdlib {
     override DataFlow::Node getOutput() { result = this }
 
     override string getFormat() {
-      exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
-        name in [
-            "b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
-          ] and
-        result = "Base64"
-        or
-        name = "b32encode" and result = "Base32"
-        or
-        name = "b16encode" and result = "Base16"
-        or
-        name = "a85encode" and result = "Ascii85"
-        or
-        name = "b85encode" and result = "Base85"
-      )
+      name in [
+          "b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
+        ] and
+      result = "Base64"
+      or
+      name = "b32encode" and result = "Base32"
+      or
+      name = "b16encode" and result = "Base16"
+      or
+      name = "a85encode" and result = "Ascii85"
+      or
+      name = "b85encode" and result = "Base85"
     }
   }
 
   /** A call to any of the decode functions in the `base64` module. */
-  private class Base64DecodeCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class Base64DecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
+    string name;
 
     Base64DecodeCall() {
-      exists(string name |
-        name in [
-            "b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
-            "decodestring", "a85decode", "b85decode", "decodebytes"
-          ] and
-        node.getFunction() = base64_attr(name).asCfgNode()
-      )
+      name in [
+          "b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
+          "decodestring", "a85decode", "b85decode", "decodebytes"
+        ] and
+      this = base64_attr(name).getACall()
     }
 
     override predicate mayExecuteInput() { none() }
@@ -864,20 +559,18 @@ private module Stdlib {
     override DataFlow::Node getOutput() { result = this }
 
     override string getFormat() {
-      exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
-        name in [
-            "b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
-          ] and
-        result = "Base64"
-        or
-        name = "b32decode" and result = "Base32"
-        or
-        name = "b16decode" and result = "Base16"
-        or
-        name = "a85decode" and result = "Ascii85"
-        or
-        name = "b85decode" and result = "Base85"
-      )
+      name in [
+          "b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
+        ] and
+      result = "Base64"
+      or
+      name = "b32decode" and result = "Base32"
+      or
+      name = "b16decode" and result = "Base16"
+      or
+      name = "a85decode" and result = "Ascii85"
+      or
+      name = "b85decode" and result = "Base85"
     }
   }
 
@@ -885,63 +578,20 @@ private module Stdlib {
   // json
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `json` module. */
-  private DataFlow::Node json(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("json")
-    or
-    exists(DataFlow::TypeTracker t2 | result = json(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `json` module. */
-  DataFlow::Node json() { result = json(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `json` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node json_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["loads", "dumps"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("json" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = json()
-    )
-    or
-    // Due to bad performance when using normal setup with `json_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        json_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate json_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(json_attr(t2, attr_name), res, summary)
-  }
+  API::Node json() { result = API::moduleImport("node") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `json` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node json_attr(string attr_name) {
-    result = json_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node json_attr(string attr_name) { result = json().getMember(attr_name) }
 
   /**
    * A call to `json.loads`
    * See https://docs.python.org/3/library/json.html#json.loads
    */
-  private class JsonLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    JsonLoadsCall() { node.getFunction() = json_attr("loads").asCfgNode() }
+  private class JsonLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    JsonLoadsCall() { this = json_attr("loads").getACall() }
 
     override predicate mayExecuteInput() { none() }
 
@@ -956,10 +606,8 @@ private module Stdlib {
    * A call to `json.dumps`
    * See https://docs.python.org/3/library/json.html#json.dumps
    */
-  private class JsonDumpsCall extends Encoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    JsonDumpsCall() { node.getFunction() = json_attr("dumps").asCfgNode() }
+  private class JsonDumpsCall extends Encoding::Range, DataFlow::CallCfgNode {
+    JsonDumpsCall() { this = json_attr("dumps").getACall() }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
 
@@ -972,15 +620,7 @@ private module Stdlib {
   // cgi
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `cgi` module. */
-  private DataFlow::Node cgi(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("cgi")
-    or
-    exists(DataFlow::TypeTracker t2 | result = cgi(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `cgi` module. */
-  DataFlow::Node cgi() { result = cgi(DataFlow::TypeTracker::end()) }
+  API::Node cgi() { result = API::moduleImport("cgi") }
 
   /** Provides models for the `cgi` module. */
   module cgi {
@@ -991,15 +631,7 @@ private module Stdlib {
      */
     module FieldStorage {
       /** Gets a reference to the `cgi.FieldStorage` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.startInAttr("FieldStorage") and
-        result = cgi()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `cgi.FieldStorage` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = cgi().getMember("FieldStorage") }
 
       /**
        * A source of instances of `cgi.FieldStorage`, extend this class to model new instances.
@@ -1020,145 +652,86 @@ private module Stdlib {
        * if it turns out to be a problem, we'll have to refine.
        */
       private class ClassInstantiation extends InstanceSource, RemoteFlowSource::Range,
-        DataFlow::CfgNode {
-        override CallNode node;
-
-        ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        DataFlow::CallCfgNode {
+        ClassInstantiation() { this = classRef().getACall() }
 
         override string getSourceType() { result = "cgi.FieldStorage" }
       }
 
       /** Gets a reference to an instance of `cgi.FieldStorage`. */
-      private DataFlow::Node instance(DataFlow::TypeTracker t) {
-        t.start() and
-        result instanceof InstanceSource
-        or
-        exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-      }
-
-      /** Gets a reference to an instance of `cgi.FieldStorage`. */
-      DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
-
-      /** Gets a reference to the `getvalue` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getvalueRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getvalue") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getvalueRef(t2).track(t2, t))
-      }
+      API::Node instance() { result = classRef().getReturn() }
 
       /** Gets a reference to the `getvalue` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getvalueRef() { result = getvalueRef(DataFlow::TypeTracker::end()) }
-
-      /** Gets a reference to the result of calling the `getvalue` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getvalueResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getvalueRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getvalueResult(t2).track(t2, t))
-      }
+      API::Node getvalueRef() { result = instance().getMember("getvalue") }
 
       /** Gets a reference to the result of calling the `getvalue` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getvalueResult() { result = getvalueResult(DataFlow::TypeTracker::end()) }
-
-      /** Gets a reference to the `getfirst` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getfirstRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getfirst") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getfirstRef(t2).track(t2, t))
-      }
+      API::Node getvalueResult() { result = getvalueRef().getReturn() }
 
       /** Gets a reference to the `getfirst` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getfirstRef() { result = getfirstRef(DataFlow::TypeTracker::end()) }
-
-      /** Gets a reference to the result of calling the `getfirst` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getfirstResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getfirstRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getfirstResult(t2).track(t2, t))
-      }
+      API::Node getfirstRef() { result = instance().getMember("getfirst") }
 
       /** Gets a reference to the result of calling the `getfirst` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getfirstResult() { result = getfirstResult(DataFlow::TypeTracker::end()) }
-
-      /** Gets a reference to the `getlist` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getlistRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getlist") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getlistRef(t2).track(t2, t))
-      }
+      API::Node getfirstResult() { result = getfirstRef().getReturn() }
 
       /** Gets a reference to the `getlist` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getlistRef() { result = getlistRef(DataFlow::TypeTracker::end()) }
+      API::Node getlistRef() { result = instance().getMember("getlist") }
 
       /** Gets a reference to the result of calling the `getlist` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getlistResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getlistRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getlistResult(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the result of calling the `getlist` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getlistResult() { result = getlistResult(DataFlow::TypeTracker::end()) }
+      API::Node getlistResult() { result = getlistRef().getReturn() }
 
       /** Gets a reference to a list of fields. */
-      private DataFlow::Node fieldList(DataFlow::TypeTracker t) {
+      private DataFlow::LocalSourceNode fieldList(DataFlow::TypeTracker t) {
         t.start() and
-        (
-          result = getlistResult()
-          or
-          result = getvalueResult()
-          or
-          // TODO: Should have better handling of subscripting
-          result.asCfgNode().(SubscriptNode).getObject() = instance().asCfgNode()
-        )
+        // TODO: Should have better handling of subscripting
+        result.asCfgNode().(SubscriptNode).getObject() = instance().getAUse().asCfgNode()
         or
         exists(DataFlow::TypeTracker t2 | result = fieldList(t2).track(t2, t))
       }
 
       /** Gets a reference to a list of fields. */
-      DataFlow::Node fieldList() { result = fieldList(DataFlow::TypeTracker::end()) }
+      DataFlow::Node fieldList() {
+        result = getlistResult().getAUse() or
+        result = getvalueResult().getAUse() or
+        fieldList(DataFlow::TypeTracker::end()).flowsTo(result)
+      }
 
       /** Gets a reference to a field. */
-      private DataFlow::Node field(DataFlow::TypeTracker t) {
+      private DataFlow::LocalSourceNode field(DataFlow::TypeTracker t) {
         t.start() and
-        (
-          result = getfirstResult()
-          or
-          result = getvalueResult()
-          or
-          // TODO: Should have better handling of subscripting
-          result.asCfgNode().(SubscriptNode).getObject() = [instance(), fieldList()].asCfgNode()
-        )
+        // TODO: Should have better handling of subscripting
+        result.asCfgNode().(SubscriptNode).getObject() =
+          [instance().getAUse(), fieldList()].asCfgNode()
         or
         exists(DataFlow::TypeTracker t2 | result = field(t2).track(t2, t))
       }
 
       /** Gets a reference to a field. */
-      DataFlow::Node field() { result = field(DataFlow::TypeTracker::end()) }
+      DataFlow::Node field() {
+        result = getfirstResult().getAUse()
+        or
+        result = getvalueResult().getAUse()
+        or
+        field(DataFlow::TypeTracker::end()).flowsTo(result)
+      }
 
       private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
         override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
           // Methods
           nodeFrom = nodeTo.(DataFlow::AttrRead).getObject() and
-          nodeFrom = instance() and
-          nodeTo in [getvalueRef(), getfirstRef(), getlistRef()]
+          nodeFrom = instance().getAUse() and
+          nodeTo = [getvalueRef(), getfirstRef(), getlistRef()].getAUse()
           or
           nodeFrom.asCfgNode() = nodeTo.asCfgNode().(CallNode).getFunction() and
           (
-            nodeFrom = getvalueRef() and nodeTo = getvalueResult()
+            nodeFrom = getvalueRef().getAUse() and nodeTo = getvalueResult().getAnImmediateUse()
             or
-            nodeFrom = getfirstRef() and nodeTo = getfirstResult()
+            nodeFrom = getfirstRef().getAUse() and nodeTo = getfirstResult().getAnImmediateUse()
             or
-            nodeFrom = getlistRef() and nodeTo = getlistResult()
+            nodeFrom = getlistRef().getAUse() and nodeTo = getlistResult().getAnImmediateUse()
           )
           or
           // Indexing
-          nodeFrom in [instance(), fieldList()] and
+          nodeFrom in [instance().getAUse(), fieldList()] and
           nodeTo.asCfgNode().(SubscriptNode).getObject() = nodeFrom.asCfgNode()
           or
           // Attributes on Field
@@ -1175,15 +748,7 @@ private module Stdlib {
   // BaseHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `BaseHTTPServer` module. */
-  private DataFlow::Node baseHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("BaseHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = baseHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `BaseHTTPServer` module. */
-  DataFlow::Node baseHTTPServer() { result = baseHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node baseHTTPServer() { result = API::moduleImport("BaseHTTPServer") }
 
   /** Provides models for the `BaseHTTPServer` module. */
   module BaseHTTPServer {
@@ -1192,18 +757,7 @@ private module Stdlib {
      */
     module BaseHTTPRequestHandler {
       /** Gets a reference to the `BaseHTTPServer.BaseHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("BaseHTTPServer" + "." + "BaseHTTPRequestHandler")
-        or
-        t.startInAttr("BaseHTTPRequestHandler") and
-        result = baseHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `BaseHTTPServer.BaseHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = baseHTTPServer().getMember("BaseHTTPRequestHandler") }
     }
   }
 
@@ -1211,15 +765,7 @@ private module Stdlib {
   // SimpleHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `SimpleHTTPServer` module. */
-  private DataFlow::Node simpleHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("SimpleHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = simpleHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `SimpleHTTPServer` module. */
-  DataFlow::Node simpleHTTPServer() { result = simpleHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node simpleHTTPServer() { result = API::moduleImport("SimpleHTTPServer") }
 
   /** Provides models for the `SimpleHTTPServer` module. */
   module SimpleHTTPServer {
@@ -1228,18 +774,7 @@ private module Stdlib {
      */
     module SimpleHTTPRequestHandler {
       /** Gets a reference to the `SimpleHTTPServer.SimpleHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("SimpleHTTPServer" + "." + "SimpleHTTPRequestHandler")
-        or
-        t.startInAttr("SimpleHTTPRequestHandler") and
-        result = simpleHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `SimpleHTTPServer.SimpleHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = simpleHTTPServer().getMember("SimpleHTTPRequestHandler") }
     }
   }
 
@@ -1247,15 +782,7 @@ private module Stdlib {
   // CGIHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `CGIHTTPServer` module. */
-  private DataFlow::Node cgiHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("CGIHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = cgiHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `CGIHTTPServer` module. */
-  DataFlow::Node cgiHTTPServer() { result = cgiHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node cgiHTTPServer() { result = API::moduleImport("CGIHTTPServer") }
 
   /** Provides models for the `CGIHTTPServer` module. */
   module CGIHTTPServer {
@@ -1264,18 +791,7 @@ private module Stdlib {
      */
     module CGIHTTPRequestHandler {
       /** Gets a reference to the `CGIHTTPServer.CGIHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("CGIHTTPServer" + "." + "CGIHTTPRequestHandler")
-        or
-        t.startInAttr("CGIHTTPRequestHandler") and
-        result = cgiHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `CGIHTTPServer.CGIHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = cgiHTTPServer().getMember("CGIHTTPRequestHandler") }
     }
   }
 
@@ -1283,54 +799,13 @@ private module Stdlib {
   // http (Python 3 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `http` module. */
-  private DataFlow::Node http(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("http")
-    or
-    exists(DataFlow::TypeTracker t2 | result = http(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `http` module. */
-  DataFlow::Node http() { result = http(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `http` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["server"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("http" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = http()
-    )
-    or
-    // Due to bad performance when using normal setup with `http_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        http_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate http_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(http_attr(t2, attr_name), res, summary)
-  }
+  API::Node http() { result = API::moduleImport("http") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `http` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node http_attr(string attr_name) {
-    result = http_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node http_attr(string attr_name) { result = http().getMember(attr_name) }
 
   /** Provides models for the `http` module. */
   module http {
@@ -1338,7 +813,7 @@ private module Stdlib {
     // http.server
     // -------------------------------------------------------------------------
     /** Gets a reference to the `http.server` module. */
-    DataFlow::Node server() { result = http_attr("server") }
+    API::Node server() { result = http_attr("server") }
 
     /** Provides models for the `http.server` module */
     module server {
@@ -1346,41 +821,7 @@ private module Stdlib {
        * Gets a reference to the attribute `attr_name` of the `http.server` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node server_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["BaseHTTPRequestHandler", "SimpleHTTPRequestHandler", "CGIHTTPRequestHandler"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("http.server" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = server()
-        )
-        or
-        // Due to bad performance when using normal setup with `server_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            server_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate server_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(server_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `http.server` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node server_attr(string attr_name) {
-        result = server_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node server_attr(string attr_name) { result = server().getMember(attr_name) }
 
       /**
        * Provides models for the `http.server.BaseHTTPRequestHandler` class (Python 3 only).
@@ -1389,7 +830,7 @@ private module Stdlib {
        */
       module BaseHTTPRequestHandler {
         /** Gets a reference to the `http.server.BaseHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("BaseHTTPRequestHandler") }
+        API::Node classRef() { result = server_attr("BaseHTTPRequestHandler") }
       }
 
       /**
@@ -1399,7 +840,7 @@ private module Stdlib {
        */
       module SimpleHTTPRequestHandler {
         /** Gets a reference to the `http.server.SimpleHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("SimpleHTTPRequestHandler") }
+        API::Node classRef() { result = server_attr("SimpleHTTPRequestHandler") }
       }
 
       /**
@@ -1409,7 +850,7 @@ private module Stdlib {
        */
       module CGIHTTPRequestHandler {
         /** Gets a reference to the `http.server.CGIHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("CGIHTTPRequestHandler") }
+        API::Node classRef() { result = server_attr("CGIHTTPRequestHandler") }
       }
     }
   }
@@ -1423,35 +864,23 @@ private module Stdlib {
    */
   private module HTTPRequestHandler {
     /** Gets a reference to the `BaseHTTPRequestHandler` class or any subclass. */
-    private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-      // Python 2
-      t.start() and
-      result in [
+    API::Node subclassRef() {
+      result =
+        [
+          // Python 2
           BaseHTTPServer::BaseHTTPRequestHandler::classRef(),
           SimpleHTTPServer::SimpleHTTPRequestHandler::classRef(),
-          CGIHTTPServer::CGIHTTPRequestHandler::classRef()
-        ]
-      or
-      // Python 3
-      t.start() and
-      result in [
+          CGIHTTPServer::CGIHTTPRequestHandler::classRef(),
+          // Python 3
           http::server::BaseHTTPRequestHandler::classRef(),
           http::server::SimpleHTTPRequestHandler::classRef(),
           http::server::CGIHTTPRequestHandler::classRef()
-        ]
-      or
-      // subclasses in project code
-      result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-      or
-      exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
+        ].getASubclass*()
     }
 
-    /** Gets a reference to the `BaseHTTPRequestHandler` class or any subclass. */
-    DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
-
     /** A HTTPRequestHandler class definition (most likely in project code). */
     class HTTPRequestHandlerClassDef extends Class {
-      HTTPRequestHandlerClassDef() { this.getParent() = subclassRef().asExpr() }
+      HTTPRequestHandlerClassDef() { this.getParent() = subclassRef().getAUse().asExpr() }
     }
 
     /**
@@ -1475,7 +904,7 @@ private module Stdlib {
     }
 
     /** Gets a reference to an instance of the `BaseHTTPRequestHandler` class or any subclass. */
-    private DataFlow::Node instance(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
       t.start() and
       result instanceof InstanceSource
       or
@@ -1483,7 +912,7 @@ private module Stdlib {
     }
 
     /** Gets a reference to an instance of the `BaseHTTPRequestHandler` class or any subclass. */
-    DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+    DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
       override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

From 2329b3160105fd2b7bfc34af13563f740ae41df9 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 9 Apr 2021 20:49:45 +0200
Subject: [PATCH 156/433] C++: Replace the new SmartPointerPartialDefinition
 with additional steps in AddressFlow.qll

---
 .../cpp/dataflow/internal/AddressFlow.qll     |  29 +++++
 .../cpp/dataflow/internal/DataFlowUtil.qll    |  14 ---
 .../code/cpp/dataflow/internal/FlowVar.qll    |  58 ---------
 .../models/implementations/SmartPointer.qll   |   2 +
 .../cpp/models/interfaces/PointerWrapper.qll  |   3 +
 .../dataflow/taint-tests/localTaint.expected  | 119 +++++++++++++++---
 .../dataflow/taint-tests/smart_pointer.cpp    |  33 +++++
 7 files changed, 169 insertions(+), 89 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 7024f9d8598c..70af0b25c23a 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -15,6 +15,7 @@
  */
 
 private import cpp
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
  * Holds if `f` is an instantiation of the `std::move` or `std::forward`
@@ -58,6 +59,8 @@ private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
   pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
   or
   pointerIn = lvalueOut.(PointerDereferenceExpr).getOperand().getFullyConverted()
+  or
+  pointerIn = lvalueOut.(OverloadedPointerDereferenceExpr).getQualifier().getFullyConverted()
 }
 
 private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
@@ -94,6 +97,12 @@ private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
 
 private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
   lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
+  or
+  exists(PointerWrapper wrapper, Call call | call = referenceOut |
+    referenceOut.getUnspecifiedType() instanceof ReferenceType and
+    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
+    lvalueIn = call.getQualifier().getFullyConverted()
+  )
 }
 
 private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
@@ -106,6 +115,13 @@ private predicate referenceToPointerStep(Expr referenceIn, Expr pointerOut) {
       stdAddressOf(call.getTarget()) and
       referenceIn = call.getArgument(0).getFullyConverted()
     )
+  or
+  exists(CopyConstructor copy, Call call | call = pointerOut |
+    copy.getDeclaringType() instanceof PointerWrapper and
+    call.getTarget() = copy and
+    // The 0'th argument is the value being copied.
+    referenceIn = call.getArgument(0).getFullyConverted()
+  )
 }
 
 private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
@@ -190,6 +206,19 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
         // See the `lvalueToUpdate` case for an explanation of this conjunct.
         call.getType().isDeeplyConstBelow()
       )
+      or
+      // Pointer wrappers behave as raw pointers for dataflow purposes.
+      outer = call.getAnArgument().getFullyConverted() and
+      exists(PointerWrapper wrapper | wrapper = outer.getType().stripTopLevelSpecifiers() |
+        not wrapper.pointsToConst()
+      )
+      or
+      outer = call.getQualifier().getFullyConverted() and
+      outer.getUnspecifiedType() instanceof PointerWrapper and
+      not (
+        call.getTarget().hasSpecifier("const") and
+        call.getType().isDeeplyConstBelow()
+      )
     )
     or
     exists(PointerFieldAccess fa |
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 810c74e3e699..fd91638b7aa1 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -199,8 +199,6 @@ class DefinitionByReferenceOrIteratorNode extends PartialDefinitionNode {
       this.getPartialDefinition() instanceof DefinitionByReference
       or
       this.getPartialDefinition() instanceof DefinitionByIterator
-      or
-      this.getPartialDefinition() instanceof DefinitionBySmartPointer
     )
   }
 
@@ -332,18 +330,6 @@ private class IteratorPartialDefinitionNode extends PartialDefinitionNode {
   override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
 }
 
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data flow node used for flow into a collection when a smart pointer
- * write occurs in a callee.
- */
-private class SmartPointerPartialDefinitionNode extends PartialDefinitionNode {
-  override SmartPointerPartialDefinition pd;
-
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-}
-
 /**
  * A post-update node on the `e->f` in `f(&e->f)` (and other forms).
  */
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index 0e5d6ea5fa74..79728629a9a1 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -242,39 +242,6 @@ private module PartialDefinitions {
     }
   }
 
-  class SmartPointerPartialDefinition extends PartialDefinition {
-    Variable pointer;
-    Expr innerDefinedExpr;
-
-    SmartPointerPartialDefinition() {
-      innerDefinedExpr = pragma[only_bind_out](getInnerDefinedExpr(this, node)) and
-      innerDefinedExpr = getAPointerWrapperAccess(pointer, -1)
-      or
-      // Pointer wrappers passed to a function by value.
-      exists(Call call |
-        call = node and
-        call.getAnArgument() = innerDefinedExpr and
-        innerDefinedExpr = this and
-        this = getAPointerWrapperAccess(pointer, 0) and
-        not call instanceof OverloadedPointerDereferenceExpr
-      )
-    }
-
-    deprecated override predicate partiallyDefines(Variable v) { v = pointer }
-
-    deprecated override predicate partiallyDefinesThis(ThisExpr e) { none() }
-
-    override predicate definesExpressions(Expr inner, Expr outer) {
-      inner = innerDefinedExpr and
-      outer = this
-    }
-
-    override predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn) {
-      v = pointer and
-      cfn = node
-    }
-  }
-
   /**
    * A partial definition that's a definition via an output iterator.
    */
@@ -288,15 +255,6 @@ private module PartialDefinitions {
   class DefinitionByReference extends VariablePartialDefinition {
     DefinitionByReference() { exists(Call c | this = c.getAnArgument() or this = c.getQualifier()) }
   }
-
-  /**
-   * A partial definition that's a definition via a smart pointer being passed into a function.
-   */
-  class DefinitionBySmartPointer extends SmartPointerPartialDefinition {
-    DefinitionBySmartPointer() {
-      exists(Call c | this = c.getAnArgument() or this = c.getQualifier())
-    }
-  }
 }
 
 import PartialDefinitions
@@ -876,22 +834,6 @@ module FlowVar_internal {
     )
   }
 
-  /**
-   * Gets either:
-   * - A call to an unwrapper function, where an access to `pointer` is the qualifier, or
-   * - A call to the `CopyConstructor` that copies the value of an access to `pointer`.
-   */
-  Call getAPointerWrapperAccess(Variable pointer, int n) {
-    exists(PointerWrapper wrapper | wrapper = pointer.getUnspecifiedType().stripType() |
-      n = -1 and
-      result.getQualifier() = pointer.getAnAccess() and
-      result.getTarget() = wrapper.getAnUnwrapperFunction()
-      or
-      result.getArgument(n) = pointer.getAnAccess() and
-      result.getTarget() instanceof CopyConstructor
-    )
-  }
-
   class IteratorParameter extends Parameter {
     IteratorParameter() { this.getUnspecifiedType() instanceof Iterator }
   }
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index 4bcf5aa3575f..4b060c234f89 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -13,6 +13,8 @@ private class UniqueOrSharedPtr extends Class, PointerWrapper {
     or
     result.getClassAndName(["operator->", "get"]) = this
   }
+
+  override predicate pointsToConst() { this.getTemplateArgument(0).(Type).isConst() }
 }
 
 /** Any function that unwraps a pointer wrapper class to reveal the underlying pointer. */
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll
index 447e7f7cedea..8948aee424b2 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll
@@ -11,4 +11,7 @@ abstract class PointerWrapper extends Class {
    * that return a reference to the pointed-to object.
    */
   abstract MemberFunction getAnUnwrapperFunction();
+
+  /** Holds if the type of the data that is pointed to by this pointer wrapper is `const`. */
+  abstract predicate pointsToConst();
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index ad8b5bbb98e9..dd15fa7cd983 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3223,47 +3223,55 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
+| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* |  |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
+| smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
 | smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:11:18:11 | p | smart_pointer.cpp:18:10:18:10 | call to operator* | TAINT |
+| smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
 | smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
+| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* |  |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
+| smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
 | smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:11:30:11 | p | smart_pointer.cpp:30:10:30:10 | call to operator* | TAINT |
+| smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
 | smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:37:6:37:6 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:39:11:39:11 | p |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
+| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* |  |
+| smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:10:37:15 | call to source | smart_pointer.cpp:37:5:37:17 | ... = ... |  |
 | smart_pointer.cpp:38:10:38:10 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
-| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* | TAINT |
+| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:45:6:45:6 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
+| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* |  |
+| smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:10:45:15 | call to source | smart_pointer.cpp:45:5:45:17 | ... = ... |  |
 | smart_pointer.cpp:46:10:46:10 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
-| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* | TAINT |
+| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* |  |
 | smart_pointer.cpp:51:30:51:50 | call to make_shared | smart_pointer.cpp:52:10:52:10 | p |  |
 | smart_pointer.cpp:51:52:51:57 | call to source | smart_pointer.cpp:51:30:51:50 | call to make_shared | TAINT |
 | smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get |  |
@@ -3282,15 +3290,18 @@
 | smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:71:4:71:6 | ptr |  |
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
-| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* | TAINT |
+| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* |  |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:10:71:15 | call to source | smart_pointer.cpp:71:3:71:17 | ... = ... |  |
 | smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p |  |
 | smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
-| smart_pointer.cpp:76:13:76:13 | call to shared_ptr [post update] | smart_pointer.cpp:77:9:77:9 | p |  |
 | smart_pointer.cpp:76:13:76:13 | p | smart_pointer.cpp:76:13:76:13 | call to shared_ptr |  |
-| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* | TAINT |
+| smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:86:45:86:45 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:87:3:87:3 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:88:8:88:8 | p |  |
@@ -3306,10 +3317,7 @@
 | smart_pointer.cpp:87:3:87:3 | ref arg p | smart_pointer.cpp:89:8:89:8 | p |  |
 | smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:87:6:87:6 | x [post update] |  |
 | smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:88:11:88:11 | x |  |
-| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:86:45:86:45 | p |  |
 | smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:87:3:87:3 | ref arg p |  |
-| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:88:8:88:8 | p |  |
-| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:89:8:89:8 | p |  |
 | smart_pointer.cpp:87:10:87:15 | call to source | smart_pointer.cpp:87:3:87:17 | ... = ... |  |
 | smart_pointer.cpp:88:8:88:8 | p | smart_pointer.cpp:88:9:88:9 | call to operator-> |  |
 | smart_pointer.cpp:88:8:88:8 | ref arg p | smart_pointer.cpp:86:45:86:45 | p |  |
@@ -3323,11 +3331,7 @@
 | smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:94:8:94:8 | q |  |
 | smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:91:9:91:9 | x [post update] |  |
 | smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:92:14:92:14 | x |  |
-| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:86:67:86:67 | q |  |
 | smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:91:3:91:3 | ref arg q |  |
-| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:92:8:92:8 | q |  |
-| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:93:8:93:8 | q |  |
-| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:94:8:94:8 | q |  |
 | smart_pointer.cpp:91:13:91:18 | call to source | smart_pointer.cpp:91:3:91:20 | ... = ... |  |
 | smart_pointer.cpp:92:8:92:8 | q | smart_pointer.cpp:92:9:92:9 | call to operator-> |  |
 | smart_pointer.cpp:92:8:92:8 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
@@ -3346,8 +3350,80 @@
 | smart_pointer.cpp:103:11:103:11 | p | smart_pointer.cpp:103:13:103:15 | call to get |  |
 | smart_pointer.cpp:103:11:103:11 | ref arg p | smart_pointer.cpp:104:8:104:8 | p |  |
 | smart_pointer.cpp:103:13:103:15 | ref arg call to get | smart_pointer.cpp:103:11:103:11 | ref arg p |  |
-| smart_pointer.cpp:103:13:103:15 | ref arg call to get | smart_pointer.cpp:104:8:104:8 | p |  |
 | smart_pointer.cpp:104:8:104:8 | p | smart_pointer.cpp:104:9:104:9 | call to operator-> |  |
+| smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
+| smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:113:2:113:4 | ptr |  |
+| smart_pointer.cpp:113:2:113:4 | ptr | smart_pointer.cpp:113:5:113:5 | call to operator-> |  |
+| smart_pointer.cpp:113:2:113:4 | ref arg ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
+| smart_pointer.cpp:113:2:113:18 | ... = ... | smart_pointer.cpp:113:7:113:7 | x [post update] |  |
+| smart_pointer.cpp:113:5:113:5 | call to operator-> [post update] | smart_pointer.cpp:113:2:113:4 | ref arg ptr |  |
+| smart_pointer.cpp:113:11:113:16 | call to source | smart_pointer.cpp:113:2:113:18 | ... = ... |  |
+| smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:117:2:117:4 | ptr |  |
+| smart_pointer.cpp:117:2:117:4 | ptr | smart_pointer.cpp:117:5:117:5 | call to operator-> |  |
+| smart_pointer.cpp:117:2:117:18 | ... = ... | smart_pointer.cpp:117:7:117:7 | x [post update] |  |
+| smart_pointer.cpp:117:5:117:5 | call to operator-> [post update] | smart_pointer.cpp:117:2:117:4 | ref arg ptr |  |
+| smart_pointer.cpp:117:11:117:16 | call to source | smart_pointer.cpp:117:2:117:18 | ... = ... |  |
+| smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:121:4:121:6 | ptr |  |
+| smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
+| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
+| smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:121:10:121:15 | call to source | smart_pointer.cpp:121:3:121:17 | ... = ... |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:125:18:125:19 | p1 |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:126:8:126:9 | p1 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:128:14:128:15 | p2 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:125:18:125:19 | p1 | smart_pointer.cpp:125:20:125:20 | call to operator-> |  |
+| smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:126:8:126:9 | p1 |  |
+| smart_pointer.cpp:125:18:125:22 | ref arg call to shared_ptr | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
+| smart_pointer.cpp:125:20:125:20 | call to operator-> [post update] | smart_pointer.cpp:125:18:125:19 | ref arg p1 |  |
+| smart_pointer.cpp:125:22:125:22 | q | smart_pointer.cpp:125:18:125:22 | call to shared_ptr |  |
+| smart_pointer.cpp:126:8:126:9 | p1 | smart_pointer.cpp:126:10:126:10 | call to operator-> |  |
+| smart_pointer.cpp:126:8:126:9 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 |  |
+| smart_pointer.cpp:126:12:126:12 | q | smart_pointer.cpp:126:13:126:13 | call to operator-> |  |
+| smart_pointer.cpp:128:13:128:13 | call to operator* | smart_pointer.cpp:128:13:128:15 | call to shared_ptr | TAINT |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:128:14:128:15 | p2 | smart_pointer.cpp:128:13:128:13 | call to operator* | TAINT |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:129:9:129:9 | call to operator* | smart_pointer.cpp:129:8:129:8 | call to operator* | TAINT |
+| smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:8:129:8 | call to operator* |  |
+| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:9:129:9 | call to operator* | TAINT |
+| smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:133:23:133:24 | p1 |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:136:18:136:19 | p2 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:137:10:137:11 | p2 |  |
+| smart_pointer.cpp:133:23:133:24 | p1 | smart_pointer.cpp:133:25:133:25 | call to operator-> |  |
+| smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
+| smart_pointer.cpp:134:8:134:9 | p1 | smart_pointer.cpp:134:10:134:10 | call to operator-> |  |
+| smart_pointer.cpp:134:8:134:9 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:134:10:134:10 | call to operator-> [post update] | smart_pointer.cpp:134:8:134:9 | ref arg p1 |  |
+| smart_pointer.cpp:134:12:134:12 | q | smart_pointer.cpp:134:13:134:13 | call to operator-> |  |
+| smart_pointer.cpp:136:18:136:19 | p2 | smart_pointer.cpp:136:17:136:17 | call to operator* | TAINT |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 |  |
+| smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
+| smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:8:137:8 | call to operator* |  |
+| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:9:137:9 | call to operator* | TAINT |
+| smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:39:45:39:51 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:40:11:40:17 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:41:12:41:18 | source1 |  |
@@ -3383,20 +3459,26 @@
 | standalone_iterators.cpp:85:35:85:36 | c1 | standalone_iterators.cpp:85:38:85:42 | call to begin | TAINT |
 | standalone_iterators.cpp:85:35:85:36 | ref arg c1 | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:85:38:85:42 | call to begin | standalone_iterators.cpp:86:6:86:7 | i1 |  |
+| standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:86:6:86:7 | i1 | standalone_iterators.cpp:86:8:86:8 | call to operator-- |  |
 | standalone_iterators.cpp:86:8:86:8 | call to operator-- | standalone_iterators.cpp:86:5:86:5 | call to operator* | TAINT |
+| standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
 | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
+| standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:13:86:18 | call to source | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | c2 | standalone_iterators.cpp:89:38:89:42 | call to begin | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | ref arg c2 | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:89:38:89:42 | call to begin | standalone_iterators.cpp:90:6:90:7 | i2 |  |
+| standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:90:6:90:7 | i2 | standalone_iterators.cpp:90:8:90:8 | call to operator-- |  |
 | standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
+| standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
 | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
+| standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 |  |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 |  |
@@ -3414,10 +3496,13 @@
 | standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b |  |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
+| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index 51718510b0ad..6ab09046c4e5 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -102,4 +102,37 @@ void reverse_taint_smart_pointer() {
   std::unique_ptr<A> p = std::unique_ptr<A>(new A);
   taint_x(p.get());
   sink(p->x); // $ ast MISSING: ir
+}
+
+struct C {
+	int z;
+	std::shared_ptr<A> q;
+};
+
+void taint_x_shared(std::shared_ptr<A> ptr) {
+	ptr->x = source();
+}
+
+void taint_x_shared_cref(const std::shared_ptr<A>& ptr) {
+	ptr->x = source();
+}
+
+void getNumberCRef(const std::shared_ptr<int>& ptr) {
+  *ptr = source();
+}
+
+int nested_shared_ptr_taint(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
+  taint_x_shared(p1->q);
+  sink(p1->q->x); // $ ast MISSING: ir
+
+  getNumber(*p2);
+  sink(**p2); // $ ast MISSING: ir
+}
+
+int nested_shared_ptr_taint_cref(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
+  taint_x_shared_cref(p1->q);
+  sink(p1->q->x); // $ MISSING: ast,ir
+
+  getNumberCRef(*p2);
+  sink(**p2); // $ MISSING: ast,ir
 }
\ No newline at end of file

From 1510fe370df737f6e7593203bbad4fff72f4e438 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 9 Apr 2021 20:58:05 +0200
Subject: [PATCH 157/433] C++: Add cases for const pointer wrapper references
 to AddressFlow and FlowVar.

---
 .../code/cpp/dataflow/internal/AddressFlow.qll  |  4 +++-
 .../code/cpp/dataflow/internal/FlowVar.qll      |  9 ++++++++-
 .../dataflow/taint-tests/localTaint.expected    | 17 +++++++++++++++++
 .../dataflow/taint-tests/smart_pointer.cpp      |  4 ++--
 4 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 70af0b25c23a..7e76c1540e30 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -247,7 +247,9 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
     not stdIdentityFunction(call.getTarget()) and
     not stdAddressOf(call.getTarget()) and
     exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
-      not rt.getBaseType().isConst()
+      not rt.getBaseType().isConst() or
+      rt.getBaseType().getUnspecifiedType() =
+        any(PointerWrapper wrapper | not wrapper.pointsToConst())
     )
   ) and
   reference = outer
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index 79728629a9a1..e3f8b6f68fb5 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -644,7 +644,14 @@ module FlowVar_internal {
   predicate parameterIsNonConstReference(Parameter p) {
     exists(ReferenceType refType |
       refType = p.getUnderlyingType() and
-      not refType.getBaseType().isConst()
+      (
+        not refType.getBaseType().isConst()
+        or
+        // A field of a parameter of type `const std::shared_ptr<A>& p` can still be changed even though
+        // the base type of the reference is `const`.
+        refType.getBaseType().getUnspecifiedType() =
+          any(PointerWrapper wrapper | not wrapper.pointsToConst())
+      )
     )
     or
     p instanceof IteratorParameter
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index dd15fa7cd983..50d5070a1442 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3301,6 +3301,8 @@
 | smart_pointer.cpp:76:13:76:13 | p | smart_pointer.cpp:76:13:76:13 | call to shared_ptr |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:77:9:77:9 | p |  |
 | smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:86:45:86:45 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:87:3:87:3 | p |  |
@@ -3358,15 +3360,20 @@
 | smart_pointer.cpp:113:2:113:18 | ... = ... | smart_pointer.cpp:113:7:113:7 | x [post update] |  |
 | smart_pointer.cpp:113:5:113:5 | call to operator-> [post update] | smart_pointer.cpp:113:2:113:4 | ref arg ptr |  |
 | smart_pointer.cpp:113:11:113:16 | call to source | smart_pointer.cpp:113:2:113:18 | ... = ... |  |
+| smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
 | smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:117:2:117:4 | ptr |  |
 | smart_pointer.cpp:117:2:117:4 | ptr | smart_pointer.cpp:117:5:117:5 | call to operator-> |  |
+| smart_pointer.cpp:117:2:117:4 | ref arg ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
 | smart_pointer.cpp:117:2:117:18 | ... = ... | smart_pointer.cpp:117:7:117:7 | x [post update] |  |
 | smart_pointer.cpp:117:5:117:5 | call to operator-> [post update] | smart_pointer.cpp:117:2:117:4 | ref arg ptr |  |
 | smart_pointer.cpp:117:11:117:16 | call to source | smart_pointer.cpp:117:2:117:18 | ... = ... |  |
+| smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:121:4:121:6 | ptr |  |
+| smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
 | smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
+| smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:10:121:15 | call to source | smart_pointer.cpp:121:3:121:17 | ... = ... |  |
 | smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
@@ -3381,11 +3388,16 @@
 | smart_pointer.cpp:125:18:125:22 | ref arg call to shared_ptr | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
 | smart_pointer.cpp:125:20:125:20 | call to operator-> [post update] | smart_pointer.cpp:125:18:125:19 | ref arg p1 |  |
 | smart_pointer.cpp:125:22:125:22 | q | smart_pointer.cpp:125:18:125:22 | call to shared_ptr |  |
+| smart_pointer.cpp:125:22:125:22 | ref arg q | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
 | smart_pointer.cpp:126:8:126:9 | p1 | smart_pointer.cpp:126:10:126:10 | call to operator-> |  |
 | smart_pointer.cpp:126:8:126:9 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
 | smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 |  |
 | smart_pointer.cpp:126:12:126:12 | q | smart_pointer.cpp:126:13:126:13 | call to operator-> |  |
 | smart_pointer.cpp:128:13:128:13 | call to operator* | smart_pointer.cpp:128:13:128:15 | call to shared_ptr | TAINT |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 |  |
 | smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
 | smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
@@ -3410,12 +3422,17 @@
 | smart_pointer.cpp:133:23:133:24 | p1 | smart_pointer.cpp:133:25:133:25 | call to operator-> |  |
 | smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
 | smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
+| smart_pointer.cpp:133:25:133:25 | call to operator-> [post update] | smart_pointer.cpp:133:23:133:24 | ref arg p1 |  |
 | smart_pointer.cpp:134:8:134:9 | p1 | smart_pointer.cpp:134:10:134:10 | call to operator-> |  |
 | smart_pointer.cpp:134:8:134:9 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
 | smart_pointer.cpp:134:10:134:10 | call to operator-> [post update] | smart_pointer.cpp:134:8:134:9 | ref arg p1 |  |
 | smart_pointer.cpp:134:12:134:12 | q | smart_pointer.cpp:134:13:134:13 | call to operator-> |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 |  |
 | smart_pointer.cpp:136:18:136:19 | p2 | smart_pointer.cpp:136:17:136:17 | call to operator* | TAINT |
 | smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |
 | smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 |  |
 | smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index 6ab09046c4e5..39cff39e3edc 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -131,8 +131,8 @@ int nested_shared_ptr_taint(std::shared_ptr<C> p1, std::unique_ptr<std::shared_p
 
 int nested_shared_ptr_taint_cref(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
   taint_x_shared_cref(p1->q);
-  sink(p1->q->x); // $ MISSING: ast,ir
+  sink(p1->q->x); // $ ast MISSING: ir
 
   getNumberCRef(*p2);
-  sink(**p2); // $ MISSING: ast,ir
+  sink(**p2); // $ ast MISSING: ir
 }
\ No newline at end of file

From 720fbaf301445e2f05138292cc0ed5e902ff6da4 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Fri, 9 Apr 2021 19:04:49 +0000
Subject: [PATCH 158/433] Python: Fix test error.

Somehow, having to type "Node" all day long made me turn "json" into
"node"...

Also removes some bits that weren't needed after all.
---
 python/ql/src/semmle/python/frameworks/Stdlib.qll | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 3441c670fde8..1941f0c4d5bf 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -341,10 +341,8 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // pickle
   // ---------------------------------------------------------------------------
-  private string pickleModuleName() { result in ["pickle", "cPickle", "_pickle"] }
-
   /** Gets a reference to the `pickle` module. */
-  deprecated DataFlow::Node pickle() {
+  DataFlow::Node pickle() {
     result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse()
   }
 
@@ -578,7 +576,7 @@ private module Stdlib {
   // json
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `json` module. */
-  API::Node json() { result = API::moduleImport("node") }
+  API::Node json() { result = API::moduleImport("json") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `json` module.

From 4e3791dc0d05702cda6d86bc1a61562d80e2b0ed Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Fri, 9 Apr 2021 19:36:35 +0000
Subject: [PATCH 159/433] Remove LoadCredentialsConfiguration and update qldoc

---
 .../CredentialsInPropertiesFile.qll           | 50 ++-----------------
 .../CredentialsInPropertiesFile.expected      | 10 ++--
 2 files changed, 8 insertions(+), 52 deletions(-)

diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
index 9577789ce0c0..1190e13a9a1a 100644
--- a/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
+++ b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
@@ -40,7 +40,7 @@ predicate isNotCleartextCredentials(string value) {
   value.toLowerCase().matches(possibleSecretName())
 }
 
-/** The credentials configuration property. */
+/** A configuration property that appears to contain a cleartext secret. */
 class CredentialsConfig extends ConfigPair {
   CredentialsConfig() {
     this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
@@ -48,60 +48,16 @@ class CredentialsConfig extends ConfigPair {
     not isNotCleartextCredentials(this.getValueElement().getValue().trim())
   }
 
+  /** Gets the whitespace-trimmed name of this property. */
   string getName() { result = this.getNameElement().getName().trim() }
 
+  /** Gets the whitespace-trimmed value of this property. */
   string getValue() { result = this.getValueElement().getValue().trim() }
 
   /** Returns a description of this vulnerability. */
   string getConfigDesc() {
-    exists(
-      // getProperty(...)
-      LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
-    |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink) and
-      ma.getArgument(0) = sink.asExpr() and
-      result = "Plaintext credentials " + this.getName() + " are loaded in Java Properties " + ma
-    )
-    or
-    exists(
-      // @Value("${mail.password}")
-      Annotation a
-    |
-      a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
-      a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}" and
-      result = "Plaintext credentials " + this.getName() + " are loaded in Spring annotation " + a
-    )
-    or
-    not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
-      this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
-      cc.hasFlow(source, sink)
-    ) and
-    not exists(Annotation a |
-      a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
-      a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}"
-    ) and
     result =
       "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
         " in properties file"
   }
 }
-
-/**
- * A dataflow configuration tracking flow of cleartext credentials stored in a properties file
- *  to a `Properties.getProperty(...)` method call.
- */
-class LoadCredentialsConfiguration extends DataFlow::Configuration {
-  LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) {
-    exists(CredentialsConfig cc |
-      source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() =
-      any(MethodAccess ma | ma.getMethod() instanceof PropertiesGetPropertyMethod).getArgument(0)
-  }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
index 371a4765c53b..b857d58634b0 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
@@ -1,5 +1,5 @@
-| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password are loaded in Java Properties getProperty(...) |
-| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password are loaded in Java Properties getProperty(...) |
-| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password are loaded in Spring annotation Value |
-| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key are loaded in Java Properties getProperty(...) |
-| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key are loaded in Java Properties getProperty(...) |
+| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password have cleartext value mysecpass in properties file |
+| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password have cleartext value Passw0rd@123 in properties file |
+| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password have cleartext value MysecPWxWa@1993 in properties file |
+| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key have cleartext value AKMAMQPBYMCD6YSAYCBA in properties file |
+| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key have cleartext value 8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k in properties file |

From 0a866420563094129f0b63d7b0cddad227b520f6 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Fri, 9 Apr 2021 16:14:03 -0400
Subject: [PATCH 160/433] C++: Refactor some side effect generation code

This change was necessary for my upcoming changes to introduce side effect instructions for indirections of smart pointers. The code to decide which parameters have which side effects appeared in both the IPA constructor for `TTranslatedSideEffect` and in `TranslatedCall`. These two versions didn't quite agree, especially once the `SideEffectFunction` model provides its own side effects instead of the defaults.
The relevant code has now been factored out into `SideEffects.qll`. This queries the model if one exists, and provides default side effects if no model exists. This fixes at least one existing issue, where we were emitting a buffer read side effect for `*this` instead of an indirect read side effect. This accounts for all of the IR diffs in the tests.
---
 .../raw/internal/SideEffects.qll              | 109 ++++++
 .../raw/internal/TranslatedCall.qll           | 114 ++----
 .../raw/internal/TranslatedElement.qll        |  44 +--
 .../test/library-tests/ir/ir/raw_ir.expected  | 337 +++++++++---------
 .../ir/ssa/aliased_ssa_ir.expected            |   6 +-
 .../ir/ssa/aliased_ssa_ir_unsound.expected    |   6 +-
 .../ir/ssa/unaliased_ssa_ir.expected          |   6 +-
 .../ir/ssa/unaliased_ssa_ir_unsound.expected  |   6 +-
 8 files changed, 332 insertions(+), 296 deletions(-)
 create mode 100644 cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
new file mode 100644
index 000000000000..350127a58d17
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
@@ -0,0 +1,109 @@
+/**
+ * Predicates to compute the modeled side effects of calls during IR construction.
+ *
+ * These are used in `TranslatedElement.qll` to generate the `TTranslatedSideEffect` instances, and
+ * also in `TranslatedCall.qll` to inject the actual side effect instructions.
+ */
+
+private import cpp
+private import semmle.code.cpp.ir.implementation.Opcode
+private import semmle.code.cpp.models.interfaces.SideEffect
+
+/**
+ * Holds if the specified call has a side effect that does not come from a `SideEffectFunction`
+ * model.
+ */
+private predicate hasDefaultSideEffect(Call call, ParameterIndex i, boolean buffer, boolean isWrite) {
+  not call.getTarget() instanceof SideEffectFunction and
+  (
+    exists(MemberFunction mfunc |
+      // A non-static member function, including a constructor or destructor, may write to `*this`,
+      // and may also read from `*this` if it is not a constructor.
+      i = -1 and
+      mfunc = call.getTarget() and
+      not mfunc.isStatic() and
+      buffer = false and
+      (
+        isWrite = false and not mfunc instanceof Constructor
+        or
+        isWrite = true and not mfunc instanceof ConstMemberFunction
+      )
+    )
+    or
+    exists(Expr expr |
+      // A pointer-like argument is assumed to read from the pointed-to buffer, and may write to the
+      // buffer as well unless the pointer points to a `const` value.
+      i >= 0 and
+      buffer = true and
+      expr = call.getArgument(i).getFullyConverted() and
+      exists(Type t | t = expr.getUnspecifiedType() |
+        t instanceof ArrayType or
+        t instanceof PointerType or
+        t instanceof ReferenceType
+      ) and
+      (
+        isWrite = true and
+        not call.getTarget().getParameter(i).getType().isDeeplyConstBelow()
+        or
+        isWrite = false
+      )
+    )
+  )
+}
+
+/**
+ * Returns a side effect opcode for parameter index `i` of the specified call.
+ *
+ * This predicate will return at most two results: one read side effect, and one write side effect.
+ */
+Opcode getASideEffectOpcode(Call call, ParameterIndex i) {
+  exists(boolean buffer |
+    (
+      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(i, buffer)
+      or
+      not call.getTarget() instanceof SideEffectFunction and
+      hasDefaultSideEffect(call, i, buffer, false)
+    ) and
+    if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(i))
+    then (
+      buffer = true and
+      result instanceof Opcode::SizedBufferReadSideEffect
+    ) else (
+      buffer = false and result instanceof Opcode::IndirectReadSideEffect
+      or
+      buffer = true and result instanceof Opcode::BufferReadSideEffect
+    )
+  )
+  or
+  exists(boolean buffer, boolean mustWrite |
+    (
+      call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(i, buffer, mustWrite)
+      or
+      not call.getTarget() instanceof SideEffectFunction and
+      hasDefaultSideEffect(call, i, buffer, true) and
+      mustWrite = false
+    ) and
+    if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(i))
+    then (
+      buffer = true and
+      mustWrite = false and
+      result instanceof Opcode::SizedBufferMayWriteSideEffect
+      or
+      buffer = true and
+      mustWrite = true and
+      result instanceof Opcode::SizedBufferMustWriteSideEffect
+    ) else (
+      buffer = false and
+      mustWrite = false and
+      result instanceof Opcode::IndirectMayWriteSideEffect
+      or
+      buffer = false and
+      mustWrite = true and
+      result instanceof Opcode::IndirectMustWriteSideEffect
+      or
+      buffer = true and mustWrite = false and result instanceof Opcode::BufferMayWriteSideEffect
+      or
+      buffer = true and mustWrite = true and result instanceof Opcode::BufferMustWriteSideEffect
+    )
+  )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
index 7ad1dd2c01e5..0b52937f1cb7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
@@ -4,6 +4,7 @@ private import semmle.code.cpp.ir.implementation.internal.OperandTag
 private import semmle.code.cpp.ir.internal.CppType
 private import semmle.code.cpp.models.interfaces.SideEffect
 private import InstructionTag
+private import SideEffects
 private import TranslatedElement
 private import TranslatedExpr
 private import TranslatedFunction
@@ -424,12 +425,15 @@ class TranslatedCallSideEffects extends TranslatedSideEffects, TTranslatedCallSi
 }
 
 class TranslatedStructorCallSideEffects extends TranslatedCallSideEffects {
-  TranslatedStructorCallSideEffects() { getParent().(TranslatedStructorCall).hasQualifier() }
+  TranslatedStructorCallSideEffects() {
+    getParent().(TranslatedStructorCall).hasQualifier() and
+    getASideEffectOpcode(expr, -1) instanceof WriteSideEffectOpcode
+  }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType t) {
-    opcode instanceof Opcode::IndirectMayWriteSideEffect and
     tag instanceof OnlyInstructionTag and
-    t = getTypeForPRValue(expr.getTarget().getDeclaringType())
+    t = getTypeForPRValue(expr.getTarget().getDeclaringType()) and
+    opcode = getASideEffectOpcode(expr, -1).(WriteSideEffectOpcode)
   }
 
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
@@ -460,9 +464,11 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
   Call call;
   Expr arg;
   int index;
-  boolean write;
+  SideEffectOpcode sideEffectOpcode;
 
-  TranslatedSideEffect() { this = TTranslatedArgumentSideEffect(call, arg, index, write) }
+  TranslatedSideEffect() {
+    this = TTranslatedArgumentSideEffect(call, arg, index, sideEffectOpcode)
+  }
 
   override Locatable getAST() { result = arg }
 
@@ -472,13 +478,13 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
 
   int getArgumentIndex() { result = index }
 
-  predicate isWrite() { write = true }
+  predicate isWrite() { sideEffectOpcode instanceof WriteSideEffectOpcode }
 
   override string toString() {
-    write = true and
+    isWrite() and
     result = "(write side effect for " + arg.toString() + ")"
     or
-    write = false and
+    not isWrite() and
     result = "(read side effect for " + arg.toString() + ")"
   }
 
@@ -489,29 +495,31 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
   override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType type) {
-    isWrite() and
-    hasSpecificWriteSideEffect(opcode) and
-    tag = OnlyInstructionTag() and
     (
-      opcode instanceof BufferAccessOpcode and
-      type = getUnknownType()
-      or
-      not opcode instanceof BufferAccessOpcode and
-      exists(Type baseType | baseType = arg.getUnspecifiedType().(DerivedType).getBaseType() |
-        if baseType instanceof VoidType
-        then type = getUnknownType()
-        else type = getTypeForPRValueOrUnknown(baseType)
+      tag = OnlyInstructionTag() and
+      opcode = sideEffectOpcode
+    ) and
+    (
+      isWrite() and
+      (
+        opcode instanceof BufferAccessOpcode and
+        type = getUnknownType()
+        or
+        not opcode instanceof BufferAccessOpcode and
+        exists(Type baseType | baseType = arg.getUnspecifiedType().(DerivedType).getBaseType() |
+          if baseType instanceof VoidType
+          then type = getUnknownType()
+          else type = getTypeForPRValueOrUnknown(baseType)
+        )
+        or
+        index = -1 and
+        not arg.getUnspecifiedType() instanceof DerivedType and
+        type = getTypeForPRValueOrUnknown(arg.getUnspecifiedType())
       )
       or
-      index = -1 and
-      not arg.getUnspecifiedType() instanceof DerivedType and
-      type = getTypeForPRValueOrUnknown(arg.getUnspecifiedType())
+      not isWrite() and
+      type = getVoidType()
     )
-    or
-    not isWrite() and
-    hasSpecificReadSideEffect(opcode) and
-    tag = OnlyInstructionTag() and
-    type = getVoidType()
   }
 
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
@@ -535,7 +543,7 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
 
   override CppType getInstructionMemoryOperandType(InstructionTag tag, TypedOperandTag operandTag) {
     not isWrite() and
-    if hasSpecificReadSideEffect(any(BufferAccessOpcode op))
+    if sideEffectOpcode instanceof BufferAccessOpcode
     then
       result = getUnknownType() and
       tag instanceof OnlyInstructionTag and
@@ -557,56 +565,6 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
       )
   }
 
-  predicate hasSpecificWriteSideEffect(Opcode op) {
-    exists(boolean buffer, boolean mustWrite |
-      if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(index))
-      then
-        call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(index, true, mustWrite) and
-        buffer = true and
-        (
-          mustWrite = false and op instanceof Opcode::SizedBufferMayWriteSideEffect
-          or
-          mustWrite = true and op instanceof Opcode::SizedBufferMustWriteSideEffect
-        )
-      else (
-        call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(index, buffer, mustWrite) and
-        (
-          buffer = true and mustWrite = false and op instanceof Opcode::BufferMayWriteSideEffect
-          or
-          buffer = false and mustWrite = false and op instanceof Opcode::IndirectMayWriteSideEffect
-          or
-          buffer = true and mustWrite = true and op instanceof Opcode::BufferMustWriteSideEffect
-          or
-          buffer = false and mustWrite = true and op instanceof Opcode::IndirectMustWriteSideEffect
-        )
-      )
-    )
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    getArgumentIndex() != -1 and
-    op instanceof Opcode::BufferMayWriteSideEffect
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    getArgumentIndex() = -1 and
-    op instanceof Opcode::IndirectMayWriteSideEffect
-  }
-
-  predicate hasSpecificReadSideEffect(Opcode op) {
-    exists(boolean buffer |
-      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(index, buffer) and
-      if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(index))
-      then buffer = true and op instanceof Opcode::SizedBufferReadSideEffect
-      else (
-        buffer = true and op instanceof Opcode::BufferReadSideEffect
-        or
-        buffer = false and op instanceof Opcode::IndirectReadSideEffect
-      )
-    )
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    op instanceof Opcode::BufferReadSideEffect
-  }
-
   override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
     tag = OnlyInstructionTag() and
     result = getTranslatedCallInstruction(call)
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
index 1de9936ae1fb..eca659914b02 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -12,6 +12,7 @@ private import TranslatedStmt
 private import TranslatedExpr
 private import IRConstruction
 private import semmle.code.cpp.models.interfaces.SideEffect
+private import SideEffects
 
 /**
  * Gets the "real" parent of `expr`. This predicate treats conversions as if
@@ -635,46 +636,15 @@ newtype TTranslatedElement =
   // The side effects of an allocation, i.e. `new`, `new[]` or `malloc`
   TTranslatedAllocationSideEffects(AllocationExpr expr) { not ignoreExpr(expr) } or
   // A precise side effect of an argument to a `Call`
-  TTranslatedArgumentSideEffect(Call call, Expr expr, int n, boolean isWrite) {
-    (
-      expr = call.getArgument(n).getFullyConverted()
-      or
-      expr = call.getQualifier().getFullyConverted() and
-      n = -1 and
-      // Exclude calls to static member functions. They don't modify the qualifier
-      not exists(MemberFunction func | func = call.getTarget() and func.isStatic())
-    ) and
+  TTranslatedArgumentSideEffect(Call call, Expr expr, int n, SideEffectOpcode opcode) {
+    not ignoreExpr(expr) and
+    not ignoreExpr(call) and
     (
-      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(n, _) and
-      isWrite = false
-      or
-      call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(n, _, _) and
-      isWrite = true
-      or
-      not call.getTarget() instanceof SideEffectFunction and
-      exists(Type t | t = expr.getUnspecifiedType() |
-        t instanceof ArrayType or
-        t instanceof PointerType or
-        t instanceof ReferenceType
-      ) and
-      (
-        isWrite = true and
-        not call.getTarget().getParameter(n).getType().isDeeplyConstBelow()
-        or
-        isWrite = false
-      )
+      n >= 0 and expr = call.getArgument(n).getFullyConverted()
       or
-      not call.getTarget() instanceof SideEffectFunction and
-      n = -1 and
-      (
-        isWrite = true and
-        not call.getTarget() instanceof ConstMemberFunction
-        or
-        isWrite = false
-      )
+      n = -1 and expr = call.getQualifier().getFullyConverted()
     ) and
-    not ignoreExpr(expr) and
-    not ignoreExpr(call)
+    opcode = getASideEffectOpcode(call, n)
   }
 
 /**
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index a7dac56cc96a..e008e2de6596 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -42,7 +42,7 @@ bad_asts.cpp:
 #   16|     r16_3(int)            = Constant[1]                     : 
 #   16|     r16_4(int)            = Call[MemberFunction]            : func:r16_2, this:r16_1, 0:r16_3
 #   16|     mu16_5(unknown)       = ^CallSideEffect                 : ~m?
-#   16|     v16_6(void)           = ^BufferReadSideEffect[-1]       : &:r16_1, ~m?
+#   16|     v16_6(void)           = ^IndirectReadSideEffect[-1]     : &:r16_1, ~m?
 #   16|     mu16_7(S)             = ^IndirectMayWriteSideEffect[-1] : &:r16_1
 #   17|     v17_1(void)           = NoOp                            : 
 #   14|     v14_4(void)           = ReturnVoid                      : 
@@ -3385,47 +3385,46 @@ ir.cpp:
 
 #  622| void CallMethods(String&, String*, String)
 #  622|   Block 0
-#  622|     v622_1(void)            = EnterFunction                   : 
-#  622|     mu622_2(unknown)        = AliasedDefinition               : 
-#  622|     mu622_3(unknown)        = InitializeNonLocal              : 
-#  622|     r622_4(glval<String &>) = VariableAddress[r]              : 
-#  622|     mu622_5(String &)       = InitializeParameter[r]          : &:r622_4
-#  622|     r622_6(String &)        = Load[r]                         : &:r622_4, ~m?
-#  622|     mu622_7(unknown)        = InitializeIndirection[r]        : &:r622_6
-#  622|     r622_8(glval<String *>) = VariableAddress[p]              : 
-#  622|     mu622_9(String *)       = InitializeParameter[p]          : &:r622_8
-#  622|     r622_10(String *)       = Load[p]                         : &:r622_8, ~m?
-#  622|     mu622_11(unknown)       = InitializeIndirection[p]        : &:r622_10
-#  622|     r622_12(glval<String>)  = VariableAddress[s]              : 
-#  622|     mu622_13(String)        = InitializeParameter[s]          : &:r622_12
-#  623|     r623_1(glval<String &>) = VariableAddress[r]              : 
-#  623|     r623_2(String &)        = Load[r]                         : &:r623_1, ~m?
-#  623|     r623_3(glval<String>)   = CopyValue                       : r623_2
-#  623|     r623_4(glval<String>)   = Convert                         : r623_3
-#  623|     r623_5(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  623|     r623_6(char *)          = Call[c_str]                     : func:r623_5, this:r623_4
-#  623|     mu623_7(unknown)        = ^CallSideEffect                 : ~m?
-#  623|     v623_8(void)            = ^BufferReadSideEffect[-1]       : &:r623_4, ~m?
-#  624|     r624_1(glval<String *>) = VariableAddress[p]              : 
-#  624|     r624_2(String *)        = Load[p]                         : &:r624_1, ~m?
-#  624|     r624_3(String *)        = Convert                         : r624_2
-#  624|     r624_4(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  624|     r624_5(char *)          = Call[c_str]                     : func:r624_4, this:r624_3
-#  624|     mu624_6(unknown)        = ^CallSideEffect                 : ~m?
-#  624|     v624_7(void)            = ^BufferReadSideEffect[-1]       : &:r624_3, ~m?
-#  624|     mu624_8(String)         = ^IndirectMayWriteSideEffect[-1] : &:r624_3
-#  625|     r625_1(glval<String>)   = VariableAddress[s]              : 
-#  625|     r625_2(glval<String>)   = Convert                         : r625_1
-#  625|     r625_3(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  625|     r625_4(char *)          = Call[c_str]                     : func:r625_3, this:r625_2
-#  625|     mu625_5(unknown)        = ^CallSideEffect                 : ~m?
-#  625|     v625_6(void)            = ^BufferReadSideEffect[-1]       : &:r625_2, ~m?
-#  626|     v626_1(void)            = NoOp                            : 
-#  622|     v622_14(void)           = ReturnIndirection[r]            : &:r622_6, ~m?
-#  622|     v622_15(void)           = ReturnIndirection[p]            : &:r622_10, ~m?
-#  622|     v622_16(void)           = ReturnVoid                      : 
-#  622|     v622_17(void)           = AliasedUse                      : ~m?
-#  622|     v622_18(void)           = ExitFunction                    : 
+#  622|     v622_1(void)            = EnterFunction               : 
+#  622|     mu622_2(unknown)        = AliasedDefinition           : 
+#  622|     mu622_3(unknown)        = InitializeNonLocal          : 
+#  622|     r622_4(glval<String &>) = VariableAddress[r]          : 
+#  622|     mu622_5(String &)       = InitializeParameter[r]      : &:r622_4
+#  622|     r622_6(String &)        = Load[r]                     : &:r622_4, ~m?
+#  622|     mu622_7(unknown)        = InitializeIndirection[r]    : &:r622_6
+#  622|     r622_8(glval<String *>) = VariableAddress[p]          : 
+#  622|     mu622_9(String *)       = InitializeParameter[p]      : &:r622_8
+#  622|     r622_10(String *)       = Load[p]                     : &:r622_8, ~m?
+#  622|     mu622_11(unknown)       = InitializeIndirection[p]    : &:r622_10
+#  622|     r622_12(glval<String>)  = VariableAddress[s]          : 
+#  622|     mu622_13(String)        = InitializeParameter[s]      : &:r622_12
+#  623|     r623_1(glval<String &>) = VariableAddress[r]          : 
+#  623|     r623_2(String &)        = Load[r]                     : &:r623_1, ~m?
+#  623|     r623_3(glval<String>)   = CopyValue                   : r623_2
+#  623|     r623_4(glval<String>)   = Convert                     : r623_3
+#  623|     r623_5(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  623|     r623_6(char *)          = Call[c_str]                 : func:r623_5, this:r623_4
+#  623|     mu623_7(unknown)        = ^CallSideEffect             : ~m?
+#  623|     v623_8(void)            = ^IndirectReadSideEffect[-1] : &:r623_4, ~m?
+#  624|     r624_1(glval<String *>) = VariableAddress[p]          : 
+#  624|     r624_2(String *)        = Load[p]                     : &:r624_1, ~m?
+#  624|     r624_3(String *)        = Convert                     : r624_2
+#  624|     r624_4(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  624|     r624_5(char *)          = Call[c_str]                 : func:r624_4, this:r624_3
+#  624|     mu624_6(unknown)        = ^CallSideEffect             : ~m?
+#  624|     v624_7(void)            = ^IndirectReadSideEffect[-1] : &:r624_3, ~m?
+#  625|     r625_1(glval<String>)   = VariableAddress[s]          : 
+#  625|     r625_2(glval<String>)   = Convert                     : r625_1
+#  625|     r625_3(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  625|     r625_4(char *)          = Call[c_str]                 : func:r625_3, this:r625_2
+#  625|     mu625_5(unknown)        = ^CallSideEffect             : ~m?
+#  625|     v625_6(void)            = ^IndirectReadSideEffect[-1] : &:r625_2, ~m?
+#  626|     v626_1(void)            = NoOp                        : 
+#  622|     v622_14(void)           = ReturnIndirection[r]        : &:r622_6, ~m?
+#  622|     v622_15(void)           = ReturnIndirection[p]        : &:r622_10, ~m?
+#  622|     v622_16(void)           = ReturnVoid                  : 
+#  622|     v622_17(void)           = AliasedUse                  : ~m?
+#  622|     v622_18(void)           = ExitFunction                : 
 
 #  628| void C::~C()
 #  628|   Block 0
@@ -3575,7 +3574,7 @@ ir.cpp:
 #  653|     r653_4(int)            = Constant[0]                             : 
 #  653|     r653_5(int)            = Call[InstanceMemberFunction]            : func:r653_3, this:r653_2, 0:r653_4
 #  653|     mu653_6(unknown)       = ^CallSideEffect                         : ~m?
-#  653|     v653_7(void)           = ^BufferReadSideEffect[-1]               : &:r653_2, ~m?
+#  653|     v653_7(void)           = ^IndirectReadSideEffect[-1]             : &:r653_2, ~m?
 #  653|     mu653_8(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r653_2
 #  654|     r654_1(glval<unknown>) = VariableAddress[#this]                  : 
 #  654|     r654_2(C *)            = Load[#this]                             : &:r654_1, ~m?
@@ -3584,7 +3583,7 @@ ir.cpp:
 #  654|     r654_5(int)            = Constant[1]                             : 
 #  654|     r654_6(int)            = Call[InstanceMemberFunction]            : func:r654_4, this:r654_3, 0:r654_5
 #  654|     mu654_7(unknown)       = ^CallSideEffect                         : ~m?
-#  654|     v654_8(void)           = ^BufferReadSideEffect[-1]               : &:r654_3, ~m?
+#  654|     v654_8(void)           = ^IndirectReadSideEffect[-1]             : &:r654_3, ~m?
 #  654|     mu654_9(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r654_3
 #  655|     r655_1(glval<unknown>) = VariableAddress[#this]                  : 
 #  655|     r655_2(C *)            = Load[#this]                             : &:r655_1, ~m?
@@ -3592,7 +3591,7 @@ ir.cpp:
 #  655|     r655_4(int)            = Constant[2]                             : 
 #  655|     r655_5(int)            = Call[InstanceMemberFunction]            : func:r655_3, this:r655_2, 0:r655_4
 #  655|     mu655_6(unknown)       = ^CallSideEffect                         : ~m?
-#  655|     v655_7(void)           = ^BufferReadSideEffect[-1]               : &:r655_2, ~m?
+#  655|     v655_7(void)           = ^IndirectReadSideEffect[-1]             : &:r655_2, ~m?
 #  655|     mu655_8(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r655_2
 #  656|     v656_1(void)           = NoOp                                    : 
 #  652|     v652_8(void)           = ReturnIndirection[#this]                : &:r652_6, ~m?
@@ -4006,7 +4005,7 @@ ir.cpp:
 #-----|     r0_6(String &)          = CopyValue                                    : r745_15
 #  745|     r745_16(String &)       = Call[operator=]                              : func:r745_12, this:r745_11, 0:r0_6
 #  745|     mu745_17(unknown)       = ^CallSideEffect                              : ~m?
-#  745|     v745_18(void)           = ^BufferReadSideEffect[-1]                    : &:r745_11, ~m?
+#  745|     v745_18(void)           = ^IndirectReadSideEffect[-1]                  : &:r745_11, ~m?
 #-----|     v0_7(void)              = ^BufferReadSideEffect[0]                     : &:r0_6, ~m?
 #  745|     mu745_19(String)        = ^IndirectMayWriteSideEffect[-1]              : &:r745_11
 #-----|     r0_8(glval<String>)     = CopyValue                                    : r745_16
@@ -4113,7 +4112,7 @@ ir.cpp:
 #-----|     r0_8(Base &)             = CopyValue                                    : r754_14
 #  754|     r754_15(Base &)          = Call[operator=]                              : func:r754_10, this:r0_5, 0:r0_8
 #  754|     mu754_16(unknown)        = ^CallSideEffect                              : ~m?
-#-----|     v0_9(void)               = ^BufferReadSideEffect[-1]                    : &:r0_5, ~m?
+#-----|     v0_9(void)               = ^IndirectReadSideEffect[-1]                  : &:r0_5, ~m?
 #-----|     v0_10(void)              = ^BufferReadSideEffect[0]                     : &:r0_8, ~m?
 #-----|     mu0_11(Base)             = ^IndirectMayWriteSideEffect[-1]              : &:r0_5
 #-----|     r0_12(glval<Base>)       = CopyValue                                    : r754_15
@@ -4129,7 +4128,7 @@ ir.cpp:
 #-----|     r0_14(String &)          = CopyValue                                    : r754_24
 #  754|     r754_25(String &)        = Call[operator=]                              : func:r754_21, this:r754_20, 0:r0_14
 #  754|     mu754_26(unknown)        = ^CallSideEffect                              : ~m?
-#  754|     v754_27(void)            = ^BufferReadSideEffect[-1]                    : &:r754_20, ~m?
+#  754|     v754_27(void)            = ^IndirectReadSideEffect[-1]                  : &:r754_20, ~m?
 #-----|     v0_15(void)              = ^BufferReadSideEffect[0]                     : &:r0_14, ~m?
 #  754|     mu754_28(String)         = ^IndirectMayWriteSideEffect[-1]              : &:r754_20
 #-----|     r0_16(glval<String>)     = CopyValue                                    : r754_25
@@ -4220,7 +4219,7 @@ ir.cpp:
 #-----|     r0_8(Middle &)            = CopyValue                                    : r763_14
 #  763|     r763_15(Middle &)         = Call[operator=]                              : func:r763_10, this:r0_5, 0:r0_8
 #  763|     mu763_16(unknown)         = ^CallSideEffect                              : ~m?
-#-----|     v0_9(void)                = ^BufferReadSideEffect[-1]                    : &:r0_5, ~m?
+#-----|     v0_9(void)                = ^IndirectReadSideEffect[-1]                  : &:r0_5, ~m?
 #-----|     v0_10(void)               = ^BufferReadSideEffect[0]                     : &:r0_8, ~m?
 #-----|     mu0_11(Middle)            = ^IndirectMayWriteSideEffect[-1]              : &:r0_5
 #-----|     r0_12(glval<Middle>)      = CopyValue                                    : r763_15
@@ -4236,7 +4235,7 @@ ir.cpp:
 #-----|     r0_14(String &)           = CopyValue                                    : r763_24
 #  763|     r763_25(String &)         = Call[operator=]                              : func:r763_21, this:r763_20, 0:r0_14
 #  763|     mu763_26(unknown)         = ^CallSideEffect                              : ~m?
-#  763|     v763_27(void)             = ^BufferReadSideEffect[-1]                    : &:r763_20, ~m?
+#  763|     v763_27(void)             = ^IndirectReadSideEffect[-1]                  : &:r763_20, ~m?
 #-----|     v0_15(void)               = ^BufferReadSideEffect[0]                     : &:r0_14, ~m?
 #  763|     mu763_28(String)          = ^IndirectMayWriteSideEffect[-1]              : &:r763_20
 #-----|     r0_16(glval<String>)      = CopyValue                                    : r763_25
@@ -4505,7 +4504,7 @@ ir.cpp:
 #  808|     r808_5(Base &)             = CopyValue                                 : r808_4
 #  808|     r808_6(Base &)             = Call[operator=]                           : func:r808_2, this:r808_1, 0:r808_5
 #  808|     mu808_7(unknown)           = ^CallSideEffect                           : ~m?
-#  808|     v808_8(void)               = ^BufferReadSideEffect[-1]                 : &:r808_1, ~m?
+#  808|     v808_8(void)               = ^IndirectReadSideEffect[-1]               : &:r808_1, ~m?
 #  808|     v808_9(void)               = ^BufferReadSideEffect[0]                  : &:r808_5, ~m?
 #  808|     mu808_10(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r808_1
 #  808|     r808_11(glval<Base>)       = CopyValue                                 : r808_6
@@ -4525,7 +4524,7 @@ ir.cpp:
 #  809|     r809_14(Base &)            = CopyValue                                 : r809_13
 #  809|     r809_15(Base &)            = Call[operator=]                           : func:r809_2, this:r809_1, 0:r809_14
 #  809|     mu809_16(unknown)          = ^CallSideEffect                           : ~m?
-#  809|     v809_17(void)              = ^BufferReadSideEffect[-1]                 : &:r809_1, ~m?
+#  809|     v809_17(void)              = ^IndirectReadSideEffect[-1]               : &:r809_1, ~m?
 #  809|     v809_18(void)              = ^BufferReadSideEffect[0]                  : &:r809_14, ~m?
 #  809|     mu809_19(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r809_1
 #  809|     r809_20(glval<Base>)       = CopyValue                                 : r809_15
@@ -4545,7 +4544,7 @@ ir.cpp:
 #  810|     r810_14(Base &)            = CopyValue                                 : r810_13
 #  810|     r810_15(Base &)            = Call[operator=]                           : func:r810_2, this:r810_1, 0:r810_14
 #  810|     mu810_16(unknown)          = ^CallSideEffect                           : ~m?
-#  810|     v810_17(void)              = ^BufferReadSideEffect[-1]                 : &:r810_1, ~m?
+#  810|     v810_17(void)              = ^IndirectReadSideEffect[-1]               : &:r810_1, ~m?
 #  810|     v810_18(void)              = ^BufferReadSideEffect[0]                  : &:r810_14, ~m?
 #  810|     mu810_19(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r810_1
 #  810|     r810_20(glval<Base>)       = CopyValue                                 : r810_15
@@ -4577,7 +4576,7 @@ ir.cpp:
 #  816|     r816_6(Middle &)           = CopyValue                                 : r816_5
 #  816|     r816_7(Middle &)           = Call[operator=]                           : func:r816_2, this:r816_1, 0:r816_6
 #  816|     mu816_8(unknown)           = ^CallSideEffect                           : ~m?
-#  816|     v816_9(void)               = ^BufferReadSideEffect[-1]                 : &:r816_1, ~m?
+#  816|     v816_9(void)               = ^IndirectReadSideEffect[-1]               : &:r816_1, ~m?
 #  816|     v816_10(void)              = ^BufferReadSideEffect[0]                  : &:r816_6, ~m?
 #  816|     mu816_11(Middle)           = ^IndirectMayWriteSideEffect[-1]           : &:r816_1
 #  816|     r816_12(glval<Middle>)     = CopyValue                                 : r816_7
@@ -4589,7 +4588,7 @@ ir.cpp:
 #  817|     r817_6(Middle &)           = CopyValue                                 : r817_5
 #  817|     r817_7(Middle &)           = Call[operator=]                           : func:r817_2, this:r817_1, 0:r817_6
 #  817|     mu817_8(unknown)           = ^CallSideEffect                           : ~m?
-#  817|     v817_9(void)               = ^BufferReadSideEffect[-1]                 : &:r817_1, ~m?
+#  817|     v817_9(void)               = ^IndirectReadSideEffect[-1]               : &:r817_1, ~m?
 #  817|     v817_10(void)              = ^BufferReadSideEffect[0]                  : &:r817_6, ~m?
 #  817|     mu817_11(Middle)           = ^IndirectMayWriteSideEffect[-1]           : &:r817_1
 #  817|     r817_12(glval<Middle>)     = CopyValue                                 : r817_7
@@ -4616,7 +4615,7 @@ ir.cpp:
 #  822|     r822_6(Base &)             = CopyValue                                 : r822_5
 #  822|     r822_7(Base &)             = Call[operator=]                           : func:r822_2, this:r822_1, 0:r822_6
 #  822|     mu822_8(unknown)           = ^CallSideEffect                           : ~m?
-#  822|     v822_9(void)               = ^BufferReadSideEffect[-1]                 : &:r822_1, ~m?
+#  822|     v822_9(void)               = ^IndirectReadSideEffect[-1]               : &:r822_1, ~m?
 #  822|     v822_10(void)              = ^BufferReadSideEffect[0]                  : &:r822_6, ~m?
 #  822|     mu822_11(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r822_1
 #  822|     r822_12(glval<Base>)       = CopyValue                                 : r822_7
@@ -4637,7 +4636,7 @@ ir.cpp:
 #  823|     r823_15(Base &)            = CopyValue                                 : r823_14
 #  823|     r823_16(Base &)            = Call[operator=]                           : func:r823_2, this:r823_1, 0:r823_15
 #  823|     mu823_17(unknown)          = ^CallSideEffect                           : ~m?
-#  823|     v823_18(void)              = ^BufferReadSideEffect[-1]                 : &:r823_1, ~m?
+#  823|     v823_18(void)              = ^IndirectReadSideEffect[-1]               : &:r823_1, ~m?
 #  823|     v823_19(void)              = ^BufferReadSideEffect[0]                  : &:r823_15, ~m?
 #  823|     mu823_20(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r823_1
 #  823|     r823_21(glval<Base>)       = CopyValue                                 : r823_16
@@ -4658,7 +4657,7 @@ ir.cpp:
 #  824|     r824_15(Base &)            = CopyValue                                 : r824_14
 #  824|     r824_16(Base &)            = Call[operator=]                           : func:r824_2, this:r824_1, 0:r824_15
 #  824|     mu824_17(unknown)          = ^CallSideEffect                           : ~m?
-#  824|     v824_18(void)              = ^BufferReadSideEffect[-1]                 : &:r824_1, ~m?
+#  824|     v824_18(void)              = ^IndirectReadSideEffect[-1]               : &:r824_1, ~m?
 #  824|     v824_19(void)              = ^BufferReadSideEffect[0]                  : &:r824_15, ~m?
 #  824|     mu824_20(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r824_1
 #  824|     r824_21(glval<Base>)       = CopyValue                                 : r824_16
@@ -4694,7 +4693,7 @@ ir.cpp:
 #  830|     r830_7(Derived &)          = CopyValue                                 : r830_6
 #  830|     r830_8(Derived &)          = Call[operator=]                           : func:r830_2, this:r830_1, 0:r830_7
 #  830|     mu830_9(unknown)           = ^CallSideEffect                           : ~m?
-#  830|     v830_10(void)              = ^BufferReadSideEffect[-1]                 : &:r830_1, ~m?
+#  830|     v830_10(void)              = ^IndirectReadSideEffect[-1]               : &:r830_1, ~m?
 #  830|     v830_11(void)              = ^BufferReadSideEffect[0]                  : &:r830_7, ~m?
 #  830|     mu830_12(Derived)          = ^IndirectMayWriteSideEffect[-1]           : &:r830_1
 #  830|     r830_13(glval<Derived>)    = CopyValue                                 : r830_8
@@ -4707,7 +4706,7 @@ ir.cpp:
 #  831|     r831_7(Derived &)          = CopyValue                                 : r831_6
 #  831|     r831_8(Derived &)          = Call[operator=]                           : func:r831_2, this:r831_1, 0:r831_7
 #  831|     mu831_9(unknown)           = ^CallSideEffect                           : ~m?
-#  831|     v831_10(void)              = ^BufferReadSideEffect[-1]                 : &:r831_1, ~m?
+#  831|     v831_10(void)              = ^IndirectReadSideEffect[-1]               : &:r831_1, ~m?
 #  831|     v831_11(void)              = ^BufferReadSideEffect[0]                  : &:r831_7, ~m?
 #  831|     mu831_12(Derived)          = ^IndirectMayWriteSideEffect[-1]           : &:r831_1
 #  831|     r831_13(glval<Derived>)    = CopyValue                                 : r831_8
@@ -5688,7 +5687,7 @@ ir.cpp:
 # 1044|     r1044_4(float)                            = Constant[1.0]                          : 
 # 1044|     r1044_5(char)                             = Call[operator()]                       : func:r1044_3, this:r1044_2, 0:r1044_4
 # 1044|     mu1044_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1044|     v1044_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1044_2, ~m?
+# 1044|     v1044_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1044_2, ~m?
 # 1045|     r1045_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_val]            : 
 # 1045|     r1045_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1045:20]          : 
 # 1045|     mu1045_3(decltype([...](...){...}))       = Uninitialized[#temp1045:20]            : &:r1045_2
@@ -5709,7 +5708,7 @@ ir.cpp:
 # 1046|     r1046_4(float)                            = Constant[2.0]                          : 
 # 1046|     r1046_5(char)                             = Call[operator()]                       : func:r1046_3, this:r1046_2, 0:r1046_4
 # 1046|     mu1046_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1046|     v1046_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1046_2, ~m?
+# 1046|     v1046_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1046_2, ~m?
 # 1047|     r1047_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_ref_explicit]   : 
 # 1047|     r1047_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1047:29]          : 
 # 1047|     mu1047_3(decltype([...](...){...}))       = Uninitialized[#temp1047:29]            : &:r1047_2
@@ -5727,7 +5726,7 @@ ir.cpp:
 # 1048|     r1048_4(float)                            = Constant[3.0]                          : 
 # 1048|     r1048_5(char)                             = Call[operator()]                       : func:r1048_3, this:r1048_2, 0:r1048_4
 # 1048|     mu1048_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1048|     v1048_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1048_2, ~m?
+# 1048|     v1048_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1048_2, ~m?
 # 1049|     r1049_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_val_explicit]   : 
 # 1049|     r1049_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1049:29]          : 
 # 1049|     mu1049_3(decltype([...](...){...}))       = Uninitialized[#temp1049:29]            : &:r1049_2
@@ -5744,7 +5743,7 @@ ir.cpp:
 # 1050|     r1050_4(float)                            = Constant[4.0]                          : 
 # 1050|     r1050_5(char)                             = Call[operator()]                       : func:r1050_3, this:r1050_2, 0:r1050_4
 # 1050|     mu1050_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1050|     v1050_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1050_2, ~m?
+# 1050|     v1050_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1050_2, ~m?
 # 1051|     r1051_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_mixed_explicit] : 
 # 1051|     r1051_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1051:31]          : 
 # 1051|     mu1051_3(decltype([...](...){...}))       = Uninitialized[#temp1051:31]            : &:r1051_2
@@ -5766,7 +5765,7 @@ ir.cpp:
 # 1052|     r1052_4(float)                            = Constant[5.0]                          : 
 # 1052|     r1052_5(char)                             = Call[operator()]                       : func:r1052_3, this:r1052_2, 0:r1052_4
 # 1052|     mu1052_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1052|     v1052_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1052_2, ~m?
+# 1052|     v1052_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1052_2, ~m?
 # 1053|     r1053_1(glval<int>)                       = VariableAddress[r]                     : 
 # 1053|     r1053_2(glval<int>)                       = VariableAddress[x]                     : 
 # 1053|     r1053_3(int)                              = Load[x]                                : &:r1053_2, ~m?
@@ -5804,7 +5803,7 @@ ir.cpp:
 # 1055|     r1055_4(float)                            = Constant[6.0]                          : 
 # 1055|     r1055_5(char)                             = Call[operator()]                       : func:r1055_3, this:r1055_2, 0:r1055_4
 # 1055|     mu1055_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1055|     v1055_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1055_2, ~m?
+# 1055|     v1055_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1055_2, ~m?
 # 1056|     v1056_1(void)                             = NoOp                                   : 
 # 1040|     v1040_10(void)                            = ReturnIndirection[s]                   : &:r1040_8, ~m?
 # 1040|     v1040_11(void)                            = ReturnVoid                             : 
@@ -5869,7 +5868,7 @@ ir.cpp:
 # 1043|     r1043_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1043|     r1043_17(char *)                                 = Call[c_str]                  : func:r1043_16, this:r1043_15
 # 1043|     mu1043_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1043|     v1043_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1043_15, ~m?
+# 1043|     v1043_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1043_15, ~m?
 # 1043|     r1043_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1043|     r1043_21(lambda [] type at line 1043, col. 21 *) = Load[#this]                  : &:r1043_20, ~m?
 # 1043|     r1043_22(glval<int &>)                           = FieldAddress[x]              : r1043_21
@@ -5921,7 +5920,7 @@ ir.cpp:
 # 1045|     r1045_14(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1045|     r1045_15(char *)                                 = Call[c_str]                  : func:r1045_14, this:r1045_13
 # 1045|     mu1045_16(unknown)                               = ^CallSideEffect              : ~m?
-# 1045|     v1045_17(void)                                   = ^BufferReadSideEffect[-1]    : &:r1045_13, ~m?
+# 1045|     v1045_17(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1045_13, ~m?
 # 1045|     r1045_18(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1045|     r1045_19(lambda [] type at line 1045, col. 21 *) = Load[#this]                  : &:r1045_18, ~m?
 # 1045|     r1045_20(glval<int>)                             = FieldAddress[x]              : r1045_19
@@ -5955,7 +5954,7 @@ ir.cpp:
 # 1047|     r1047_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1047|     r1047_17(char *)                                 = Call[c_str]                  : func:r1047_16, this:r1047_15
 # 1047|     mu1047_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1047|     v1047_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1047_15, ~m?
+# 1047|     v1047_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1047_15, ~m?
 # 1047|     r1047_20(int)                                    = Constant[0]                  : 
 # 1047|     r1047_21(glval<char>)                            = PointerAdd[1]                : r1047_17, r1047_20
 # 1047|     r1047_22(char)                                   = Load[?]                      : &:r1047_21, ~m?
@@ -6003,7 +6002,7 @@ ir.cpp:
 # 1049|     r1049_14(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1049|     r1049_15(char *)                                 = Call[c_str]                  : func:r1049_14, this:r1049_13
 # 1049|     mu1049_16(unknown)                               = ^CallSideEffect              : ~m?
-# 1049|     v1049_17(void)                                   = ^BufferReadSideEffect[-1]    : &:r1049_13, ~m?
+# 1049|     v1049_17(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1049_13, ~m?
 # 1049|     r1049_18(int)                                    = Constant[0]                  : 
 # 1049|     r1049_19(glval<char>)                            = PointerAdd[1]                : r1049_15, r1049_18
 # 1049|     r1049_20(char)                                   = Load[?]                      : &:r1049_19, ~m?
@@ -6034,7 +6033,7 @@ ir.cpp:
 # 1051|     r1051_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1051|     r1051_17(char *)                                 = Call[c_str]                  : func:r1051_16, this:r1051_15
 # 1051|     mu1051_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1051|     v1051_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1051_15, ~m?
+# 1051|     v1051_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1051_15, ~m?
 # 1051|     r1051_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1051|     r1051_21(lambda [] type at line 1051, col. 32 *) = Load[#this]                  : &:r1051_20, ~m?
 # 1051|     r1051_22(glval<int>)                             = FieldAddress[x]              : r1051_21
@@ -6068,7 +6067,7 @@ ir.cpp:
 # 1054|     r1054_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1054|     r1054_17(char *)                                 = Call[c_str]                  : func:r1054_16, this:r1054_15
 # 1054|     mu1054_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1054|     v1054_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1054_15, ~m?
+# 1054|     v1054_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1054_15, ~m?
 # 1054|     r1054_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1054|     r1054_21(lambda [] type at line 1054, col. 23 *) = Load[#this]                  : &:r1054_20, ~m?
 # 1054|     r1054_22(glval<int>)                             = FieldAddress[x]              : r1054_21
@@ -6095,37 +6094,37 @@ ir.cpp:
 
 # 1077| void RangeBasedFor(vector<int> const&)
 # 1077|   Block 0
-# 1077|     v1077_1(void)                  = EnterFunction              : 
-# 1077|     mu1077_2(unknown)              = AliasedDefinition          : 
-# 1077|     mu1077_3(unknown)              = InitializeNonLocal         : 
-# 1077|     r1077_4(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1077|     mu1077_5(vector<int> &)        = InitializeParameter[v]     : &:r1077_4
-# 1077|     r1077_6(vector<int> &)         = Load[v]                    : &:r1077_4, ~m?
-# 1077|     mu1077_7(unknown)              = InitializeIndirection[v]   : &:r1077_6
-# 1078|     r1078_1(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1078|     r1078_2(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1078|     r1078_3(vector<int> &)         = Load[v]                    : &:r1078_2, ~m?
-# 1078|     r1078_4(glval<vector<int>>)    = CopyValue                  : r1078_3
-# 1078|     r1078_5(vector<int> &)         = CopyValue                  : r1078_4
-# 1078|     mu1078_6(vector<int> &)        = Store[(__range)]           : &:r1078_1, r1078_5
-# 1078|     r1078_7(glval<iterator>)       = VariableAddress[(__begin)] : 
-# 1078|     r1078_8(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1078|     r1078_9(vector<int> &)         = Load[(__range)]            : &:r1078_8, ~m?
-#-----|     r0_1(glval<vector<int>>)       = CopyValue                  : r1078_9
-# 1078|     r1078_10(glval<unknown>)       = FunctionAddress[begin]     : 
-# 1078|     r1078_11(iterator)             = Call[begin]                : func:r1078_10, this:r0_1
-# 1078|     mu1078_12(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_2(void)                     = ^BufferReadSideEffect[-1]  : &:r0_1, ~m?
-# 1078|     mu1078_13(iterator)            = Store[(__begin)]           : &:r1078_7, r1078_11
-# 1078|     r1078_14(glval<iterator>)      = VariableAddress[(__end)]   : 
-# 1078|     r1078_15(glval<vector<int> &>) = VariableAddress[(__range)] : 
-# 1078|     r1078_16(vector<int> &)        = Load[(__range)]            : &:r1078_15, ~m?
-#-----|     r0_3(glval<vector<int>>)       = CopyValue                  : r1078_16
-# 1078|     r1078_17(glval<unknown>)       = FunctionAddress[end]       : 
-# 1078|     r1078_18(iterator)             = Call[end]                  : func:r1078_17, this:r0_3
-# 1078|     mu1078_19(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_4(void)                     = ^BufferReadSideEffect[-1]  : &:r0_3, ~m?
-# 1078|     mu1078_20(iterator)            = Store[(__end)]             : &:r1078_14, r1078_18
+# 1077|     v1077_1(void)                  = EnterFunction               : 
+# 1077|     mu1077_2(unknown)              = AliasedDefinition           : 
+# 1077|     mu1077_3(unknown)              = InitializeNonLocal          : 
+# 1077|     r1077_4(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1077|     mu1077_5(vector<int> &)        = InitializeParameter[v]      : &:r1077_4
+# 1077|     r1077_6(vector<int> &)         = Load[v]                     : &:r1077_4, ~m?
+# 1077|     mu1077_7(unknown)              = InitializeIndirection[v]    : &:r1077_6
+# 1078|     r1078_1(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1078|     r1078_2(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1078|     r1078_3(vector<int> &)         = Load[v]                     : &:r1078_2, ~m?
+# 1078|     r1078_4(glval<vector<int>>)    = CopyValue                   : r1078_3
+# 1078|     r1078_5(vector<int> &)         = CopyValue                   : r1078_4
+# 1078|     mu1078_6(vector<int> &)        = Store[(__range)]            : &:r1078_1, r1078_5
+# 1078|     r1078_7(glval<iterator>)       = VariableAddress[(__begin)]  : 
+# 1078|     r1078_8(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1078|     r1078_9(vector<int> &)         = Load[(__range)]             : &:r1078_8, ~m?
+#-----|     r0_1(glval<vector<int>>)       = CopyValue                   : r1078_9
+# 1078|     r1078_10(glval<unknown>)       = FunctionAddress[begin]      : 
+# 1078|     r1078_11(iterator)             = Call[begin]                 : func:r1078_10, this:r0_1
+# 1078|     mu1078_12(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_2(void)                     = ^IndirectReadSideEffect[-1] : &:r0_1, ~m?
+# 1078|     mu1078_13(iterator)            = Store[(__begin)]            : &:r1078_7, r1078_11
+# 1078|     r1078_14(glval<iterator>)      = VariableAddress[(__end)]    : 
+# 1078|     r1078_15(glval<vector<int> &>) = VariableAddress[(__range)]  : 
+# 1078|     r1078_16(vector<int> &)        = Load[(__range)]             : &:r1078_15, ~m?
+#-----|     r0_3(glval<vector<int>>)       = CopyValue                   : r1078_16
+# 1078|     r1078_17(glval<unknown>)       = FunctionAddress[end]        : 
+# 1078|     r1078_18(iterator)             = Call[end]                   : func:r1078_17, this:r0_3
+# 1078|     mu1078_19(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_4(void)                     = ^IndirectReadSideEffect[-1] : &:r0_3, ~m?
+# 1078|     mu1078_20(iterator)            = Store[(__end)]              : &:r1078_14, r1078_18
 #-----|   Goto -> Block 1
 
 # 1078|   Block 1
@@ -6136,26 +6135,26 @@ ir.cpp:
 # 1078|     r1078_24(iterator)        = Load[(__end)]               : &:r1078_23, ~m?
 # 1078|     r1078_25(bool)            = Call[operator!=]            : func:r1078_22, this:r0_5, 0:r1078_24
 # 1078|     mu1078_26(unknown)        = ^CallSideEffect             : ~m?
-#-----|     v0_6(void)                = ^BufferReadSideEffect[-1]   : &:r0_5, ~m?
+#-----|     v0_6(void)                = ^IndirectReadSideEffect[-1] : &:r0_5, ~m?
 # 1078|     v1078_27(void)            = ConditionalBranch           : r1078_25
 #-----|   False -> Block 5
 #-----|   True -> Block 2
 
 # 1078|   Block 2
-# 1078|     r1078_28(glval<int>)      = VariableAddress[e]         : 
-# 1078|     r1078_29(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r0_7(glval<iterator>)     = Convert                    : r1078_29
-# 1078|     r1078_30(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1078|     r1078_31(int &)           = Call[operator*]            : func:r1078_30, this:r0_7
-# 1078|     mu1078_32(unknown)        = ^CallSideEffect            : ~m?
-#-----|     v0_8(void)                = ^BufferReadSideEffect[-1]  : &:r0_7, ~m?
-# 1078|     r1078_33(int)             = Load[?]                    : &:r1078_31, ~m?
-# 1078|     mu1078_34(int)            = Store[e]                   : &:r1078_28, r1078_33
-# 1079|     r1079_1(glval<int>)       = VariableAddress[e]         : 
-# 1079|     r1079_2(int)              = Load[e]                    : &:r1079_1, ~m?
-# 1079|     r1079_3(int)              = Constant[0]                : 
-# 1079|     r1079_4(bool)             = CompareGT                  : r1079_2, r1079_3
-# 1079|     v1079_5(void)             = ConditionalBranch          : r1079_4
+# 1078|     r1078_28(glval<int>)      = VariableAddress[e]          : 
+# 1078|     r1078_29(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_7(glval<iterator>)     = Convert                     : r1078_29
+# 1078|     r1078_30(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 1078|     r1078_31(int &)           = Call[operator*]             : func:r1078_30, this:r0_7
+# 1078|     mu1078_32(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_8(void)                = ^IndirectReadSideEffect[-1] : &:r0_7, ~m?
+# 1078|     r1078_33(int)             = Load[?]                     : &:r1078_31, ~m?
+# 1078|     mu1078_34(int)            = Store[e]                    : &:r1078_28, r1078_33
+# 1079|     r1079_1(glval<int>)       = VariableAddress[e]          : 
+# 1079|     r1079_2(int)              = Load[e]                     : &:r1079_1, ~m?
+# 1079|     r1079_3(int)              = Constant[0]                 : 
+# 1079|     r1079_4(bool)             = CompareGT                   : r1079_2, r1079_3
+# 1079|     v1079_5(void)             = ConditionalBranch           : r1079_4
 #-----|   False -> Block 4
 #-----|   True -> Block 3
 
@@ -6169,36 +6168,36 @@ ir.cpp:
 # 1078|     r1078_37(glval<unknown>)  = FunctionAddress[operator++]     : 
 # 1078|     r1078_38(iterator &)      = Call[operator++]                : func:r1078_37, this:r1078_36
 # 1078|     mu1078_39(unknown)        = ^CallSideEffect                 : ~m?
-# 1078|     v1078_40(void)            = ^BufferReadSideEffect[-1]       : &:r1078_36, ~m?
+# 1078|     v1078_40(void)            = ^IndirectReadSideEffect[-1]     : &:r1078_36, ~m?
 # 1078|     mu1078_41(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r1078_36
 # 1078|     r1078_42(glval<iterator>) = CopyValue                       : r1078_38
 #-----|   Goto (back edge) -> Block 1
 
 # 1084|   Block 5
-# 1084|     r1084_1(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1084|     r1084_2(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1084|     r1084_3(vector<int> &)         = Load[v]                    : &:r1084_2, ~m?
-# 1084|     r1084_4(glval<vector<int>>)    = CopyValue                  : r1084_3
-# 1084|     r1084_5(vector<int> &)         = CopyValue                  : r1084_4
-# 1084|     mu1084_6(vector<int> &)        = Store[(__range)]           : &:r1084_1, r1084_5
-# 1084|     r1084_7(glval<iterator>)       = VariableAddress[(__begin)] : 
-# 1084|     r1084_8(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1084|     r1084_9(vector<int> &)         = Load[(__range)]            : &:r1084_8, ~m?
-#-----|     r0_9(glval<vector<int>>)       = CopyValue                  : r1084_9
-# 1084|     r1084_10(glval<unknown>)       = FunctionAddress[begin]     : 
-# 1084|     r1084_11(iterator)             = Call[begin]                : func:r1084_10, this:r0_9
-# 1084|     mu1084_12(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_10(void)                    = ^BufferReadSideEffect[-1]  : &:r0_9, ~m?
-# 1084|     mu1084_13(iterator)            = Store[(__begin)]           : &:r1084_7, r1084_11
-# 1084|     r1084_14(glval<iterator>)      = VariableAddress[(__end)]   : 
-# 1084|     r1084_15(glval<vector<int> &>) = VariableAddress[(__range)] : 
-# 1084|     r1084_16(vector<int> &)        = Load[(__range)]            : &:r1084_15, ~m?
-#-----|     r0_11(glval<vector<int>>)      = CopyValue                  : r1084_16
-# 1084|     r1084_17(glval<unknown>)       = FunctionAddress[end]       : 
-# 1084|     r1084_18(iterator)             = Call[end]                  : func:r1084_17, this:r0_11
-# 1084|     mu1084_19(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_12(void)                    = ^BufferReadSideEffect[-1]  : &:r0_11, ~m?
-# 1084|     mu1084_20(iterator)            = Store[(__end)]             : &:r1084_14, r1084_18
+# 1084|     r1084_1(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1084|     r1084_2(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1084|     r1084_3(vector<int> &)         = Load[v]                     : &:r1084_2, ~m?
+# 1084|     r1084_4(glval<vector<int>>)    = CopyValue                   : r1084_3
+# 1084|     r1084_5(vector<int> &)         = CopyValue                   : r1084_4
+# 1084|     mu1084_6(vector<int> &)        = Store[(__range)]            : &:r1084_1, r1084_5
+# 1084|     r1084_7(glval<iterator>)       = VariableAddress[(__begin)]  : 
+# 1084|     r1084_8(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1084|     r1084_9(vector<int> &)         = Load[(__range)]             : &:r1084_8, ~m?
+#-----|     r0_9(glval<vector<int>>)       = CopyValue                   : r1084_9
+# 1084|     r1084_10(glval<unknown>)       = FunctionAddress[begin]      : 
+# 1084|     r1084_11(iterator)             = Call[begin]                 : func:r1084_10, this:r0_9
+# 1084|     mu1084_12(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_10(void)                    = ^IndirectReadSideEffect[-1] : &:r0_9, ~m?
+# 1084|     mu1084_13(iterator)            = Store[(__begin)]            : &:r1084_7, r1084_11
+# 1084|     r1084_14(glval<iterator>)      = VariableAddress[(__end)]    : 
+# 1084|     r1084_15(glval<vector<int> &>) = VariableAddress[(__range)]  : 
+# 1084|     r1084_16(vector<int> &)        = Load[(__range)]             : &:r1084_15, ~m?
+#-----|     r0_11(glval<vector<int>>)      = CopyValue                   : r1084_16
+# 1084|     r1084_17(glval<unknown>)       = FunctionAddress[end]        : 
+# 1084|     r1084_18(iterator)             = Call[end]                   : func:r1084_17, this:r0_11
+# 1084|     mu1084_19(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_12(void)                    = ^IndirectReadSideEffect[-1] : &:r0_11, ~m?
+# 1084|     mu1084_20(iterator)            = Store[(__end)]              : &:r1084_14, r1084_18
 #-----|   Goto -> Block 6
 
 # 1084|   Block 6
@@ -6209,7 +6208,7 @@ ir.cpp:
 # 1084|     r1084_24(iterator)        = Load[(__end)]               : &:r1084_23, ~m?
 # 1084|     r1084_25(bool)            = Call[operator!=]            : func:r1084_22, this:r0_13, 0:r1084_24
 # 1084|     mu1084_26(unknown)        = ^CallSideEffect             : ~m?
-#-----|     v0_14(void)               = ^BufferReadSideEffect[-1]   : &:r0_13, ~m?
+#-----|     v0_14(void)               = ^IndirectReadSideEffect[-1] : &:r0_13, ~m?
 # 1084|     v1084_27(void)            = ConditionalBranch           : r1084_25
 #-----|   False -> Block 10
 #-----|   True -> Block 8
@@ -6219,29 +6218,29 @@ ir.cpp:
 # 1084|     r1084_29(glval<unknown>)  = FunctionAddress[operator++]     : 
 # 1084|     r1084_30(iterator &)      = Call[operator++]                : func:r1084_29, this:r1084_28
 # 1084|     mu1084_31(unknown)        = ^CallSideEffect                 : ~m?
-# 1084|     v1084_32(void)            = ^BufferReadSideEffect[-1]       : &:r1084_28, ~m?
+# 1084|     v1084_32(void)            = ^IndirectReadSideEffect[-1]     : &:r1084_28, ~m?
 # 1084|     mu1084_33(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r1084_28
 # 1084|     r1084_34(glval<iterator>) = CopyValue                       : r1084_30
 #-----|   Goto (back edge) -> Block 6
 
 # 1084|   Block 8
-# 1084|     r1084_35(glval<int &>)    = VariableAddress[e]         : 
-# 1084|     r1084_36(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r0_15(glval<iterator>)    = Convert                    : r1084_36
-# 1084|     r1084_37(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1084|     r1084_38(int &)           = Call[operator*]            : func:r1084_37, this:r0_15
-# 1084|     mu1084_39(unknown)        = ^CallSideEffect            : ~m?
-#-----|     v0_16(void)               = ^BufferReadSideEffect[-1]  : &:r0_15, ~m?
-# 1084|     r1084_40(glval<int>)      = CopyValue                  : r1084_38
-# 1084|     r1084_41(glval<int>)      = Convert                    : r1084_40
-# 1084|     r1084_42(int &)           = CopyValue                  : r1084_41
-# 1084|     mu1084_43(int &)          = Store[e]                   : &:r1084_35, r1084_42
-# 1085|     r1085_1(glval<int &>)     = VariableAddress[e]         : 
-# 1085|     r1085_2(int &)            = Load[e]                    : &:r1085_1, ~m?
-# 1085|     r1085_3(int)              = Load[?]                    : &:r1085_2, ~m?
-# 1085|     r1085_4(int)              = Constant[5]                : 
-# 1085|     r1085_5(bool)             = CompareLT                  : r1085_3, r1085_4
-# 1085|     v1085_6(void)             = ConditionalBranch          : r1085_5
+# 1084|     r1084_35(glval<int &>)    = VariableAddress[e]          : 
+# 1084|     r1084_36(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_15(glval<iterator>)    = Convert                     : r1084_36
+# 1084|     r1084_37(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 1084|     r1084_38(int &)           = Call[operator*]             : func:r1084_37, this:r0_15
+# 1084|     mu1084_39(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_16(void)               = ^IndirectReadSideEffect[-1] : &:r0_15, ~m?
+# 1084|     r1084_40(glval<int>)      = CopyValue                   : r1084_38
+# 1084|     r1084_41(glval<int>)      = Convert                     : r1084_40
+# 1084|     r1084_42(int &)           = CopyValue                   : r1084_41
+# 1084|     mu1084_43(int &)          = Store[e]                    : &:r1084_35, r1084_42
+# 1085|     r1085_1(glval<int &>)     = VariableAddress[e]          : 
+# 1085|     r1085_2(int &)            = Load[e]                     : &:r1085_1, ~m?
+# 1085|     r1085_3(int)              = Load[?]                     : &:r1085_2, ~m?
+# 1085|     r1085_4(int)              = Constant[5]                 : 
+# 1085|     r1085_5(bool)             = CompareLT                   : r1085_3, r1085_4
+# 1085|     v1085_6(void)             = ConditionalBranch           : r1085_5
 #-----|   False -> Block 7
 #-----|   True -> Block 9
 
@@ -7525,7 +7524,7 @@ ir.cpp:
 # 1373|     r1373_8(glval<unknown>)  = FunctionAddress[c_str]            : 
 # 1373|     r1373_9(char *)          = Call[c_str]                       : func:r1373_8, this:r1373_7
 # 1373|     mu1373_10(unknown)       = ^CallSideEffect                   : ~m?
-# 1373|     v1373_11(void)           = ^BufferReadSideEffect[-1]         : &:r1373_7, ~m?
+# 1373|     v1373_11(void)           = ^IndirectReadSideEffect[-1]       : &:r1373_7, ~m?
 # 1374|     r1374_1(glval<String>)   = VariableAddress[#temp1374:5]      : 
 # 1374|     r1374_2(glval<unknown>)  = FunctionAddress[returnValue]      : 
 # 1374|     r1374_3(String)          = Call[returnValue]                 : func:r1374_2
@@ -7535,7 +7534,7 @@ ir.cpp:
 # 1374|     r1374_7(glval<unknown>)  = FunctionAddress[c_str]            : 
 # 1374|     r1374_8(char *)          = Call[c_str]                       : func:r1374_7, this:r1374_6
 # 1374|     mu1374_9(unknown)        = ^CallSideEffect                   : ~m?
-# 1374|     v1374_10(void)           = ^BufferReadSideEffect[-1]         : &:r1374_6, ~m?
+# 1374|     v1374_10(void)           = ^IndirectReadSideEffect[-1]       : &:r1374_6, ~m?
 # 1376|     r1376_1(glval<String>)   = VariableAddress[#temp1376:5]      : 
 # 1376|     r1376_2(glval<unknown>)  = FunctionAddress[defaultConstruct] : 
 # 1376|     r1376_3(String)          = Call[defaultConstruct]            : func:r1376_2
@@ -7589,7 +7588,7 @@ ir.cpp:
 # 1385|     r1385_4(glval<unknown>)           = FunctionAddress[method]           : 
 # 1385|     v1385_5(void)                     = Call[method]                      : func:r1385_4, this:r1385_1
 # 1385|     mu1385_6(unknown)                 = ^CallSideEffect                   : ~m?
-# 1385|     v1385_7(void)                     = ^BufferReadSideEffect[-1]         : &:r1385_1, ~m?
+# 1385|     v1385_7(void)                     = ^IndirectReadSideEffect[-1]       : &:r1385_1, ~m?
 # 1385|     mu1385_8(destructor_only)         = ^IndirectMayWriteSideEffect[-1]   : &:r1385_1
 # 1386|     r1386_1(glval<destructor_only>)   = VariableAddress[#temp1386:5]      : 
 # 1386|     r1386_2(glval<unknown>)           = FunctionAddress[returnValue]      : 
@@ -7599,7 +7598,7 @@ ir.cpp:
 # 1386|     r1386_6(glval<unknown>)           = FunctionAddress[method]           : 
 # 1386|     v1386_7(void)                     = Call[method]                      : func:r1386_6, this:r1386_1
 # 1386|     mu1386_8(unknown)                 = ^CallSideEffect                   : ~m?
-# 1386|     v1386_9(void)                     = ^BufferReadSideEffect[-1]         : &:r1386_1, ~m?
+# 1386|     v1386_9(void)                     = ^IndirectReadSideEffect[-1]       : &:r1386_1, ~m?
 # 1386|     mu1386_10(destructor_only)        = ^IndirectMayWriteSideEffect[-1]   : &:r1386_1
 # 1388|     r1388_1(glval<destructor_only>)   = VariableAddress[#temp1388:5]      : 
 # 1388|     r1388_2(glval<unknown>)           = FunctionAddress[defaultConstruct] : 
@@ -7667,7 +7666,7 @@ ir.cpp:
 # 1397|     r1397_7(glval<unknown>)            = FunctionAddress[method]           : 
 # 1397|     v1397_8(void)                      = Call[method]                      : func:r1397_7, this:r1397_1
 # 1397|     mu1397_9(unknown)                  = ^CallSideEffect                   : ~m?
-# 1397|     v1397_10(void)                     = ^BufferReadSideEffect[-1]         : &:r1397_1, ~m?
+# 1397|     v1397_10(void)                     = ^IndirectReadSideEffect[-1]       : &:r1397_1, ~m?
 # 1397|     mu1397_11(copy_constructor)        = ^IndirectMayWriteSideEffect[-1]   : &:r1397_1
 # 1398|     r1398_1(glval<copy_constructor>)   = VariableAddress[#temp1398:5]      : 
 # 1398|     r1398_2(glval<unknown>)            = FunctionAddress[returnValue]      : 
@@ -7677,7 +7676,7 @@ ir.cpp:
 # 1398|     r1398_6(glval<unknown>)            = FunctionAddress[method]           : 
 # 1398|     v1398_7(void)                      = Call[method]                      : func:r1398_6, this:r1398_1
 # 1398|     mu1398_8(unknown)                  = ^CallSideEffect                   : ~m?
-# 1398|     v1398_9(void)                      = ^BufferReadSideEffect[-1]         : &:r1398_1, ~m?
+# 1398|     v1398_9(void)                      = ^IndirectReadSideEffect[-1]       : &:r1398_1, ~m?
 # 1398|     mu1398_10(copy_constructor)        = ^IndirectMayWriteSideEffect[-1]   : &:r1398_1
 # 1399|     r1399_1(glval<copy_constructor>)   = VariableAddress[#temp1399:5]      : 
 # 1399|     r1399_2(glval<unknown>)            = FunctionAddress[defaultConstruct] : 
@@ -7851,7 +7850,7 @@ ir.cpp:
 # 1447|     r1447_9(glval<unknown>)     = FunctionAddress[f]                                : 
 # 1447|     r1447_10(float)             = Call[f]                                           : func:r1447_9, this:r1447_8
 # 1447|     mu1447_11(unknown)          = ^CallSideEffect                                   : ~m?
-# 1447|     v1447_12(void)              = ^BufferReadSideEffect[-1]                         : &:r1447_8, ~m?
+# 1447|     v1447_12(void)              = ^IndirectReadSideEffect[-1]                       : &:r1447_8, ~m?
 # 1447|     mu1447_13(float)            = Store[f]                                          : &:r1447_1, r1447_10
 # 1448|     v1448_1(void)               = NoOp                                              : 
 # 1443|     v1443_4(void)               = ReturnVoid                                        : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index c4019a38251e..76de50dd792b 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -1059,7 +1059,7 @@ ssa.cpp:
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     m241_4(unknown)              = ^CallSideEffect                 : ~m240_7
 #  241|     m241_5(unknown)              = Chi                             : total:m240_7, partial:m241_4
-#  241|     v241_6(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m240_9
+#  241|     v241_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, m240_9
 #  241|     m241_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  241|     m241_8(Constructible)        = Chi                             : total:m240_9, partial:m241_7
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
@@ -1067,7 +1067,7 @@ ssa.cpp:
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     m242_4(unknown)              = ^CallSideEffect                 : ~m241_5
 #  242|     m242_5(unknown)              = Chi                             : total:m241_5, partial:m242_4
-#  242|     v242_6(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m241_8
+#  242|     v242_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, m241_8
 #  242|     m242_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  242|     m242_8(Constructible)        = Chi                             : total:m241_8, partial:m242_7
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
@@ -1084,7 +1084,7 @@ ssa.cpp:
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     m244_4(unknown)              = ^CallSideEffect                 : ~m243_7
 #  244|     m244_5(unknown)              = Chi                             : total:m243_7, partial:m244_4
-#  244|     v244_6(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m243_9
+#  244|     v244_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, m243_9
 #  244|     m244_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  244|     m244_8(Constructible)        = Chi                             : total:m243_9, partial:m244_7
 #  245|     v245_1(void)                 = NoOp                            : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
index a101e638cd08..ab79d20214a8 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
@@ -1054,7 +1054,7 @@ ssa.cpp:
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     m241_4(unknown)              = ^CallSideEffect                 : ~m240_7
 #  241|     m241_5(unknown)              = Chi                             : total:m240_7, partial:m241_4
-#  241|     v241_6(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m240_9
+#  241|     v241_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, m240_9
 #  241|     m241_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  241|     m241_8(Constructible)        = Chi                             : total:m240_9, partial:m241_7
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
@@ -1062,7 +1062,7 @@ ssa.cpp:
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     m242_4(unknown)              = ^CallSideEffect                 : ~m241_5
 #  242|     m242_5(unknown)              = Chi                             : total:m241_5, partial:m242_4
-#  242|     v242_6(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m241_8
+#  242|     v242_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, m241_8
 #  242|     m242_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  242|     m242_8(Constructible)        = Chi                             : total:m241_8, partial:m242_7
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
@@ -1079,7 +1079,7 @@ ssa.cpp:
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     m244_4(unknown)              = ^CallSideEffect                 : ~m243_7
 #  244|     m244_5(unknown)              = Chi                             : total:m243_7, partial:m244_4
-#  244|     v244_6(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m243_9
+#  244|     v244_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, m243_9
 #  244|     m244_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  244|     m244_8(Constructible)        = Chi                             : total:m243_9, partial:m244_7
 #  245|     v245_1(void)                 = NoOp                            : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 8b6cf17dbbbb..0b257db98a43 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -983,13 +983,13 @@ ssa.cpp:
 #  241|     r241_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     mu241_4(unknown)             = ^CallSideEffect                 : ~m?
-#  241|     v241_5(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m?
+#  241|     v241_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, ~m?
 #  241|     mu241_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
 #  242|     r242_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     mu242_4(unknown)             = ^CallSideEffect                 : ~m?
-#  242|     v242_5(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m?
+#  242|     v242_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, ~m?
 #  242|     mu242_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
 #  243|     mu243_2(Constructible)       = Uninitialized[c2]               : &:r243_1
@@ -1002,7 +1002,7 @@ ssa.cpp:
 #  244|     r244_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     mu244_4(unknown)             = ^CallSideEffect                 : ~m?
-#  244|     v244_5(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m?
+#  244|     v244_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, ~m?
 #  244|     mu244_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  245|     v245_1(void)                 = NoOp                            : 
 #  239|     v239_4(void)                 = ReturnVoid                      : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
index 8b6cf17dbbbb..0b257db98a43 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
@@ -983,13 +983,13 @@ ssa.cpp:
 #  241|     r241_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     mu241_4(unknown)             = ^CallSideEffect                 : ~m?
-#  241|     v241_5(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m?
+#  241|     v241_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, ~m?
 #  241|     mu241_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
 #  242|     r242_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     mu242_4(unknown)             = ^CallSideEffect                 : ~m?
-#  242|     v242_5(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m?
+#  242|     v242_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, ~m?
 #  242|     mu242_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
 #  243|     mu243_2(Constructible)       = Uninitialized[c2]               : &:r243_1
@@ -1002,7 +1002,7 @@ ssa.cpp:
 #  244|     r244_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     mu244_4(unknown)             = ^CallSideEffect                 : ~m?
-#  244|     v244_5(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m?
+#  244|     v244_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, ~m?
 #  244|     mu244_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  245|     v245_1(void)                 = NoOp                            : 
 #  239|     v239_4(void)                 = ReturnVoid                      : 

From b8c11503f0fcc66c07169a0d9cb413726af347ff Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:21:49 +0800
Subject: [PATCH 161/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index 2712f30a3f2b..f49100089028 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -4,7 +4,7 @@
 <qhelp>
 <overview>
 <p>The software uses external input as the function name to wrap JSON data and returns it to the client as a request response. 
-When there is a cross-domain problem, the problem of sensitive information leakage may occur.</p>
+When there is a cross-domain problem, this could lead to information leakage.</p>
 
 </overview>
 <recommendation>

From ebd38eaf3bd0d5f4cb15bf4724fb2bb90ad1f8a6 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:22:08 +0800
Subject: [PATCH 162/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index f49100089028..e3d61a0342e3 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -14,7 +14,7 @@ When there is a cross-domain problem, this could lead to information leakage.</p
 </recommendation>
 <example>
 
-<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad8</code>, 
+<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>, 
 will cause information leakage problems when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
 method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can 
 solve the problem of information leakage caused by cross-domain.</p>

From d8165145c71e1c21c8e274fca2d807ad34b0001d Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:22:44 +0800
Subject: [PATCH 163/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index e3d61a0342e3..f8c01cf5a328 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -15,7 +15,7 @@ When there is a cross-domain problem, this could lead to information leakage.</p
 <example>
 
 <p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>, 
-will cause information leakage problems when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
+will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
 method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can 
 solve the problem of information leakage caused by cross-domain.</p>
 

From 1510048f7afb17ae4e63b38c7e83c2ef05c9aa11 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:23:13 +0800
Subject: [PATCH 164/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index f8c01cf5a328..10c6aa056adb 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -16,7 +16,7 @@ When there is a cross-domain problem, this could lead to information leakage.</p
 
 <p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>, 
 will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
-method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can 
+method and the <code>good2</code> method, using the <code>verifToken</code> method to do random <code>token</code> verification
 solve the problem of information leakage caused by cross-domain.</p>
 
 <sample src="JsonpInjection.java" />

From 79c1374925f72b59ac9ad6f41ad2ad0b759c0eb5 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:24:49 +0800
Subject: [PATCH 165/433] Update
 java/ql/src/semmle/code/java/frameworks/Servlets.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/semmle/code/java/frameworks/Servlets.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index 21f55d396853..a99df9816f15 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -354,7 +354,7 @@ class FilterChain extends Interface {
 
 /** Holds if `m` is a filter handler method (for example `doFilter`). */
 predicate isDoFilterMethod(Method m) {
-  m.getName().matches("doFilter") and
+  m.getName() ="doFilter" and
   m.getDeclaringType() instanceof FilterClass and
   m.getNumberOfParameters() = 3 and
   m.getParameter(0).getType() instanceof ServletRequest and

From 157e4670fd5ec92f9f86b2fc23eae3eda103375d Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:25:11 +0800
Subject: [PATCH 166/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index 10c6aa056adb..2a3f0861cdf9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -17,7 +17,7 @@ When there is a cross-domain problem, this could lead to information leakage.</p
 <p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>, 
 will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
 method and the <code>good2</code> method, using the <code>verifToken</code> method to do random <code>token</code> verification
-solve the problem of information leakage caused by cross-domain.</p>
+solves the problem of information leakage even in the presence of cross-domain access issues.</p>
 
 <sample src="JsonpInjection.java" />
 

From 837f20108ddabb25c4c04f45c1c1324b456d2ce0 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:25:43 +0800
Subject: [PATCH 167/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index bf90926f72f0..507a93454d78 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -7,7 +7,7 @@ import semmle.code.java.dataflow.DataFlow3
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
-/** A data flow configuration is tracing flow from the access to the authentication method of token/auth/referer/origin to if condition. */
+/** A data flow configuration tracing flow from the result of a method whose name includes token/auth/referer/origin to an if-statement condition. */
 class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
   VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
 

From c77c7b0a982bfe6eb88911bc7ac5cfb26b58d245 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:27:16 +0800
Subject: [PATCH 168/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../Security/CWE/CWE-352/JsonpInjectionLib.qll             | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 507a93454d78..f30a31f41337 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -27,7 +27,12 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
   }
 }
 
-/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
+/** Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
+* 
+* For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
+* the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
+* and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
+ */
 class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
 

From 760231c0046b559279eefe79c60de6e0092a96ba Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:28:17 +0800
Subject: [PATCH 169/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index f30a31f41337..c63473cafa86 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -60,6 +60,9 @@ Callable getACallingCallableOrSelf(Callable call) {
   result = getACallingCallableOrSelf(call.getAReference().getEnclosingCallable())
 }
 
+/**
+ * A method that is called to handle an HTTP GET request.
+ */
 abstract class RequestGetMethod extends Method { }
 
 /** Override method of `doGet` of `Servlet` subclass. */

From 9635a36044677ba4b3849f61480a16934b99bf76 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:29:06 +0800
Subject: [PATCH 170/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.ql  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index 6e333d839930..9e210dd0e7ba 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -16,7 +16,10 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.deadcode.WebEntryPoints
 import DataFlow::PathGraph
 
-/** Determine whether there is a verification method for the remote streaming source data flow path method. */
+/** 
+ * Holds if some `Filter.doFilter` method exists in the whole program that takes some user-controlled
+ * input and tests it with what appears to be a token- or authentication-checking function.
+ */
 predicate existsFilterVerificationMethod() {
   exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc, Method m |
     vmfc.hasFlow(source, sink) and

From 4c21980d4f34ab44bb684ff23c8c113028b355f0 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:29:30 +0800
Subject: [PATCH 171/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index c63473cafa86..3ba559a81c06 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -141,7 +141,7 @@ class JsonDataFlowConfig extends DataFlow2::Configuration {
   }
 }
 
-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+/** Taint-tracking configuration tracing flow from probable jsonp data with a user-controlled function name to an outgoing HTTP entity. */
 class JsonpInjectionFlowConfig extends TaintTracking::Configuration {
   JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
 

From 8a7d28a2ed8f235a82b20803da94f4f6828f26e5 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 04:29:49 +0800
Subject: [PATCH 172/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 3ba559a81c06..5e9b447f51c7 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -130,7 +130,7 @@ class RemoteFlowConfig extends DataFlow2::Configuration {
   }
 }
 
-/** A data flow configuration tracing flow from json data to splicing jsonp data. */
+/** A data flow configuration tracing flow from json data into the argument `json` of JSONP-like string `someFunctionName + "(" + json + ")"`. */
 class JsonDataFlowConfig extends DataFlow2::Configuration {
   JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
 

From 8687c5c14533ac35859cedca383217c65bce5539 Mon Sep 17 00:00:00 2001
From: porcupineyhairs <61983466+porcupineyhairs@users.noreply.github.com>
Date: Sat, 10 Apr 2021 04:18:35 +0530
Subject: [PATCH 173/433] Apply suggestions from code review

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../Security/CWE/CWE-094/InsecureDexLoading.qhelp    | 12 ++++++------
 .../Security/CWE/CWE-094/InsecureDexLoading.ql       |  8 ++++----
 .../Security/CWE/CWE-094/InsecureDexLoading.qll      |  4 ++--
 .../Security/CWE/CWE-094/InsecureDexLoadingBad.java  |  4 ++--
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
index feda3af3fc26..4a5555c1390c 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
@@ -2,29 +2,29 @@
 <qhelp>
   <overview>
     <p>
-Shared world writable storage spaces are not secure to load Dex libraries from. A malicious actor can replace a dex file with a maliciously crafted file 
+It is dangerous to load Dex libraries from shared world-writable storage spaces. A malicious actor can replace a dex file with a maliciously crafted file 
 which when loaded by the app can lead to code execution. 
 </p>
   </overview>
 
   <recommendation>
     <p>
-      Loading a file from private storage instead of a world writable one can prevent this issue.
-      As the attacker cannot access files stored by the app in its private storage. 
+      Loading a file from private storage instead of a world-writable one can prevent this issue,
+      because the attacker cannot access files stored there. 
     </p>
   </recommendation>
 
   <example>
     <p>
-      The following example loads a Dex file from a shared world writable location. in this case, 
-      since the `/sdcard` directory is on external storage, any one can read/write to the location. 
+      The following example loads a Dex file from a shared world-writable location. in this case, 
+      since the `/sdcard` directory is on external storage, anyone can read/write to the location. 
       bypassing all Android security policies. Hence, this is insecure.
     </p>
     <sample src="InsecureDexLoadingBad.java" />
 
     <p>
     The next example loads a Dex file stored inside the app's private storage. 
-    This is not exploitable as nobody else except the app can access the data stored here.
+    This is not exploitable as nobody else except the app can access the data stored there.
     </p>
     <sample src="InsecureDexLoadingGood.java" />
   </example>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
index 58d9844d38aa..bae3ed63d700 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
@@ -1,7 +1,7 @@
 /**
  * @name Insecure loading of an Android Dex File
- * @description Loading a DEX library located in a world-readable/ writable location such as
- * a SD card can cause arbitary code execution vulnerabilities.
+ * @description Loading a DEX library located in a world-writable location such as
+ * an SD card can lead to arbitrary code execution vulnerabilities.
  * @kind path-problem
  * @problem.severity error
  * @precision high
@@ -16,5 +16,5 @@ import DataFlow::PathGraph
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureDexConfiguration conf
 where conf.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Potential arbitary code execution due to $@.",
-  source.getNode(), "a value loaded from a world readable/writable source."
+select sink.getNode(), source, sink, "Potential arbitrary code execution due to $@.",
+  source.getNode(), "a value loaded from a world-writable source."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
index 2a4b387be7e3..0ee0954216e7 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
@@ -2,7 +2,7 @@ import java
 import semmle.code.java.dataflow.FlowSources
 
 /**
- * A taint-tracking configuration fordetecting unsafe use of a
+ * A taint-tracking configuration detecting unsafe use of a
  * `DexClassLoader` by an Android app.
  */
 class InsecureDexConfiguration extends TaintTracking::Configuration {
@@ -63,7 +63,7 @@ private class DexClassLoader extends InsecureDexSink {
 }
 
 /**
- * An `File` instance which reads from an SD card
+ * A `File` instance which reads from an SD card
  * taken as a source for insecure Dex class loading vulnerabilities.
  */
 private class ExternalFile extends InsecureDexSource {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
index d8fdd828f4fb..869b6bc571c6 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
@@ -22,11 +22,11 @@ private void updateChecker() {
 						getClassLoader());
 				int version = (int) cl.loadClass("my.package.class").getDeclaredMethod("myMethod").invoke(null);
 				if (Build.VERSION.SDK_INT < version) {
-					Toast.makeText(this, "Securely loaded Dex!", Toast.LENGTH_LONG).show();
+					Toast.makeText(this, "Loaded Dex!", Toast.LENGTH_LONG).show();
 				}
 			}
 		} catch (Exception e) {
 			// ignore
 		}
 	}
-}
\ No newline at end of file
+}

From a5ebe8c60055b44c2e522019df2eb14e0a7b03d5 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 09:26:08 +0800
Subject: [PATCH 174/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 5e9b447f51c7..da1e17fd75c9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -12,7 +12,7 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
   VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) {
-    exists(MethodAccess ma, BarrierGuard bg | ma = bg |
+    exists(MethodAccess ma | ma instanceof BarrierGuard |
       (
         ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
         or

From 650446f761fc943d7a5d7c891402ea22b46b202d Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 09:26:32 +0800
Subject: [PATCH 175/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index da1e17fd75c9..c5b0de71fad3 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -39,8 +39,8 @@ class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma, BarrierGuard bg, int i, VerificationMethodToIfFlowConfig vmtifc |
-      ma = bg
+    exists(MethodAccess ma, int i, VerificationMethodToIfFlowConfig vmtifc |
+      ma instanceof BarrierGuard
     |
       (
         ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")

From 8b756d7f1bcf090b0a890df81fe85dd712e56e05 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 09:27:03 +0800
Subject: [PATCH 176/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjection.ql | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index 9e210dd0e7ba..aa046e7cd2c6 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -28,7 +28,11 @@ predicate existsFilterVerificationMethod() {
   )
 }
 
-/** Determine whether there is a verification method for the remote streaming source data flow path method. */
+/** 
+ * Holds if somewhere in the whole program some user-controlled
+ * input is tested with what appears to be a token- or authentication-checking function,
+ * and `checkNode` is reachable from any function that can reach the user-controlled input source.
+ */
 predicate existsServletVerificationMethod(Node checkNode) {
   exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
     vmfc.hasFlow(source, sink) and

From 046aeaa38cd5478670e711357d965a30077ef89f Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 09:37:29 +0800
Subject: [PATCH 177/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index c5b0de71fad3..1a1d8487149e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -98,7 +98,7 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
 }
 
 /** A concatenate expression using `(` and `)` or `);`. */
-class JsonpInjectionExpr extends AddExpr {
+class JsonpBuilderExpr extends AddExpr {
   JsonpInjectionExpr() {
     getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
     getLeftOperand()

From eeae91e62012dce68650e2a2d696adbded055218 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Sat, 10 Apr 2021 09:48:55 +0800
Subject: [PATCH 178/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 1a1d8487149e..589a565c590f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -100,7 +100,7 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
 /** A concatenate expression using `(` and `)` or `);`. */
 class JsonpBuilderExpr extends AddExpr {
   JsonpInjectionExpr() {
-    getRightOperand().toString().regexpMatch("\"\\)\"|\"\\);\"") and
+    getRightOperand().toString().regexpMatch("\"\\);?\"") and
     getLeftOperand()
         .(AddExpr)
         .getLeftOperand()

From 9349e6922d50c36926a4cdf56a9bbc46c712a2c1 Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Thu, 8 Apr 2021 21:37:03 +0200
Subject: [PATCH 179/433] Java: Add ToStringMethod

---
 .../Security/CWE/CWE-209/StackTraceExposure.ql    |  3 +--
 .../CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql     |  3 +--
 .../CWE/CWE-798/HardcodedCredentialsApiCall.ql    |  4 ++--
 .../Undesirable Calls/CallsToStringToString.ql    |  3 +--
 .../Undesirable Calls/DefaultToString.ql          | 15 ++++-----------
 .../Security/CWE/CWE-297/InsecureLdapEndpoint.ql  |  2 +-
 java/ql/src/semmle/code/java/JDK.qll              | 10 +++++++++-
 java/ql/src/semmle/code/java/dispatch/ObjFlow.qll |  2 +-
 .../code/java/security/ControlledString.qll       |  9 ++++-----
 9 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
index c9c1e2917c0e..3426d9f6f62b 100644
--- a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+++ b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -79,8 +79,7 @@ predicate stackTraceExpr(Expr exception, MethodAccess stackTraceString) {
     printStackCall.getAnArgument() = printWriter and
     printStackCall.getQualifier() = exception and
     stackTraceString.getQualifier() = stringWriterVar.getAnAccess() and
-    stackTraceString.getMethod().getName() = "toString" and
-    stackTraceString.getMethod().getNumberOfParameters() = 0
+    stackTraceString.getMethod() instanceof ToStringMethod
   )
 }
 
diff --git a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
index c84abe1ff75d..7b026efb7ae2 100644
--- a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
+++ b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
@@ -33,9 +33,8 @@ class InsecureAlgoLiteral extends ShortStringLiteral {
 }
 
 predicate objectToString(MethodAccess ma) {
-  exists(Method m |
+  exists(ToStringMethod m |
     m = ma.getMethod() and
-    m.hasName("toString") and
     m.getDeclaringType() instanceof TypeObject and
     variableTrack(ma.getQualifier()).getType().getErasure() instanceof TypeObject
   )
diff --git a/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql b/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
index 4fb3f14c9934..c76527bc5389 100644
--- a/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
+++ b/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
@@ -19,14 +19,14 @@ class HardcodedCredentialApiCallConfiguration extends DataFlow::Configuration {
 
   override predicate isSource(DataFlow::Node n) {
     n.asExpr() instanceof HardcodedExpr and
-    not n.asExpr().getEnclosingCallable().getName() = "toString"
+    not n.asExpr().getEnclosingCallable() instanceof ToStringMethod
   }
 
   override predicate isSink(DataFlow::Node n) { n.asExpr() instanceof CredentialsApiSink }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     node1.asExpr().getType() instanceof TypeString and
-    exists(MethodAccess ma | ma.getMethod().getName().regexpMatch("getBytes|toCharArray") |
+    exists(MethodAccess ma | ma.getMethod().hasName(["getBytes", "toCharArray"]) |
       node2.asExpr() = ma and
       ma.getQualifier() = node1.asExpr()
     )
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
index 40a4e36d70cd..c13956694056 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql	
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql	
@@ -10,9 +10,8 @@
 
 import java
 
-from MethodAccess ma, Method tostring
+from MethodAccess ma, ToStringMethod tostring
 where
-  tostring.hasName("toString") and
   tostring.getDeclaringType() instanceof TypeString and
   ma.getMethod() = tostring
 select ma, "Redundant call to 'toString' on a String object."
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
index 7d9ef5b85f93..c6eaf5af2cbf 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql	
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql	
@@ -14,20 +14,13 @@ import java
 import semmle.code.java.StringFormat
 
 predicate explicitToStringCall(Expr e) {
-  exists(MethodAccess ma, Method toString | toString = ma.getMethod() |
-    e = ma.getQualifier() and
-    toString.getName() = "toString" and
-    toString.getNumberOfParameters() = 0 and
-    not toString.isStatic()
+  exists(MethodAccess ma |
+    ma.getMethod() instanceof ToStringMethod and
+    e = ma.getQualifier()
   )
 }
 
-predicate directlyDeclaresToString(Class c) {
-  exists(Method m | m.getDeclaringType() = c |
-    m.getName() = "toString" and
-    m.getNumberOfParameters() = 0
-  )
-}
+predicate directlyDeclaresToString(Class c) { any(ToStringMethod m).getDeclaringType() = c }
 
 predicate inheritsObjectToString(Class t) {
   not directlyDeclaresToString(t.getSourceDeclaration()) and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
index 467d78ae1c48..9fa2fe596fd9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
@@ -68,7 +68,7 @@ predicate isBooleanTrue(Expr expr) {
   or
   exists(MethodAccess ma |
     expr = ma and
-    ma.getMethod().hasName("toString") and
+    ma.getMethod() instanceof ToStringMethod and
     ma.getQualifier().(FieldAccess).getField().hasName("TRUE") and
     ma.getQualifier()
         .(FieldAccess)
diff --git a/java/ql/src/semmle/code/java/JDK.qll b/java/ql/src/semmle/code/java/JDK.qll
index cf2ae1ab2078..7bc072e177cb 100644
--- a/java/ql/src/semmle/code/java/JDK.qll
+++ b/java/ql/src/semmle/code/java/JDK.qll
@@ -353,7 +353,7 @@ class EqualsMethod extends Method {
 class HashCodeMethod extends Method {
   HashCodeMethod() {
     this.hasName("hashCode") and
-    this.getNumberOfParameters() = 0
+    this.hasNoParameters()
   }
 }
 
@@ -365,6 +365,14 @@ class CloneMethod extends Method {
   }
 }
 
+/** A method with the same signature as `java.lang.Object.toString`. */
+class ToStringMethod extends Method {
+  ToStringMethod() {
+    this.hasName("toString") and
+    this.hasNoParameters()
+  }
+}
+
 /**
  * The public static `main` method, with a single formal parameter
  * of type `String[]` and return type `void`.
diff --git a/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll b/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
index 52ee910ae1d5..9ec77acf2c7c 100644
--- a/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
+++ b/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
@@ -194,7 +194,7 @@ private predicate source(RefType t, ObjNode n) {
 private predicate sink(ObjNode n) {
   exists(MethodAccess toString |
     toString.getQualifier() = n.asExpr() and
-    toString.getMethod().hasName("toString")
+    toString.getMethod() instanceof ToStringMethod
   ) and
   n.getTypeBound().getErasure() instanceof TypeObject
 }
diff --git a/java/ql/src/semmle/code/java/security/ControlledString.qll b/java/ql/src/semmle/code/java/security/ControlledString.qll
index c9f036b0ea69..3779c2c1009a 100644
--- a/java/ql/src/semmle/code/java/security/ControlledString.qll
+++ b/java/ql/src/semmle/code/java/security/ControlledString.qll
@@ -8,7 +8,8 @@ import semmle.code.java.Expr
 import semmle.code.java.security.Validation
 
 /**
- * Holds if `method` is a `toString()` method on a boxed type. These never return special characters.
+ * Holds if `method` is a `toString()` method on a boxed type, with or without parameters.
+ * These never return special characters.
  */
 private predicate boxedToString(Method method) {
   method.getDeclaringType() instanceof BoxedType and
@@ -44,11 +45,9 @@ private predicate controlledStringProp(Expr src, Expr dest) {
   exists(AddExpr concatOp | concatOp = dest | src = concatOp.getAnOperand())
   or
   // `toString()` on a safe string is safe.
-  exists(MethodAccess toStringCall, Method toString |
+  exists(MethodAccess toStringCall |
     src = toStringCall.getQualifier() and
-    toString = toStringCall.getMethod() and
-    toString.hasName("toString") and
-    toString.getNumberOfParameters() = 0 and
+    toStringCall.getMethod() instanceof ToStringMethod and
     dest = toStringCall
   )
 }

From d90527bead69c90f6a2f2ce12bce0cd82dd44ebd Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Sat, 10 Apr 2021 10:33:21 +0800
Subject: [PATCH 180/433] JsonpInjectionExpr updated to JsonpBuilderExpr

---
 .../Security/CWE/CWE-352/JsonpInjectionLib.qll            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 589a565c590f..380087cdd05e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -99,7 +99,7 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
 
 /** A concatenate expression using `(` and `)` or `);`. */
 class JsonpBuilderExpr extends AddExpr {
-  JsonpInjectionExpr() {
+  JsonpBuilderExpr() {
     getRightOperand().toString().regexpMatch("\"\\);?\"") and
     getLeftOperand()
         .(AddExpr)
@@ -126,7 +126,7 @@ class RemoteFlowConfig extends DataFlow2::Configuration {
   override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(JsonpInjectionExpr jhe | jhe.getFunctionName() = sink.asExpr())
+    exists(JsonpBuilderExpr jhe | jhe.getFunctionName() = sink.asExpr())
   }
 }
 
@@ -137,7 +137,7 @@ class JsonDataFlowConfig extends DataFlow2::Configuration {
   override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(JsonpInjectionExpr jhe | jhe.getJsonExpr() = sink.asExpr())
+    exists(JsonpBuilderExpr jhe | jhe.getJsonExpr() = sink.asExpr())
   }
 }
 
@@ -146,7 +146,7 @@ class JsonpInjectionFlowConfig extends TaintTracking::Configuration {
   JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) {
-    exists(JsonpInjectionExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
+    exists(JsonpBuilderExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
       jhe = src.asExpr() and
       jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
       rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))

From 10be2735ec49bf10b451858863247229608e7a1e Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Sat, 10 Apr 2021 12:12:18 +0000
Subject: [PATCH 181/433] Python: Get rid of `_attr` predicates

Also changes all `CfgNode`s representing calls to `CallCfgNode`s.
---
 .../src/semmle/python/frameworks/Stdlib.qll   | 158 ++++--------------
 1 file changed, 32 insertions(+), 126 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 1941f0c4d5bf..326ae8b647ca 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -19,31 +19,15 @@ private module Stdlib {
   /** Gets a reference to the `os` module. */
   API::Node os() { result = API::moduleImport("os") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `os` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `"system"` will get all uses of `os.system`.
-   */
-  private API::Node os_attr(string attr_name) { result = os().getMember(attr_name) }
-
   /** Provides models for the `os` module. */
   module os {
     /** Gets a reference to the `os.path` module. */
-    API::Node path() { result = os_attr("path") }
+    API::Node path() { result = os().getMember("path") }
 
     /** Provides models for the `os.path` module */
     module path {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `os.path` module.
-       * WARNING: Only holds for a few predefined attributes.
-       *
-       * For example, using `attr_name = "join"` will get all uses of `os.path.join`.
-       */
-      API::Node path_attr(string attr_name) { result = path().getMember(attr_name) }
-
       /** Gets a reference to the `os.path.join` function. */
-      API::Node join() { result = path_attr("join") }
+      API::Node join() { result = path().getMember("join") }
     }
   }
 
@@ -52,7 +36,7 @@ private module Stdlib {
    * See https://docs.python.org/3/library/os.path.html#os.path.normpath
    */
   private class OsPathNormpathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
-    OsPathNormpathCall() { this = os::path::path_attr("normpath").getACall() }
+    OsPathNormpathCall() { this = os::path().getMember("normpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -73,10 +57,8 @@ private module Stdlib {
    * A call to `os.path.abspath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.abspath
    */
-  private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathAbspathCall() { this = os::path::path_attr("abspath").getACall() }
+  private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathAbspathCall() { this = os::path().getMember("abspath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -97,10 +79,8 @@ private module Stdlib {
    * A call to `os.path.realpath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.realpath
    */
-  private class OsPathRealpathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathRealpathCall() { this = os::path::path_attr("realpath").getACall() }
+  private class OsPathRealpathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathRealpathCall() { this = os::path().getMember("realpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -121,10 +101,8 @@ private module Stdlib {
    * A call to `os.system`.
    * See https://docs.python.org/3/library/os.html#os.system
    */
-  private class OsSystemCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsSystemCall() { this = os_attr("system").getACall() }
+  private class OsSystemCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    OsSystemCall() { this = os().getMember("system").getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -137,13 +115,12 @@ private module Stdlib {
    * Although deprecated since version 2.6, they still work in 2.7.
    * See https://docs.python.org/2.7/library/os.html#os.popen2
    */
-  private class OsPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class OsPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     string name;
 
     OsPopenCall() {
       name in ["popen", "popen2", "popen3", "popen4"] and
-      this = os_attr(name).getACall()
+      this = os().getMember(name).getACall()
     }
 
     override DataFlow::Node getCommand() {
@@ -158,13 +135,11 @@ private module Stdlib {
    * A call to any of the `os.exec*` functions
    * See https://docs.python.org/3.8/library/os.html#os.execl
    */
-  private class OsExecCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class OsExecCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     OsExecCall() {
       exists(string name |
         name in ["execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe"] and
-        this = os_attr(name).getACall()
+        this = os().getMember(name).getACall()
       )
     }
 
@@ -175,15 +150,13 @@ private module Stdlib {
    * A call to any of the `os.spawn*` functions
    * See https://docs.python.org/3.8/library/os.html#os.spawnl
    */
-  private class OsSpawnCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class OsSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     OsSpawnCall() {
       exists(string name |
         name in [
             "spawnl", "spawnle", "spawnlp", "spawnlpe", "spawnv", "spawnve", "spawnvp", "spawnvpe"
           ] and
-        this = os_attr(name).getACall()
+        this = os().getMember(name).getACall()
       )
     }
 
@@ -194,10 +167,8 @@ private module Stdlib {
    * A call to any of the `os.posix_spawn*` functions
    * See https://docs.python.org/3.8/library/os.html#os.posix_spawn
    */
-  private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPosixSpawnCall() { this = os_attr(["posix_spawn", "posix_spawnp"]).getACall() }
+  private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    OsPosixSpawnCall() { this = os().getMember(["posix_spawn", "posix_spawnp"]).getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -218,29 +189,17 @@ private module Stdlib {
   // subprocess
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `subprocess` module. */
-  deprecated DataFlow::Node subprocess() { result = API::moduleImport("subprocess").getAUse() }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `subprocess` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "Popen"` will get all uses of `subprocess.Popen`.
-   */
-  private DataFlow::Node subprocess_attr(string attr_name) {
-    result = API::moduleImport("subprocess").getMember(attr_name).getAUse()
-  }
+  API::Node subprocess() { result = API::moduleImport("subprocess") }
 
   /**
    * A call to `subprocess.Popen` or helper functions (call, check_call, check_output, run)
    * See https://docs.python.org/3.8/library/subprocess.html#subprocess.Popen
    */
-  private class SubprocessPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class SubprocessPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     SubprocessPopenCall() {
       exists(string name |
         name in ["Popen", "call", "check_call", "check_output", "run"] and
-        node.getFunction() = subprocess_attr(name).asCfgNode()
+        this = subprocess().getMember(name).getACall()
       )
     }
 
@@ -311,17 +270,6 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // marshal
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `marshal` module. */
-  deprecated DataFlow::Node marshal() { result = API::moduleImport("marshal").getAUse() }
-
-  /** Provides models for the `marshal` module. */
-  module marshal {
-    /** Gets a reference to the `marshal.loads` function. */
-    deprecated DataFlow::Node loads() {
-      result = API::moduleImport("marshal").getMember("loads").getAUse()
-    }
-  }
-
   /**
    * A call to `marshal.loads`
    * See https://docs.python.org/3/library/marshal.html#marshal.loads
@@ -342,9 +290,7 @@ private module Stdlib {
   // pickle
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `pickle` module. */
-  DataFlow::Node pickle() {
-    result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse()
-  }
+  DataFlow::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse() }
 
   /** Provides models for the `pickle` module. */
   module pickle {
@@ -376,25 +322,15 @@ private module Stdlib {
   /** Gets a reference to the `popen2` module (only available in Python 2). */
   API::Node popen2() { result = API::moduleImport("popen2") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `popen2` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node popen2_attr(string attr_name) {
-    result = API::moduleImport("popen2").getMember(attr_name)
-  }
-
   /**
    * A call to any of the `popen.popen*` functions, or instantiation of a `popen.Popen*` class.
    * See https://docs.python.org/2.7/library/popen2.html
    */
-  private class Popen2PopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class Popen2PopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     Popen2PopenCall() {
       exists(string name |
         name in ["popen2", "popen3", "popen4", "Popen3", "Popen4"] and
-        this = popen2_attr(name).getACall()
+        this = popen2().getMember(name).getACall()
       )
     }
 
@@ -409,18 +345,12 @@ private module Stdlib {
   /** Gets a reference to the `platform` module. */
   API::Node platform() { result = API::moduleImport("platform") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `platform` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node platform_attr(string attr_name) { result = platform().getMember(attr_name) }
-
   /**
    * A call to the `platform.popen` function.
    * See https://docs.python.org/2.7/library/platform.html#platform.popen
    */
   private class PlatformPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
-    PlatformPopenCall() { this = platform_attr("popen").getACall() }
+    PlatformPopenCall() { this = platform().getMember("popen").getACall() }
 
     override DataFlow::Node getCommand() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("cmd")]
@@ -500,12 +430,6 @@ private module Stdlib {
   /** Gets a reference to the `base64` module. */
   API::Node base64() { result = API::moduleImport("base64") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `base64` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node base64_attr(string attr_name) { result = base64().getMember(attr_name) }
-
   /** A call to any of the encode functions in the `base64` module. */
   private class Base64EncodeCall extends Encoding::Range, DataFlow::CallCfgNode {
     string name;
@@ -515,7 +439,7 @@ private module Stdlib {
           "b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
           "encodestring", "a85encode", "b85encode", "encodebytes"
         ] and
-      this = base64_attr(name).getACall()
+      this = base64().getMember(name).getACall()
     }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
@@ -547,7 +471,7 @@ private module Stdlib {
           "b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
           "decodestring", "a85decode", "b85decode", "decodebytes"
         ] and
-      this = base64_attr(name).getACall()
+      this = base64().getMember(name).getACall()
     }
 
     override predicate mayExecuteInput() { none() }
@@ -578,18 +502,12 @@ private module Stdlib {
   /** Gets a reference to the `json` module. */
   API::Node json() { result = API::moduleImport("json") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `json` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node json_attr(string attr_name) { result = json().getMember(attr_name) }
-
   /**
    * A call to `json.loads`
    * See https://docs.python.org/3/library/json.html#json.loads
    */
   private class JsonLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
-    JsonLoadsCall() { this = json_attr("loads").getACall() }
+    JsonLoadsCall() { this = json().getMember("loads").getACall() }
 
     override predicate mayExecuteInput() { none() }
 
@@ -605,7 +523,7 @@ private module Stdlib {
    * See https://docs.python.org/3/library/json.html#json.dumps
    */
   private class JsonDumpsCall extends Encoding::Range, DataFlow::CallCfgNode {
-    JsonDumpsCall() { this = json_attr("dumps").getACall() }
+    JsonDumpsCall() { this = json().getMember("dumps").getACall() }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
 
@@ -799,28 +717,16 @@ private module Stdlib {
   /** Gets a reference to the `http` module. */
   API::Node http() { result = API::moduleImport("http") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `http` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node http_attr(string attr_name) { result = http().getMember(attr_name) }
-
   /** Provides models for the `http` module. */
   module http {
     // -------------------------------------------------------------------------
     // http.server
     // -------------------------------------------------------------------------
     /** Gets a reference to the `http.server` module. */
-    API::Node server() { result = http_attr("server") }
+    API::Node server() { result = http().getMember("server") }
 
     /** Provides models for the `http.server` module */
     module server {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `http.server` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node server_attr(string attr_name) { result = server().getMember(attr_name) }
-
       /**
        * Provides models for the `http.server.BaseHTTPRequestHandler` class (Python 3 only).
        *
@@ -828,7 +734,7 @@ private module Stdlib {
        */
       module BaseHTTPRequestHandler {
         /** Gets a reference to the `http.server.BaseHTTPRequestHandler` class. */
-        API::Node classRef() { result = server_attr("BaseHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("BaseHTTPRequestHandler") }
       }
 
       /**
@@ -838,7 +744,7 @@ private module Stdlib {
        */
       module SimpleHTTPRequestHandler {
         /** Gets a reference to the `http.server.SimpleHTTPRequestHandler` class. */
-        API::Node classRef() { result = server_attr("SimpleHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("SimpleHTTPRequestHandler") }
       }
 
       /**
@@ -848,7 +754,7 @@ private module Stdlib {
        */
       module CGIHTTPRequestHandler {
         /** Gets a reference to the `http.server.CGIHTTPRequestHandler` class. */
-        API::Node classRef() { result = server_attr("CGIHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("CGIHTTPRequestHandler") }
       }
     }
   }

From 17d1c77a144bd2dff785bdd9950f9668b3d1f7ab Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 08:14:17 +0300
Subject: [PATCH 182/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.ql

---
 .../InsufficientControlFlowManagementAfterRefactoringTheCode.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
index 6b9639fe8b9b..fa8780d6e450 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
@@ -44,7 +44,7 @@ class UsingWhileAfterWhile extends WhileStmt {
 }
 
 /**
- * Using arithmetic in comparison.
+ * Using arithmetic in a condition.
  */
 class UsingArithmeticInComparison extends BinaryArithmeticOperation {
   /**

From 3da88f2103406da69d287ef8880ca001e7efc084 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 08:15:36 +0300
Subject: [PATCH 183/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.c

---
 .../InsufficientControlFlowManagementAfterRefactoringTheCode.c  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
index 3ba47068244d..1f1f10b89cc5 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.c
@@ -10,7 +10,7 @@ while(flagsLoop)
   ...
   if(flagsIf) break;
   ...
-} // GOOD: coreten cycle
+} // GOOD: correct cycle
 ...
 if(intA+intB) return 1; // BAD: possibly no comparison
 ...

From 6924c6c51c4fd8235dab112580bd5c1faa40802f Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 08:23:06 +0300
Subject: [PATCH 184/433] Update test.c

---
 .../query-tests/Security/CWE/CWE-691/semmle/tests/test.c      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
index e2fccf587366..230b027b39b2 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -20,6 +20,10 @@ void workFunction_1(char *s) {
     if(intB - intA<10) break;
     intA--;
   }while(intA>0); // BAD
+  for(intA=100; intA>0; intA--)
+  {
+    if(intB - intA<10) break;
+  }while(intA>0); // BAD
   while(intA>0)
   {
     if(intB - intA<10) break;

From feb3a8deb10231e6e042da3d33dec445a251d3e4 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 08:23:41 +0300
Subject: [PATCH 185/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.expected

---
 ...fficientControlFlowManagementAfterRefactoringTheCode.expected | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
index cc1b5cf46d80..1eca77a526f1 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.expected
@@ -1,3 +1,4 @@
 | test.c:15:6:15:16 | ... + ... | this expression needs your attention |
 | test.c:17:17:17:27 | ... + ... | this expression needs your attention |
 | test.c:22:10:22:15 | ... > ... | this expression needs your attention |
+| test.c:26:10:26:15 | ... > ... | this expression needs your attention |

From 02d6de81a7e5e4cee907d5b67b7757e51178294e Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Mon, 12 Apr 2021 08:16:36 +0200
Subject: [PATCH 186/433] Apply suggestions from code review

Co-authored-by: Taus <tausbn@github.com>
---
 python/ql/src/Security/CWE-327/README.md           | 2 +-
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/README.md b/python/ql/src/Security/CWE-327/README.md
index 680ae56f4934..f80dfd0a2963 100644
--- a/python/ql/src/Security/CWE-327/README.md
+++ b/python/ql/src/Security/CWE-327/README.md
@@ -12,7 +12,7 @@ This should be kept up to date; the world is moving fast and protocols are being
 
 - `ssl.wrap_socket` is creating insecure connections, use `SSLContext.wrap_socket` instead. [link](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)
     > Deprecated since version 3.7: Since Python 3.2 and 2.7.9, it is recommended to use the `SSLContext.wrap_socket()` instead of `wrap_socket()`. The top-level function is limited and creates an insecure client socket without server name indication or hostname matching.
-- Default consteructors are fine, a fluent api is used to constrain possible protocols later.
+- Default constructors are fine, a fluent API is used to constrain possible protocols later.
 
 ## Current recomendation
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 82c251f3f810..dfbc989150bc 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -116,7 +116,7 @@ abstract class TlsLibrary extends string {
   }
 
   /** The creation of a context with an unspecific protocol version, say TLS, known to have insecure instances. */
-  DataFlow::CfgNode unspecific_context_creation(ProtocolFamily family) {
+  ContextCreation unspecific_context_creation(ProtocolFamily family) {
     result = default_context_creation()
     or
     result = specific_context_creation() and

From 036fddfdb53cdaf356422a9bdc277d024bd69ae1 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 12 Apr 2021 08:18:24 +0200
Subject: [PATCH 187/433] Python: `Namable` -> `Nameable`

---
 python/ql/src/Security/CWE-327/InsecureProtocol.ql | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 19f6acf5512c..e31bf78443b2 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -33,19 +33,19 @@ class ProtocolConfiguration extends DataFlow::Node {
 //
 // Note that AstNode is abstract and AstNode_ is a library class, so
 // we have to extend @py_ast_node.
-class Namable extends @py_ast_node {
-  Namable() {
+class Nameable extends @py_ast_node {
+  Nameable() {
     exists(ProtocolConfiguration protocolConfiguration |
       this = protocolConfiguration.asCfgNode().(CallNode).getFunction().getNode()
     )
     or
-    exists(Namable attr | this = attr.(Attribute).getObject())
+    exists(Nameable attr | this = attr.(Attribute).getObject())
   }
 
   string toString() { result = "AstNode" }
 }
 
-string callName(Namable call) {
+string callName(Nameable call) {
   result = call.(Name).getId()
   or
   exists(Attribute a | a = call | result = callName(a.getObject()) + "." + a.getName())

From 1b948ac2e2e44cc95d8340755f2d51bb8d4ec1c9 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Mon, 12 Apr 2021 15:44:39 +0800
Subject: [PATCH 188/433] Combine two Configurations into one

---
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  6 +--
 .../CWE/CWE-352/JsonpInjectionLib.qll         | 51 ++++++++-----------
 2 files changed, 23 insertions(+), 34 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index aa046e7cd2c6..a02891e8a566 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -16,7 +16,7 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.deadcode.WebEntryPoints
 import DataFlow::PathGraph
 
-/** 
+/**
  * Holds if some `Filter.doFilter` method exists in the whole program that takes some user-controlled
  * input and tests it with what appears to be a token- or authentication-checking function.
  */
@@ -28,7 +28,7 @@ predicate existsFilterVerificationMethod() {
   )
 }
 
-/** 
+/**
  * Holds if somewhere in the whole program some user-controlled
  * input is tested with what appears to be a token- or authentication-checking function,
  * and `checkNode` is reachable from any function that can reach the user-controlled input source.
@@ -69,4 +69,4 @@ where
   conf.hasFlowPath(source, sink) and
   exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
 select sink.getNode(), source, sink, "Jsonp response might include code from $@.", source.getNode(),
-  "this user input"
+  "this user input"
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 380087cdd05e..f0a1a9de81c8 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -7,31 +7,11 @@ import semmle.code.java.dataflow.DataFlow3
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
-/** A data flow configuration tracing flow from the result of a method whose name includes token/auth/referer/origin to an if-statement condition. */
-class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
-  VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) {
-    exists(MethodAccess ma | ma instanceof BarrierGuard |
-      (
-        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-        or
-        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-      ) and
-      ma = src.asExpr()
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(IfStmt is | is.getCondition() = sink.asExpr())
-  }
-}
-
-/** Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
-* 
-* For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
-* the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
-* and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
+/**
+ * Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
+ *
+ * For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
+ * the flow from `getHeader(...)` to the argument to `checkToken`, and then the flow from `checkToken`'s result to the condition of `if(isGood)`.
  */
 class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
@@ -39,16 +19,25 @@ class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma, int i, VerificationMethodToIfFlowConfig vmtifc |
-      ma instanceof BarrierGuard
-    |
+    exists(IfStmt is, Method m | is.getEnclosingCallable() = m |
       (
-        ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        not m.getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        or
+        not m.getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+      ) and
+      sink.asExpr() = is.getCondition()
+    )
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node prod, DataFlow::Node succ) {
+    exists(MethodAccess ma |
+      (
+        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
         or
         ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
       ) and
-      ma.getArgument(i) = sink.asExpr() and
-      vmtifc.hasFlow(exprNode(ma), _)
+      ma.getAnArgument() = prod.asExpr() and
+      ma = succ.asExpr()
     )
   }
 }

From 17c4bbbc4e80d5e4015593ef3c46347957e84c07 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 12 Apr 2021 09:57:40 +0200
Subject: [PATCH 189/433] allow parameters that end with "Command" in
 js/shell-command-constructed-from-input

---
 .../UnsafeShellCommandConstructionCustomizations.qll       | 7 ++++++-
 javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js | 5 +++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
index e38e2776bbcb..20b691684741 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -53,7 +53,12 @@ module UnsafeShellCommandConstruction {
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
     ExternalInputSource() {
       this = Exports::getALibraryInputParameter() and
-      not this.getName() = ["cmd", "command"] // looks to be on purpose.
+      not (
+        // looks to be on purpose.
+        this.getName() = ["cmd", "command"]
+        or
+        this.getName().regexpMatch(".*(Cmd|Command)$") // ends with "Cmd" or "Command"
+      )
     }
   }
 
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
index 9c848024fc5b..6b053d643660 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
@@ -483,4 +483,9 @@ module.exports.splitConcat = function (name) {
 	let args = ' my name is ' + name; // NOT OK
 	let cmd = 'echo';
 	cp.exec(cmd + args);
+}
+
+module.exports.myCommand = function (myCommand) {
+	let cmd = `cd ${cwd} ; ${myCommand}`; // OK - the parameter name suggests that it is purposely a shell command.
+	cp.exec(cmd);
 }
\ No newline at end of file

From 9f91dde76fb55ecea5b6fdbb81d3e837f7dfa4e7 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 12 Apr 2021 09:58:06 +0200
Subject: [PATCH 190/433] Python: Update test expectation after comment

---
 .../CWE-327/InsecureProtocol.expected         | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
index 57b19cef0b17..359a8d28ba1a 100644
--- a/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
@@ -22,18 +22,18 @@
 | ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:28:14:28:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:24:15:24:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
 | ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:33:15:33:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:55:14:55:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:52:15:52:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:99:15:99:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:99:15:99:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:115:5:115:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:69:14:69:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:133:5:133:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:75:14:75:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:60:12:60:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
-| ssl_fluent.py:95:14:95:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:93:5:93:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:144:14:144:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:141:5:141:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:160:5:160:11 | ControlFlowNode for context | context modification |
-| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:159:15:159:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
-| ssl_fluent.py:163:14:163:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:159:15:159:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:57:14:57:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:54:15:54:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:57:14:57:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:54:15:54:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:101:15:101:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:101:15:101:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:117:5:117:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:135:5:135:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
+| ssl_fluent.py:97:14:97:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:95:5:95:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:146:14:146:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:143:5:143:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@  | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
+| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@  | ssl_fluent.py:161:15:161:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
+| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@  | ssl_fluent.py:161:15:161:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |

From 3ff8e010b292598e7422f294907d950e9bfb6ad2 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 12 Apr 2021 10:00:07 +0200
Subject: [PATCH 191/433] Python: Refactor based on review - more natural
 handling of default arguments - do not assume default construction gives a
 family - simplifies `UnspecificSSLContextCreation`

---
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  |  8 ++++--
 python/ql/src/Security/CWE-327/Ssl.qll        | 25 ++++++++++---------
 .../src/Security/CWE-327/TlsLibraryModel.qll  | 22 ++++++++--------
 3 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index d2cfb74b3ab9..55b77386f2f8 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -9,8 +9,12 @@ class PyOpenSSLContextCreation extends ContextCreation {
     this = API::moduleImport("OpenSSL").getMember("SSL").getMember("Context").getACall()
   }
 
-  override DataFlow::CfgNode getProtocol() {
-    result.getNode() in [node.getArg(0), node.getArgByName("method")]
+  override string getProtocol() {
+    exists(ControlFlowNode protocolArg, PyOpenSSL pyo |
+      protocolArg in [node.getArg(0), node.getArgByName("method")]
+    |
+      protocolArg = [pyo.specific_version(result), pyo.unspecific_version(result)].asCfgNode()
+    )
   }
 }
 
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 2ca7dcce1f90..cb19fb8f11ff 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -7,8 +7,15 @@ class SSLContextCreation extends ContextCreation {
 
   SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
 
-  override DataFlow::CfgNode getProtocol() {
-    result.getNode() in [node.getArg(0), node.getArgByName("protocol")]
+  override string getProtocol() {
+    exists(ControlFlowNode protocolArg, Ssl ssl |
+      protocolArg in [node.getArg(0), node.getArgByName("protocol")]
+    |
+      protocolArg = [ssl.specific_version(result), ssl.unspecific_version(result)].asCfgNode()
+    )
+    or
+    not exists(node.getAnArg()) and
+    result = "TLS"
   }
 }
 
@@ -19,7 +26,7 @@ class SSLDefaultContextCreation extends ContextCreation {
 
   // Allowed insecure versions are "TLSv1" and "TLSv1_1"
   // see https://docs.python.org/3/library/ssl.html#context-creation
-  override DataFlow::CfgNode getProtocol() { none() }
+  override string getProtocol() { result = "TLS" }
 }
 
 /** Gets a reference to an `ssl.Context` instance. */
@@ -141,17 +148,10 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
   UnspecificSSLContextCreation() { library = "ssl" }
 
   override ProtocolVersion getUnrestriction() {
-    // Case: A protocol argument is present.
     result = UnspecificContextCreation.super.getUnrestriction() and
     // These are turned off by default
     // see https://docs.python.org/3/library/ssl.html#ssl-contexts
     not result in ["SSLv2", "SSLv3"]
-    or
-    // Case: No protocol arguemnt is present.
-    not exists(this.getProtocol()) and
-    // The default argument is TLS and the SSL versions are turned off by default since Python 3.6
-    // see https://docs.python.org/3.6/library/ssl.html#ssl.SSLContext
-    result in ["TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
   }
 }
 
@@ -185,8 +185,9 @@ class Ssl extends TlsLibrary {
 
   override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) {
     result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
-    insecure_version(version).asCfgNode() =
-      result.asCfgNode().(CallNode).getArgByName("ssl_version")
+    specific_version(version).asCfgNode() =
+      result.asCfgNode().(CallNode).getArgByName("ssl_version") and
+    version.isInsecure()
   }
 
   override ConnectionCreation connection_creation() { result instanceof WrapSocketCall }
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index dfbc989150bc..685485004b25 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -30,8 +30,8 @@ class ProtocolFamily extends string {
 
 /** The creation of a context. */
 abstract class ContextCreation extends DataFlow::CfgNode {
-  /** Gets the requested protocol if any. */
-  abstract DataFlow::CfgNode getProtocol();
+  /** Gets the protocol version or family for this context. */
+  abstract string getProtocol();
 }
 
 /** The creation of a connection from a context. */
@@ -66,7 +66,7 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
   TlsLibrary library;
   ProtocolFamily family;
 
-  UnspecificContextCreation() { this.getProtocol() = library.unspecific_version(family) }
+  UnspecificContextCreation() { this.getProtocol() = family }
 
   override DataFlow::CfgNode getContext() { result = this }
 
@@ -92,9 +92,8 @@ abstract class TlsLibrary extends string {
   /** The module or class holding the version constants. */
   abstract API::Node version_constants();
 
-  /** A dataflow node representing a specific protocol version, known to be insecure. */
-  DataFlow::Node insecure_version(ProtocolVersion version) {
-    version.isInsecure() and
+  /** A dataflow node representing a specific protocol version. */
+  DataFlow::Node specific_version(ProtocolVersion version) {
     result = version_constants().getMember(specific_version_name(version)).getAUse()
   }
 
@@ -111,16 +110,15 @@ abstract class TlsLibrary extends string {
 
   /** The creation of a context with a specific protocol version, known to be insecure. */
   ContextCreation insecure_context_creation(ProtocolVersion version) {
-    result = specific_context_creation() and
-    result.getProtocol() = insecure_version(version)
+    result in [specific_context_creation(), default_context_creation()] and
+    result.getProtocol() = version and
+    version.isInsecure()
   }
 
   /** The creation of a context with an unspecific protocol version, say TLS, known to have insecure instances. */
   ContextCreation unspecific_context_creation(ProtocolFamily family) {
-    result = default_context_creation()
-    or
-    result = specific_context_creation() and
-    result.(ContextCreation).getProtocol() = unspecific_version(family)
+    result in [specific_context_creation(), default_context_creation()] and
+    result.getProtocol() = family
   }
 
   /** A connection is created in an insecure manner, not from a context. */

From 91d28fb8b0f3591207ece13ae88fddbd85477f18 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 19 Mar 2021 19:32:21 +0100
Subject: [PATCH 192/433] cleanup in API-graphs

---
 .../ql/src/semmle/javascript/ApiGraphs.qll    | 20 ++-----------------
 1 file changed, 2 insertions(+), 18 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index a363e472e15d..96e2e93fa0b2 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -374,15 +374,13 @@ module API {
             exists(SSA::implicitInit([nm.getModuleVariable(), nm.getExportsVariable()]))
           )
         )
-        or
-        m = any(CanonicalName n | isDefined(n)).getExternalModuleName()
       } or
       MkModuleImport(string m) {
         imports(_, m)
         or
-        m = any(CanonicalName n | isUsed(n)).getExternalModuleName()
-        or
         any(TypeAnnotation n).hasQualifiedName(m, _)
+        or
+        any(Type t).hasUnderlyingType(m, _)
       } or
       MkClassInstance(DataFlow::ClassNode cls) { cls = trackDefNode(_) and hasSemantics(cls) } or
       MkAsyncFuncResult(DataFlow::FunctionNode f) {
@@ -431,20 +429,6 @@ module API {
       )
     }
 
-    private predicate isUsed(CanonicalName n) {
-      exists(n.(TypeName).getAnAccess()) or
-      exists(n.(Namespace).getAnAccess())
-    }
-
-    private predicate isDefined(CanonicalName n) {
-      exists(ASTNode def |
-        def = n.(TypeName).getADefinition() or
-        def = n.(Namespace).getADefinition()
-      |
-        not def.isAmbient()
-      )
-    }
-
     /**
      * Holds if `rhs` is the right-hand side of a definition of a node that should have an
      * incoming edge from `base` labeled `lbl` in the API graph.

From cd57e61f658c6ada8043145d65d5b8b3fe53c901 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Mon, 22 Mar 2021 15:21:30 +0000
Subject: [PATCH 193/433] Rename `MkHasUnderlyingType` to `MkTypeUse`.

---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 96e2e93fa0b2..c0d28d913f70 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -313,7 +313,7 @@ module API {
   module Node {
     /** Gets a node whose type has the given qualified name. */
     Node ofType(string moduleName, string exportedName) {
-      result = Impl::MkHasUnderlyingType(moduleName, exportedName).(Node).getInstance()
+      result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
     }
   }
 
@@ -388,11 +388,8 @@ module API {
       } or
       MkDef(DataFlow::Node nd) { rhs(_, _, nd) } or
       MkUse(DataFlow::Node nd) { use(_, _, nd) } or
-      /**
-       * A TypeScript type, identified by name of the type-annotation.
-       * This API node is exclusively used by `API::Node::ofType`.
-       */
-      MkHasUnderlyingType(string moduleName, string exportName) {
+      /** A use of a TypeScript type. */
+      MkTypeUse(string moduleName, string exportName) {
         any(TypeAnnotation n).hasQualifiedName(moduleName, exportName)
         or
         any(Type t).hasUnderlyingType(moduleName, exportName)
@@ -406,7 +403,7 @@ module API {
     class TNonModuleDef =
       MkModuleExport or MkClassInstance or MkAsyncFuncResult or MkDef or MkSyntheticCallbackArg;
 
-    class TUse = MkModuleUse or MkModuleImport or MkUse or MkHasUnderlyingType;
+    class TUse = MkModuleUse or MkModuleImport or MkUse or MkTypeUse;
 
     private predicate hasSemantics(DataFlow::Node nd) { not nd.getTopLevel().isExterns() }
 
@@ -584,7 +581,7 @@ module API {
         )
         or
         exists(string moduleName, string exportName |
-          base = MkHasUnderlyingType(moduleName, exportName) and
+          base = MkTypeUse(moduleName, exportName) and
           lbl = Label::instance() and
           ref.(DataFlow::SourceNode).hasUnderlyingType(moduleName, exportName)
         )
@@ -823,7 +820,7 @@ module API {
       exists(string moduleName, string exportName |
         pred = MkModuleImport(moduleName) and
         lbl = Label::member(exportName) and
-        succ = MkHasUnderlyingType(moduleName, exportName)
+        succ = MkTypeUse(moduleName, exportName)
       )
       or
       exists(DataFlow::Node nd, DataFlow::FunctionNode f |

From cf5f838b13c6f8aa6f7eb7a24eed1752cc4d1a6f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 12 Apr 2021 12:04:23 +0200
Subject: [PATCH 194/433] Data flow: Remove recommendation to use `unique` in
 `Node::getEnclosingCallable()`

---
 docs/ql-libraries/dataflow/dataflow.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/docs/ql-libraries/dataflow/dataflow.md b/docs/ql-libraries/dataflow/dataflow.md
index 3c46436a87a5..ea3379f3967b 100644
--- a/docs/ql-libraries/dataflow/dataflow.md
+++ b/docs/ql-libraries/dataflow/dataflow.md
@@ -98,10 +98,6 @@ Recommendations:
   also work, but the upside of `use-use` steps is that sources defined in terms
   of variable reads just work out of the box. It also makes certain
   barrier-implementations simpler.
-* A predicate `DataFlowCallable Node::getEnclosingCallable()` is required, and in
-  order to ensure appropriate join-orders, it is important that the QL compiler knows
-  that this predicate is functional. It can therefore be necessary to enclose the body
-  of this predicate in a `unique` aggregate.
 
 The shared library does not use `localFlowStep` nor `localFlow` but users of
 `DataFlow.qll` may expect the existence of `DataFlow::localFlowStep` and

From c7686b18388731b9a624b58bd36750863a672955 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 12 Apr 2021 13:01:14 +0200
Subject: [PATCH 195/433] C#: First try `pwsh` and then `powershell` when
 calling `dotnet-install.ps1`

---
 .../autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs  | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
index 8787406c104e..1b440aaa196c 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
@@ -209,8 +209,9 @@ public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certifi
                         var psScriptFile = builder.Actions.PathCombine(builder.Options.RootDirectory, "install-dotnet.ps1");
                         builder.Actions.WriteAllText(psScriptFile, psScript);
 
-                        var install = new CommandBuilder(builder.Actions).
-                            RunCommand("powershell").
+                        BuildScript GetInstall(string pwsh) =>
+                            new CommandBuilder(builder.Actions).
+                            RunCommand(pwsh).
                             Argument("-NoProfile").
                             Argument("-ExecutionPolicy").
                             Argument("unrestricted").
@@ -219,13 +220,14 @@ public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certifi
                             Argument("-Version").
                             Argument(version).
                             Argument("-InstallDir").
-                            Argument(path);
+                            Argument(path).
+                            Script;
 
                         var removeScript = new CommandBuilder(builder.Actions).
                             RunCommand("del").
                             Argument(psScriptFile);
 
-                        return install.Script & BuildScript.Try(removeScript.Script);
+                        return (GetInstall("pwsh") | GetInstall("powershell")) & BuildScript.Try(removeScript.Script);
                     }
                     else
                     {

From 5446532e1d7de60cb4f05045fc6f37e2f323221b Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 12 Apr 2021 14:01:55 +0200
Subject: [PATCH 196/433] C#: Update auto-builder tests

---
 .../BuildScripts.cs                           | 35 ++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
index 7b9f2e788811..f74e9829bc5b 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
@@ -981,7 +981,7 @@ public void TestDotnetVersionWindows()
         {
             actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
             actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
+            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
             actions.RunProcess[@"cmd.exe /C del C:\Project\install-dotnet.ps1"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
@@ -1008,6 +1008,39 @@ public void TestDotnetVersionWindows()
             TestAutobuilderScript(autobuilder, 0, 7);
         }
 
+        [Fact]
+        public void TestDotnetVersionWindowsNoPwsh()
+        {
+            actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
+            actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
+            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 1;
+            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
+            actions.RunProcess[@"cmd.exe /C del C:\Project\install-dotnet.ps1"] = 0;
+            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
+            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
+            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
+            actions.RunProcess[@"cmd.exe /C C:\odasa\tools\odasa index --auto C:\Project\.dotnet\dotnet build --no-incremental C:\Project\test.csproj"] = 0;
+            actions.FileExists["csharp.log"] = true;
+            actions.FileExists[@"C:\Project\test.csproj"] = true;
+            actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
+            actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_SOURCE_ARCHIVE_DIR"] = "";
+            actions.GetEnvironmentVariable["PATH"] = "/bin:/usr/bin";
+            actions.EnumerateFiles[@"C:\Project"] = "foo.cs\ntest.cs\ntest.csproj";
+            actions.EnumerateDirectories[@"C:\Project"] = "";
+            var xml = new XmlDocument();
+            xml.LoadXml(@"<Project Sdk=""Microsoft.NET.Sdk"">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>netcoreapp2.1</TargetFramework>
+  </PropertyGroup>
+
+</Project>");
+            actions.LoadXml[@"C:\Project\test.csproj"] = xml;
+
+            var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
+            TestAutobuilderScript(autobuilder, 0, 8);
+        }
+
         [Fact]
         public void TestDirsProjWindows()
         {

From b4d35b52c386072c1eb8561cf4e68cc87d292b87 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 2 Mar 2021 13:22:21 +0100
Subject: [PATCH 197/433] C#: Add Console.Read* to local flow sources

---
 .../csharp/security/dataflow/flowsources/Local.qll | 14 ++++++++++++++
 .../CWE-134/ConsoleUncontrolledFormatString.cs     | 13 +++++++++++++
 .../CWE-134/UncontrolledFormatString.expected      |  4 ++++
 3 files changed, 31 insertions(+)
 create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs

diff --git a/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
index e867c9be3ddc..b1b0bf8df850 100644
--- a/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
+++ b/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
@@ -20,3 +20,17 @@ class TextFieldSource extends LocalUserInputSource {
 
   override string getSourceType() { result = "TextBox text" }
 }
+
+/** A call to any `System.Console.Read*` method. */
+class SystemConsoleReadSource extends LocalUserInputSource {
+  SystemConsoleReadSource() {
+    this.asExpr() =
+      any(MethodCall call |
+        call.getTarget().hasQualifiedName("System.Console", "ReadLine") or
+        call.getTarget().hasQualifiedName("System.Console", "Read") or
+        call.getTarget().hasQualifiedName("System.Console", "ReadKey")
+      )
+  }
+
+  override string getSourceType() { result = "TextBox text" }
+}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs b/csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs
new file mode 100644
index 000000000000..c9d4440cf787
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-134/ConsoleUncontrolledFormatString.cs	
@@ -0,0 +1,13 @@
+using System;
+using System;
+
+public class Program
+{
+    public static void Main()
+    {
+        var format = Console.ReadLine();
+
+        // BAD: Uncontrolled format string.
+        var x = string.Format(format, 1, 2);
+    }
+}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected b/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected
index bc87c96b194b..4923cd34e70d 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-134/UncontrolledFormatString.expected	
@@ -1,8 +1,11 @@
 edges
+| ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format |
 | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path |
 | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path |
 | UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString : NameValueCollection | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format |
 nodes
+| ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
+| ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | semmle.label | access to local variable format |
 | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
 | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | semmle.label | access to local variable path |
 | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | semmle.label | access to local variable path |
@@ -10,6 +13,7 @@ nodes
 | UncontrolledFormatStringBad.cs:9:25:9:47 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
 | UncontrolledFormatStringBad.cs:12:39:12:44 | access to local variable format | semmle.label | access to local variable format |
 #select
+| ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine : String | ConsoleUncontrolledFormatString.cs:11:31:11:36 | access to local variable format | $@ flows to here and is used as a format string. | ConsoleUncontrolledFormatString.cs:8:22:8:39 | call to method ReadLine | call to method ReadLine |
 | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:14:23:14:26 | access to local variable path | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
 | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString : NameValueCollection | UncontrolledFormatString.cs:17:46:17:49 | access to local variable path | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:11:23:11:45 | access to property QueryString | access to property QueryString |
 | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | $@ flows to here and is used as a format string. | UncontrolledFormatString.cs:34:23:34:31 | access to property Text | access to property Text |

From 57016ddbde804691b73bb62519bd6884a2a76d51 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 8 Apr 2021 10:10:41 +0200
Subject: [PATCH 198/433] C++: Remove `unique` wrapper from
 `DataFlow::Node::getEnclosingCallable()`

---
 .../src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 0a6d459ec79b..c644c3dd2689 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -46,7 +46,7 @@ class Node extends TNode {
   /**
    * INTERNAL: Do not use. Alternative name for `getFunction`.
    */
-  final Function getEnclosingCallable() { result = unique(Function f | f = this.getFunction() | f) }
+  final Function getEnclosingCallable() { result = this.getFunction() }
 
   /** Gets the type of this node. */
   Type getType() { none() } // overridden in subclasses
@@ -715,6 +715,7 @@ private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
 }
 
 private module FieldFlow {
+  private import DataFlowImplCommon
   private import DataFlowImplLocal
   private import DataFlowPrivate
 
@@ -747,7 +748,7 @@ private module FieldFlow {
     exists(FieldConfiguration cfg | cfg.hasFlow(node1, node2)) and
     // This configuration should not be able to cross function boundaries, but
     // we double-check here just to be sure.
-    node1.getEnclosingCallable() = node2.getEnclosingCallable()
+    getNodeEnclosingCallable(node1) = getNodeEnclosingCallable(node2)
   }
 }
 

From c281e54d22038c0d3dc28b6b344da4c954aa7747 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Mon, 12 Apr 2021 13:05:01 +0000
Subject: [PATCH 199/433] Remove unused files and update qldoc

---
 .../CWE-555/CredentialsInPropertiesFile.ql    | 18 +------
 .../security/CWE-555/MailConfig.java          | 11 -----
 .../security/CWE-555/PropertiesUtils.java     | 47 -------------------
 .../query-tests/security/CWE-555/options      |  1 -
 .../beans/factory/annotation/Value.java       | 11 -----
 5 files changed, 2 insertions(+), 86 deletions(-)
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-555/options
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java

diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
index f085317218c0..d72743f37998 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
@@ -1,20 +1,6 @@
-/**
- * @name Cleartext Credentials in Properties File
- * @description Finds cleartext credentials in Java properties files.
- * @kind problem
- * @id java/credentials-in-properties
- * @tags security
- *       external/cwe/cwe-555
- *       external/cwe/cwe-256
- *       external/cwe/cwe-260
- */
-
 /*
- * Note this query requires properties files to be indexed before it can produce results.
- * If creating your own database with the CodeQL CLI, you should run
- * `codeql database index-files --language=properties ...`
- * If using lgtm.com, you should add `properties_files: true` to the index block of your
- * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction#customizing-index)
+ * Note this is similar to src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
+ * except we do not filter out test files.
  */
 
 import java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java b/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
deleted file mode 100644
index bef99dac3ea7..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-555/MailConfig.java
+++ /dev/null
@@ -1,11 +0,0 @@
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.annotation.Configuration;
-
-@Configuration
-public class MailConfig {
-    @Value("${mail.password}")
-    private String mailPassword;
-
-    @Value("${mail.username}")
-    private String mailUserName;
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java b/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
deleted file mode 100644
index f33ef39ee077..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-555/PropertiesUtils.java
+++ /dev/null
@@ -1,47 +0,0 @@
-import java.io.IOException;
-import java.util.Properties;
-
-public class PropertiesUtils {
-	/* Properties declaration. */ 
-	private static Properties properties;  
-
-    /** Static block to initializing the properties. */
-	static {
-		properties = new Properties();
-		try {
-			properties.load(PropertiesUtils.class.getClassLoader().getResourceAsStream("configuration.properties"));
-		} catch (IOException e) {
-			e.printStackTrace();
-		}
-	}
-
-	/** Returns the LDAP DN property value. */
-	public static String getLdapDN() {
-		return properties.getProperty("ldap.loginDN");
-	}
-    
-	/** Returns the LDAP password property value. */
-	public static String getLdapPassword() {
-		return properties.getProperty("ldap.password");
-	}
-
-	/** Returns the SQL Server username property value. */
-	public static String getMSDataSourceUserName() {
-		return properties.getProperty("datasource1.username");
-	}
-
-	/** Returns the SQL Server password property value. */
-	public static String getMSDataSourcePassword() {
-		return properties.getProperty("datasource1.password");
-	}
-    
-	/** Returns the AWS Access Key property value. */
-	public static String getAWSAccessKey() {
-		return properties.getProperty("com.example.aws.s3.access_key");
-	}
-
-	/** Returns the AWS Secret Key property value. */
-	public static String getAWSSecretKey() {
-		return properties.getProperty("com.example.aws.s3.secret_key");
-	}
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/options b/java/ql/test/experimental/query-tests/security/CWE-555/options
deleted file mode 100644
index cf3d60de0e5c..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-555/options
+++ /dev/null
@@ -1 +0,0 @@
-// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java
deleted file mode 100644
index 67c38cf5d20b..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/factory/annotation/Value.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.springframework.beans.factory.annotation;
-
-public @interface Value {
-
-	/**
-	 * The actual value expression such as <code>#{systemProperties.myProp}</code>
-	 * or property placeholder such as <code>${my.app.myProp}</code>.
-	 */
-	String value();
-
-}
\ No newline at end of file

From 172d6139e206969bb2b3030910cae5bd3a19ed34 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 12 Apr 2021 15:06:10 +0200
Subject: [PATCH 200/433] support all ClientRequests in
 js/disabling-certificate-validation

---
 .../CWE-295/DisablingCertificateValidation.ql |  2 +-
 .../DisablingCertificateValidation.expected   |  1 +
 .../test/query-tests/Security/CWE-295/tst2.js | 24 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-295/tst2.js

diff --git a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
index 6855ec2519db..f18ff4a3535e 100644
--- a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
+++ b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
@@ -16,7 +16,7 @@ import javascript
  */
 DataFlow::ObjectLiteralNode tlsOptions() {
   exists(DataFlow::InvokeNode invk | result.flowsTo(invk.getAnArgument()) |
-    invk instanceof NodeJSLib::NodeJSClientRequest
+    invk instanceof ClientRequest
     or
     invk = DataFlow::moduleMember("https", "Agent").getAnInstantiation()
     or
diff --git a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
index d028c5b3b30b..9b21e2f5d8bd 100644
--- a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
@@ -1,3 +1,4 @@
+| tst2.js:8:5:8:29 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
 | tst.js:15:3:15:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
 | tst.js:18:1:18:40 | process ... HORIZED | Disabling certificate validation is strongly discouraged. |
 | tst.js:21:3:21:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
diff --git a/javascript/ql/test/query-tests/Security/CWE-295/tst2.js b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js
new file mode 100644
index 000000000000..50f5ae277146
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js
@@ -0,0 +1,24 @@
+const request = require('request');
+
+let requestOptions = {
+    headers: {
+        "content-type": "application/json",
+        "accept": "application/json"
+    },
+    rejectUnauthorized: false,
+    requestCert: true,
+    agent: false
+}
+
+module.exports.post = (url, requestBody, apiContext) => {
+    Object.assign(requestOptions, {
+        body: JSON.stringify(requestBody),
+        headers : Object.assign(requestOptions.headers, apiContext)
+    })
+
+    return request.post(url, requestOptions).then((res) => {
+        return Promise.resolve(res.body);
+    }).catch((err) => {
+        return Promise.resolve(err);
+    })
+}
\ No newline at end of file

From 32737a17fb64fb1b4f57b8a4b65398607da39d30 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 12 Apr 2021 15:09:13 +0200
Subject: [PATCH 201/433] add change note

---
 .../change-notes/2021-04-12-disabling-certificate-validation.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 javascript/change-notes/2021-04-12-disabling-certificate-validation.md

diff --git a/javascript/change-notes/2021-04-12-disabling-certificate-validation.md b/javascript/change-notes/2021-04-12-disabling-certificate-validation.md
new file mode 100644
index 000000000000..e289c5f7276c
--- /dev/null
+++ b/javascript/change-notes/2021-04-12-disabling-certificate-validation.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The query "Disabling certificate validation" (`js/disabling-certificate-validation`) has been improved to recognize many more request libraries.

From 11bf9827289b1103ead2af9f3d7c0ccc30e235c1 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Mon, 12 Apr 2021 14:36:42 +0100
Subject: [PATCH 202/433] Remove superfluous linebreaks in qhelp file

---
 .../Security/CWE/CWE-094/InsecureDexLoading.qhelp           | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
index 4a5555c1390c..216bdeaebf38 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
@@ -32,13 +32,11 @@ which when loaded by the app can lead to code execution.
   <references>
     <li>
       Android Documentation:
-      <a href="https://developer.android.com/training/data-storage/">Data and file storage overview</a>
-      .
+      <a href="https://developer.android.com/training/data-storage/">Data and file storage overview</a>.
     </li>
     <li>
       Android Documentation:
-      <a href="https://developer.android.com/reference/dalvik/system/DexClassLoader">DexClassLoader</a>
-      .
+      <a href="https://developer.android.com/reference/dalvik/system/DexClassLoader">DexClassLoader</a>.
     </li>
   </references>
 </qhelp>

From d7c14775bf607f92ca473d34c79bbc540b8defbc Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 16:56:48 +0300
Subject: [PATCH 203/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp

---
 ...sufficientControlFlowManagementAfterRefactoringTheCode.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
index 2c485dfd0cf4..4167ce57d65e 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.qhelp
@@ -3,7 +3,7 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>In some situations, after code refactoring, parts of the old constructs may remain. They are correctly accepted by the compiler, but can critically affect program execution. For example, if you switch from `do {...} while ();` to `while () {...}` with errors, you run the risk of running out of resources. These code snippets look suspicious and require the developer's attention.</p>
+<p>In some situations, after code refactoring, parts of the old constructs may remain. They are correctly accepted by the compiler, but can critically affect program execution. For example, if you switch from `do {...} while ();` to `while () {...}` forgetting to remove the old construct completely, you get `while(){...}while();` which may be vulnerable. These code snippets look suspicious and require the developer's attention.</p>
 
 
 </overview>

From 58d5ad48d56fb7556b4aae4dd8e9a97946532bf8 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 17:00:34 +0300
Subject: [PATCH 204/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.ql

---
 ...nsufficientControlFlowManagementAfterRefactoringTheCode.ql | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
index fa8780d6e450..dc5b2225a623 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
@@ -105,7 +105,7 @@ class UsingArithmeticInComparison extends BinaryArithmeticOperation {
   }
 }
 
-from Expr exp, WhileStmt wst
+from Expr exp
 where
   exp instanceof UsingArithmeticInComparison and
   not exp.(UsingArithmeticInComparison).workingWithValue() and
@@ -114,5 +114,5 @@ where
   not exp.(UsingArithmeticInComparison).compareWithZero() and
   exp.(UsingArithmeticInComparison).compareWithOutZero()
   or
-  wst instanceof UsingWhileAfterWhile and exp = wst.getCondition()
+  exists(WhileStmt wst | wst instanceof UsingWhileAfterWhile and exp = wst.getCondition())
 select exp, "this expression needs your attention"

From 5aeaab7c6d7ff786c970b41f1bebce8c6040d838 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Mon, 12 Apr 2021 16:01:01 +0200
Subject: [PATCH 205/433] C++: As response to the review comments this commit
 adds a reference-to-pointer state to AddressFlow. A call to an unwrapper
 function now adds a pointer -> reference-to-pointer transition, and a
 ReferenceDereference adds a reference-to-pointer -> pointer transition.

---
 .../cpp/dataflow/internal/AddressFlow.qll     | 105 +++++++++++++++---
 .../dataflow/taint-tests/localTaint.expected  |  49 ++++----
 2 files changed, 116 insertions(+), 38 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 7e76c1540e30..e179f7e8717b 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -59,8 +59,6 @@ private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
   pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
   or
   pointerIn = lvalueOut.(PointerDereferenceExpr).getOperand().getFullyConverted()
-  or
-  pointerIn = lvalueOut.(OverloadedPointerDereferenceExpr).getQualifier().getFullyConverted()
 }
 
 private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
@@ -69,6 +67,19 @@ private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
   lvalueIn = pointerOut.(AddressOfExpr).getOperand().getFullyConverted()
 }
 
+/**
+ * Since pointer wrappers behave as raw pointers, we treat the conversions from `lvalueToLvalueStepPure`
+ * as pointer-to-pointer steps when they involve pointer wrappers.
+ */
+private predicate pointerWrapperToPointerWrapperStep(Expr pointerIn, Expr pointerOut) {
+  pointerIn.getUnspecifiedType() instanceof PointerWrapper and
+  pointerIn.getConversion() = pointerOut and
+  pointerOut.(CStyleCast).isImplicit()
+  or
+  pointerOut.getUnspecifiedType() instanceof PointerWrapper and
+  pointerIn.getConversion() = pointerOut.(ReferenceDereferenceExpr)
+}
+
 private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
   (
     pointerOut instanceof PointerAddExpr
@@ -93,35 +104,60 @@ private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
   pointerIn = pointerOut.(CommaExpr).getRightOperand().getFullyConverted()
   or
   pointerIn = pointerOut.(StmtExpr).getResultExpr().getFullyConverted()
+  or
+  pointerWrapperToPointerWrapperStep(pointerIn, pointerOut)
 }
 
 private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
   lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
-  or
-  exists(PointerWrapper wrapper, Call call | call = referenceOut |
-    referenceOut.getUnspecifiedType() instanceof ReferenceType and
-    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
-    lvalueIn = call.getQualifier().getFullyConverted()
-  )
 }
 
 private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
   referenceIn.getConversion() = lvalueOut.(ReferenceDereferenceExpr)
 }
 
+private predicate referenceToPointerToPointerStep(Expr referenceToPointerIn, Expr pointerOut) {
+  exists(CopyConstructor copy, Call call | call = pointerOut |
+    copy.getDeclaringType() instanceof PointerWrapper and
+    call.getTarget() = copy and
+    // The 0'th argument is the value being copied.
+    referenceToPointerIn = call.getArgument(0).getFullyConverted()
+  )
+  or
+  referenceToPointerIn.getConversion() = pointerOut.(ReferenceDereferenceExpr)
+}
+
+/**
+ * This predicate exists only to support "fake pointer" objects like
+ * smart pointers. We treat these as raw pointers for dataflow purposes.
+ */
+private predicate referenceToPointerToUpdate(
+  Expr referenceToPointer, Expr outer, ControlFlowNode node
+) {
+  exists(Call call |
+    node = call and
+    outer = call.getAnArgument().getFullyConverted() and
+    not stdIdentityFunction(call.getTarget()) and
+    not stdAddressOf(call.getTarget()) and
+    exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
+      rt.getBaseType().getUnspecifiedType() =
+        any(PointerWrapper wrapper | not wrapper.pointsToConst())
+    )
+  ) and
+  referenceToPointer = outer
+  or
+  exists(Expr pointerMid |
+    referenceToPointerToPointerStep(referenceToPointer, pointerMid) and
+    pointerToUpdate(pointerMid, outer, node)
+  )
+}
+
 private predicate referenceToPointerStep(Expr referenceIn, Expr pointerOut) {
   pointerOut =
     any(FunctionCall call |
       stdAddressOf(call.getTarget()) and
       referenceIn = call.getArgument(0).getFullyConverted()
     )
-  or
-  exists(CopyConstructor copy, Call call | call = pointerOut |
-    copy.getDeclaringType() instanceof PointerWrapper and
-    call.getTarget() = copy and
-    // The 0'th argument is the value being copied.
-    referenceIn = call.getArgument(0).getFullyConverted()
-  )
 }
 
 private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
@@ -238,6 +274,16 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
     pointerToPointerStep(pointer, pointerMid) and
     pointerToUpdate(pointerMid, outer, node)
   )
+  or
+  exists(Expr referenceMid |
+    pointerToReferenceStep(pointer, referenceMid) and
+    referenceToUpdate(referenceMid, outer, node)
+  )
+  or
+  exists(Expr referenceToPointerMid |
+    pointerToReferenceToPointerStep(pointer, referenceToPointerMid) and
+    referenceToPointerToUpdate(referenceToPointerMid, outer, node)
+  )
 }
 
 private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode node) {
@@ -247,9 +293,7 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
     not stdIdentityFunction(call.getTarget()) and
     not stdAddressOf(call.getTarget()) and
     exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
-      not rt.getBaseType().isConst() or
-      rt.getBaseType().getUnspecifiedType() =
-        any(PointerWrapper wrapper | not wrapper.pointsToConst())
+      not rt.getBaseType().isConst()
     )
   ) and
   reference = outer
@@ -270,6 +314,14 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
   )
 }
 
+private predicate pointerToReferenceStep(Expr pointerIn, Expr referenceOut) {
+  exists(PointerWrapper wrapper, Call call | call = referenceOut |
+    referenceOut.getUnspecifiedType() instanceof ReferenceType and
+    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
+    pointerIn = call.getQualifier().getFullyConverted()
+  )
+}
+
 private predicate lvalueFromVariableAccess(VariableAccess va, Expr lvalue) {
   // Base case for non-reference types.
   lvalue = va and
@@ -331,6 +383,21 @@ private predicate referenceFromVariableAccess(VariableAccess va, Expr reference)
     lvalueFromVariableAccess(va, prev) and
     lvalueToReferenceStep(prev, reference)
   )
+  or
+  exists(Expr prev |
+    pointerFromVariableAccess(va, prev) and
+    pointerToReferenceStep(prev, reference)
+  )
+}
+
+private predicate pointerToReferenceToPointerStep(Expr pointerIn, Expr referenceToPointerOut) {
+  pointerIn.getConversion() = referenceToPointerOut.(ReferenceToExpr)
+  or
+  exists(PointerWrapper wrapper, Call call | call = referenceToPointerOut |
+    referenceToPointerOut.getUnspecifiedType() instanceof ReferenceType and
+    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
+    pointerIn = call.getQualifier().getFullyConverted()
+  )
 }
 
 /**
@@ -351,6 +418,8 @@ predicate valueToUpdate(Expr inner, Expr outer, ControlFlowNode node) {
     pointerToUpdate(inner, outer, node)
     or
     referenceToUpdate(inner, outer, node)
+    or
+    referenceToPointerToUpdate(inner, outer, node)
   ) and
   (
     inner instanceof VariableAccess and
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 50d5070a1442..90a494de6f83 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -948,12 +948,16 @@
 | map.cpp:170:23:170:28 | call to source | map.cpp:170:7:170:30 | ... = ... |  |
 | map.cpp:171:7:171:9 | m10 | map.cpp:171:10:171:10 | call to operator[] | TAINT |
 | map.cpp:171:7:171:9 | ref arg m10 | map.cpp:252:1:252:1 | m10 |  |
+| map.cpp:171:10:171:10 | ref arg call to operator[] | map.cpp:171:7:171:9 | ref arg m10 | TAINT |
 | map.cpp:172:7:172:9 | m11 | map.cpp:172:10:172:10 | call to operator[] | TAINT |
 | map.cpp:172:7:172:9 | ref arg m11 | map.cpp:252:1:252:1 | m11 |  |
+| map.cpp:172:10:172:10 | ref arg call to operator[] | map.cpp:172:7:172:9 | ref arg m11 | TAINT |
 | map.cpp:173:7:173:9 | m12 | map.cpp:173:10:173:10 | call to operator[] | TAINT |
 | map.cpp:173:7:173:9 | ref arg m12 | map.cpp:252:1:252:1 | m12 |  |
+| map.cpp:173:10:173:10 | ref arg call to operator[] | map.cpp:173:7:173:9 | ref arg m12 | TAINT |
 | map.cpp:174:7:174:9 | m13 | map.cpp:174:10:174:10 | call to operator[] | TAINT |
 | map.cpp:174:7:174:9 | ref arg m13 | map.cpp:252:1:252:1 | m13 |  |
+| map.cpp:174:10:174:10 | ref arg call to operator[] | map.cpp:174:7:174:9 | ref arg m13 | TAINT |
 | map.cpp:177:27:177:29 | call to map | map.cpp:178:2:178:4 | m14 |  |
 | map.cpp:177:27:177:29 | call to map | map.cpp:179:2:179:4 | m14 |  |
 | map.cpp:177:27:177:29 | call to map | map.cpp:180:2:180:4 | m14 |  |
@@ -1651,12 +1655,16 @@
 | map.cpp:322:23:322:28 | call to source | map.cpp:322:7:322:30 | ... = ... |  |
 | map.cpp:323:7:323:9 | m10 | map.cpp:323:10:323:10 | call to operator[] | TAINT |
 | map.cpp:323:7:323:9 | ref arg m10 | map.cpp:438:1:438:1 | m10 |  |
+| map.cpp:323:10:323:10 | ref arg call to operator[] | map.cpp:323:7:323:9 | ref arg m10 | TAINT |
 | map.cpp:324:7:324:9 | m11 | map.cpp:324:10:324:10 | call to operator[] | TAINT |
 | map.cpp:324:7:324:9 | ref arg m11 | map.cpp:438:1:438:1 | m11 |  |
+| map.cpp:324:10:324:10 | ref arg call to operator[] | map.cpp:324:7:324:9 | ref arg m11 | TAINT |
 | map.cpp:325:7:325:9 | m12 | map.cpp:325:10:325:10 | call to operator[] | TAINT |
 | map.cpp:325:7:325:9 | ref arg m12 | map.cpp:438:1:438:1 | m12 |  |
+| map.cpp:325:10:325:10 | ref arg call to operator[] | map.cpp:325:7:325:9 | ref arg m12 | TAINT |
 | map.cpp:326:7:326:9 | m13 | map.cpp:326:10:326:10 | call to operator[] | TAINT |
 | map.cpp:326:7:326:9 | ref arg m13 | map.cpp:438:1:438:1 | m13 |  |
+| map.cpp:326:10:326:10 | ref arg call to operator[] | map.cpp:326:7:326:9 | ref arg m13 | TAINT |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:330:2:330:4 | m14 |  |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:331:2:331:4 | m14 |  |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:332:2:332:4 | m14 |  |
@@ -2447,6 +2455,9 @@
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:55:24:55:25 | i1 |  |
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:57:9:57:10 | i1 |  |
+| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:55:30:55:31 | s1 |  |
+| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:57:9:57:10 | ref arg i1 | TAINT |
+| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:126:1:126:1 | s1 |  |
 | set.cpp:57:9:57:10 | i1 | set.cpp:57:8:57:8 | call to operator* | TAINT |
 | set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:24:55:25 | i1 |  |
 | set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
@@ -2465,6 +2476,9 @@
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:59:24:59:25 | i2 |  |
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:61:9:61:10 | i2 |  |
+| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:59:30:59:31 | s2 |  |
+| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:61:9:61:10 | ref arg i2 | TAINT |
+| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:126:1:126:1 | s2 |  |
 | set.cpp:61:9:61:10 | i2 | set.cpp:61:8:61:8 | call to operator* | TAINT |
 | set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:24:59:25 | i2 |  |
 | set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
@@ -2951,6 +2965,9 @@
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:169:24:169:25 | i1 |  |
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:171:9:171:10 | i1 |  |
+| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:169:30:169:31 | s1 |  |
+| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:171:9:171:10 | ref arg i1 | TAINT |
+| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:238:1:238:1 | s1 |  |
 | set.cpp:171:9:171:10 | i1 | set.cpp:171:8:171:8 | call to operator* | TAINT |
 | set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:24:169:25 | i1 |  |
 | set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
@@ -2969,6 +2986,9 @@
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:173:24:173:25 | i2 |  |
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:175:9:175:10 | i2 |  |
+| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:173:30:173:31 | s2 |  |
+| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:175:9:175:10 | ref arg i2 | TAINT |
+| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:238:1:238:1 | s2 |  |
 | set.cpp:175:9:175:10 | i2 | set.cpp:175:8:175:8 | call to operator* | TAINT |
 | set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:24:173:25 | i2 |  |
 | set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
@@ -3223,7 +3243,7 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* |  |
+| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
@@ -3235,7 +3255,7 @@
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* |  |
+| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
@@ -3251,13 +3271,13 @@
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* |  |
+| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:10:37:15 | call to source | smart_pointer.cpp:37:5:37:17 | ... = ... |  |
 | smart_pointer.cpp:38:10:38:10 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
-| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* |  |
+| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* | TAINT |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:45:6:45:6 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
@@ -3265,13 +3285,13 @@
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* |  |
+| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:10:45:15 | call to source | smart_pointer.cpp:45:5:45:17 | ... = ... |  |
 | smart_pointer.cpp:46:10:46:10 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
-| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* |  |
+| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* | TAINT |
 | smart_pointer.cpp:51:30:51:50 | call to make_shared | smart_pointer.cpp:52:10:52:10 | p |  |
 | smart_pointer.cpp:51:52:51:57 | call to source | smart_pointer.cpp:51:30:51:50 | call to make_shared | TAINT |
 | smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get |  |
@@ -3292,7 +3312,7 @@
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
-| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* |  |
+| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* | TAINT |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:10:71:15 | call to source | smart_pointer.cpp:71:3:71:17 | ... = ... |  |
@@ -3303,7 +3323,7 @@
 | smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:77:9:77:9 | p |  |
-| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* |  |
+| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* | TAINT |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:86:45:86:45 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:87:3:87:3 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:88:8:88:8 | p |  |
@@ -3372,7 +3392,7 @@
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
-| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
+| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* | TAINT |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:10:121:15 | call to source | smart_pointer.cpp:121:3:121:17 | ... = ... |  |
@@ -3409,7 +3429,6 @@
 | smart_pointer.cpp:129:9:129:9 | call to operator* | smart_pointer.cpp:129:8:129:8 | call to operator* | TAINT |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
-| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:8:129:8 | call to operator* |  |
 | smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:9:129:9 | call to operator* | TAINT |
 | smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
@@ -3437,7 +3456,6 @@
 | smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
-| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:8:137:8 | call to operator* |  |
 | smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:9:137:9 | call to operator* | TAINT |
 | smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
@@ -3476,26 +3494,20 @@
 | standalone_iterators.cpp:85:35:85:36 | c1 | standalone_iterators.cpp:85:38:85:42 | call to begin | TAINT |
 | standalone_iterators.cpp:85:35:85:36 | ref arg c1 | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:85:38:85:42 | call to begin | standalone_iterators.cpp:86:6:86:7 | i1 |  |
-| standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:86:6:86:7 | i1 | standalone_iterators.cpp:86:8:86:8 | call to operator-- |  |
 | standalone_iterators.cpp:86:8:86:8 | call to operator-- | standalone_iterators.cpp:86:5:86:5 | call to operator* | TAINT |
-| standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
 | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
-| standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:13:86:18 | call to source | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | c2 | standalone_iterators.cpp:89:38:89:42 | call to begin | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | ref arg c2 | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:89:38:89:42 | call to begin | standalone_iterators.cpp:90:6:90:7 | i2 |  |
-| standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:90:6:90:7 | i2 | standalone_iterators.cpp:90:8:90:8 | call to operator-- |  |
 | standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
-| standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
 | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
-| standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 |  |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 |  |
@@ -3513,13 +3525,10 @@
 | standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b |  |
-| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
-| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
-| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 |  |

From a43698802f669f94b74aedd4d4c22d60ef232263 Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Mon, 12 Apr 2021 17:36:50 +0300
Subject: [PATCH 206/433] Update
 InsufficientControlFlowManagementWhenUsingBitOperations.ql

---
 .../InsufficientControlFlowManagementWhenUsingBitOperations.ql | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
index 8a7a3fff1d02..72d7625b5170 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -61,8 +61,7 @@ class DangerousBitOperations extends BinaryBitwiseOperation {
   /** Holds when the bit expression contains both arguments and a function call. */
   predicate dangerousArgumentChecking() {
     not this.getLeftOperand() instanceof Call and
-    globalValueNumber(this.getLeftOperand().getAChild*()) =
-      globalValueNumber(bfc.getAnArgument())
+    globalValueNumber(this.getLeftOperand().getAChild*()) = globalValueNumber(bfc.getAnArgument())
   }
 
   /** Holds when function calls are present in the bit expression. */

From bb23866cec93bda0bf1e132facd78344fb7a7fe4 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Mon, 12 Apr 2021 16:33:01 +0100
Subject: [PATCH 207/433] Add missing doc comments

---
 .../Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
index 772ac6cd2091..e6965959d13f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -52,10 +52,13 @@ class ApplicationProperties extends ConfigPair {
 class ManagementSecurityConfig extends ApplicationProperties {
   ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
 
+  /** Gets the whitespace-trimmed value of this property. */
   string getValue() { result = this.getValueElement().getValue().trim() }
 
+  /** Holds if `management.security.enabled` is set to `false`. */
   predicate hasSecurityDisabled() { getValue() = "false" }
 
+  /** Holds if `management.security.enabled` is set to `true`. */
   predicate hasSecurityEnabled() { getValue() = "true" }
 }
 
@@ -65,6 +68,7 @@ class ManagementEndPointInclude extends ApplicationProperties {
     this.getNameElement().getName() = "management.endpoints.web.exposure.include"
   }
 
+  /** Gets the whitespace-trimmed value of this property. */
   string getValue() { result = this.getValueElement().getValue().trim() }
 }
 

From dfc91b8331199ff8780aeb8b0a1ef5c14d06a6ba Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 12 Apr 2021 17:33:33 +0200
Subject: [PATCH 208/433] C#: Simplify `dotnet-install.ps1` invocation

Using the pattern from https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script.
---
 .../BuildScripts.cs                           | 12 +++---
 .../Semmle.Autobuild.CSharp/DotNetRule.cs     | 43 ++-----------------
 2 files changed, 9 insertions(+), 46 deletions(-)

diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
index f74e9829bc5b..9334181fe5a6 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
@@ -981,8 +981,7 @@ public void TestDotnetVersionWindows()
         {
             actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
             actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
-            actions.RunProcess[@"cmd.exe /C del C:\Project\install-dotnet.ps1"] = 0;
+            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
@@ -1005,7 +1004,7 @@ public void TestDotnetVersionWindows()
             actions.LoadXml[@"C:\Project\test.csproj"] = xml;
 
             var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
-            TestAutobuilderScript(autobuilder, 0, 7);
+            TestAutobuilderScript(autobuilder, 0, 6);
         }
 
         [Fact]
@@ -1013,9 +1012,8 @@ public void TestDotnetVersionWindowsNoPwsh()
         {
             actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
             actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 1;
-            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
-            actions.RunProcess[@"cmd.exe /C del C:\Project\install-dotnet.ps1"] = 0;
+            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 1;
+            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
@@ -1038,7 +1036,7 @@ public void TestDotnetVersionWindowsNoPwsh()
             actions.LoadXml[@"C:\Project\test.csproj"] = xml;
 
             var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
-            TestAutobuilderScript(autobuilder, 0, 8);
+            TestAutobuilderScript(autobuilder, 0, 7);
         }
 
         [Fact]
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
index 1b440aaa196c..a456c9407db6 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
@@ -179,35 +179,8 @@ private static BuildScript DownloadDotNetVersion(Autobuilder builder, string pat
 
                     if (builder.Actions.IsWindows())
                     {
-                        var psScript = @"param([string]$Version, [string]$InstallDir)
 
-add-type @""
-using System.Net;
-using System.Security.Cryptography.X509Certificates;
-public class TrustAllCertsPolicy : ICertificatePolicy
-{
-    public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem)
-    {
-        return true;
-    }
-}
-""@
-$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
-[System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
-[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
-$Script = Invoke-WebRequest -useb 'https://dot.net/v1/dotnet-install.ps1'
-
-$arguments = @{
-  Channel = 'release'
-  Version = $Version
-  InstallDir = $InstallDir
-}
-
-$ScriptBlock = [scriptblock]::create("".{$($Script)} $(&{$args} @arguments)"")
-
-Invoke-Command -ScriptBlock $ScriptBlock";
-                        var psScriptFile = builder.Actions.PathCombine(builder.Options.RootDirectory, "install-dotnet.ps1");
-                        builder.Actions.WriteAllText(psScriptFile, psScript);
+                        var psCommand = $"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version {version} -InstallDir {path}";
 
                         BuildScript GetInstall(string pwsh) =>
                             new CommandBuilder(builder.Actions).
@@ -215,19 +188,11 @@ BuildScript GetInstall(string pwsh) =>
                             Argument("-NoProfile").
                             Argument("-ExecutionPolicy").
                             Argument("unrestricted").
-                            Argument("-file").
-                            Argument(psScriptFile).
-                            Argument("-Version").
-                            Argument(version).
-                            Argument("-InstallDir").
-                            Argument(path).
+                            Argument("-Command").
+                            Argument("\"" + psCommand + "\"").
                             Script;
 
-                        var removeScript = new CommandBuilder(builder.Actions).
-                            RunCommand("del").
-                            Argument(psScriptFile);
-
-                        return (GetInstall("pwsh") | GetInstall("powershell")) & BuildScript.Try(removeScript.Script);
+                        return GetInstall("pwsh") | GetInstall("powershell");
                     }
                     else
                     {

From d7f26dfc183f3e8c1a220c1aa7d7092f9bfb09e1 Mon Sep 17 00:00:00 2001
From: luchua-bc <shengxin.canada@gmail.com>
Date: Mon, 12 Apr 2021 16:19:23 +0000
Subject: [PATCH 209/433] Update stub classes and qldoc

---
 .../CWE-1004/SensitiveCookieNotHttpOnly.ql    | 14 ++---
 .../CWE-1004/SensitiveCookieNotHttpOnly.java  |  2 +-
 .../javax/ws/rs/core/Cookie.java              | 10 +--
 .../javax/servlet/http/Cookie.java            | 62 +++----------------
 4 files changed, 22 insertions(+), 66 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
index cb8f7412014e..4c0dc624d078 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -82,8 +82,8 @@ class CookieClass extends RefType {
   }
 }
 
-/** Holds if the `expr` is `true` or a variable that is ever assigned `true`. */
-// This could be a very large result set if computed out of context
+/** Holds if `expr` is any boolean-typed expression other than literal `false`. */
+// Inlined because this could be a very large result set if computed out of context
 pragma[inline]
 predicate mayBeBooleanTrue(Expr expr) {
   expr.getType() instanceof BooleanType and
@@ -123,11 +123,11 @@ predicate isTestMethod(MethodAccess ma) {
 }
 
 /**
- * A taint configuration tracking flow of a method or a wrapper method that sets the `HttpOnly`
- * flag, or one that removes a cookie, to a `ServletResponse.addCookie` call.
+ * A taint configuration tracking flow of a method that sets the `HttpOnly` flag,
+ * or one that removes a cookie, to a `ServletResponse.addCookie` call.
  */
-class SetHttpOnlyInCookieConfiguration extends TaintTracking2::Configuration {
-  SetHttpOnlyInCookieConfiguration() { this = "SetHttpOnlyInCookieConfiguration" }
+class SetHttpOnlyOrRemovesCookieConfiguration extends TaintTracking2::Configuration {
+  SetHttpOnlyOrRemovesCookieConfiguration() { this = "SetHttpOnlyOrRemovesCookieConfiguration" }
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr() =
@@ -150,7 +150,7 @@ class CookieResponseSink extends DataFlow::ExprNode {
       (
         ma.getMethod() instanceof ResponseAddCookieMethod and
         this.getExpr() = ma.getArgument(0) and
-        not exists(SetHttpOnlyInCookieConfiguration cc | cc.hasFlowTo(this))
+        not exists(SetHttpOnlyOrRemovesCookieConfiguration cc | cc.hasFlowTo(this))
         or
         ma instanceof SetCookieMethodAccess and
         this.getExpr() = ma.getArgument(1) and
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 0bb912f6ce67..4ad7aa5dd95e 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -137,7 +137,7 @@ public void addCookie14(HttpServletRequest request, HttpServletResponse response
         response.addCookie(createCookie("refresh_token", refreshToken, true));
     }
 
-    // BAD - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
     public void addCookie15(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
         response.addCookie(createCookie("refresh_token", refreshToken, false));
     }
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
index f810600a7660..2726c3d27dda 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
@@ -125,7 +125,7 @@ public static Cookie valueOf(final String value) {
      * @return the cookie name.
      */
     public String getName() {
-        return name;
+        return null;
     }
 
     /**
@@ -134,7 +134,7 @@ public String getName() {
      * @return the cookie value.
      */
     public String getValue() {
-        return value;
+        return null;
     }
 
     /**
@@ -143,7 +143,7 @@ public String getValue() {
      * @return the cookie version.
      */
     public int getVersion() {
-        return version;
+        return -1;
     }
 
     /**
@@ -152,7 +152,7 @@ public int getVersion() {
      * @return the cookie domain.
      */
     public String getDomain() {
-        return domain;
+        return null;
     }
 
     /**
@@ -161,6 +161,6 @@ public String getDomain() {
      * @return the cookie path.
      */
     public String getPath() {
-        return path;
+        return null;
     }
 }
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
index 47b1d883e474..53d3058f9218 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
@@ -24,95 +24,51 @@
 package javax.servlet.http;
 
 public class Cookie implements Cloneable {
-    private String name; // NAME= ... "$Name" style is reserved
-    private String value; // value of NAME
-    private String comment; // ;Comment=VALUE ... describes cookie's use
-    private String domain; // ;Domain=VALUE ... domain that sees cookie
-    private int maxAge = -1; // ;Max-Age=VALUE ... cookies auto-expire
-    private String path; // ;Path=VALUE ... URLs that see the cookie
-    private boolean secure; // ;Secure ... e.g. use SSL
-    private int version = 0; // ;Version=1 ... means RFC 2109++ style
-    private boolean isHttpOnly = false;
 
     public Cookie(String name, String value) {
-        this.name = name;
-        this.value = value;
     }
     public void setComment(String purpose) {
-        comment = purpose;
     }
     public String getComment() {
-        return comment;
+        return null;
     }
     public void setDomain(String pattern) {
-        domain = pattern.toLowerCase(); // IE allegedly needs this
     }
     public String getDomain() {
-        return domain;
+        return null;
     }
     public void setMaxAge(int expiry) {
-        maxAge = expiry;
     }
     public int getMaxAge() {
-        return maxAge;
+        return -1;
     }
     public void setPath(String uri) {
-        path = uri;
     }
     public String getPath() {
-        return path;
+        return null;
     }
     public void setSecure(boolean flag) {
-        secure = flag;
     }
     public boolean getSecure() {
-        return secure;
+        return false;
     }
     public String getName() {
-        return name;
+        return null;
     }
     public void setValue(String newValue) {
-        value = newValue;
     }
     public String getValue() {
-        return value;
+        return null;
     }
     public int getVersion() {
-        return version;
+        return -1;
     }
     public void setVersion(int v) {
     }
-
-    /**
-     * Marks or unmarks this Cookie as <i>HttpOnly</i>.
-     *
-     * <p>If <tt>isHttpOnly</tt> is set to <tt>true</tt>, this cookie is
-     * marked as <i>HttpOnly</i>, by adding the <tt>HttpOnly</tt> attribute
-     * to it.
-     *
-     * <p><i>HttpOnly</i> cookies are not supposed to be exposed to
-     * client-side scripting code, and may therefore help mitigate certain
-     * kinds of cross-site scripting attacks.
-     *
-     * @param isHttpOnly true if this cookie is to be marked as
-     * <i>HttpOnly</i>, false otherwise
-     *
-     * @since Servlet 3.0
-     */
     public void setHttpOnly(boolean isHttpOnly) {
-        this.isHttpOnly = isHttpOnly;
     }
- 
-    /**
-     * Checks whether this Cookie has been marked as <i>HttpOnly</i>.
-     *
-     * @return true if this Cookie has been marked as <i>HttpOnly</i>,
-     * false otherwise
-     *
-     * @since Servlet 3.0
-     */
     public boolean isHttpOnly() {
-        return isHttpOnly;
+        return false;
     }
 
     /**

From 037e6369ce657381a15fe2df4ea0b09ed24d9802 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Mon, 12 Apr 2021 18:27:21 +0200
Subject: [PATCH 210/433] C++: Ensure all values are bound in both
 disjunctions.

---
 .../dataflow/fields/partial-definition-diff.ql | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
index d8b6b4e0e69a..fae4b06da5ad 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
@@ -19,15 +19,19 @@ class IRPartialDefNode extends IRNode {
   override string toString() { result = n.asPartialDefinition().toString() }
 }
 
-from Node node, AST::Node astNode, IR::Node irNode, string msg
+from Node node, string msg
 where
-  node.asIR() = irNode and
-  exists(irNode.asPartialDefinition()) and
-  not exists(AST::Node otherNode | otherNode.asPartialDefinition() = irNode.asPartialDefinition()) and
+  exists(IR::Node irNode, Expr partial |
+    node.asIR() = irNode and
+    partial = irNode.asPartialDefinition() and
+    not exists(AST::Node otherNode | otherNode.asPartialDefinition() = partial)
+  ) and
   msg = "IR only"
   or
-  node.asAST() = astNode and
-  exists(astNode.asPartialDefinition()) and
-  not exists(IR::Node otherNode | otherNode.asPartialDefinition() = astNode.asPartialDefinition()) and
+  exists(AST::Node astNode, Expr partial |
+    node.asAST() = astNode and
+    partial = astNode.asPartialDefinition() and
+    not exists(IR::Node otherNode | otherNode.asPartialDefinition() = partial)
+  ) and
   msg = "AST only"
 select node, msg

From b96b6652626cbeb232748ac782130b884335725d Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Mon, 12 Apr 2021 21:40:49 +0300
Subject: [PATCH 211/433] Renaming in
 java/ql/src/experimental/Security/CWE/CWE-094

---
 .../CWE/CWE-094/{InjectionLib.qll => FlowUtils.qll}         | 2 +-
 .../Security/CWE/CWE-094/JakartaExpressionInjection.qhelp   | 6 +++---
 .../Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll  | 4 ++--
 .../experimental/Security/CWE/CWE-094/JexlInjectionLib.qll  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)
 rename java/ql/src/experimental/Security/CWE/CWE-094/{InjectionLib.qll => FlowUtils.qll} (81%)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll
similarity index 81%
rename from java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll
rename to java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll
index adab79d6f5c3..5371c51aa8f0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/InjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll
@@ -5,7 +5,7 @@ import semmle.code.java.dataflow.FlowSources
  * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
  * a bean by calling one of its getters.
  */
-predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node toNode) {
+predicate hasGetterFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
   exists(MethodAccess ma, Method m | ma.getMethod() = m |
     m instanceof GetterMethod and
     ma.getQualifier() = fromNode.asExpr() and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
index a6d66c1d1d16..a8d3cd0fe70e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
@@ -29,14 +29,14 @@ with sandboxing capabilities such as Apache Commons JEXL or the Spring Expressio
 The following example shows how untrusted data is used to build and run an expression
 using the JUEL interpreter:
 </p>
-<sample src="UnsafeExpressionEvaluationWithJUEL.java" />
+<sample src="UnsafeExpressionEvaluationWithJuel.java" />
 
 <p>
-JUEL does not support to run expressions in a sandbox. To prevent running arbitrary code,
+JUEL does not support running expressions in a sandbox. To prevent running arbitrary code,
 incoming data has to be checked before including it in an expression. The next example
 uses a Regex pattern to check whether a user tries to run an allowed expression or not:
 </p>
-<sample src="SaferExpressionEvaluationWithJUEL.java" />
+<sample src="SaferExpressionEvaluationWithJuel.java" />
 
 </example>
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
index b1c5d1e8ae20..430909743647 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -1,5 +1,5 @@
 import java
-import InjectionLib
+import FlowUtils
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 
@@ -16,7 +16,7 @@ class JakartaExpressionInjectionConfig extends TaintTracking::Configuration {
 
   override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
     any(TaintPropagatingCall c).taintFlow(fromNode, toNode) or
-    returnsDataFromBean(fromNode, toNode)
+    hasGetterFlow(fromNode, toNode)
   }
 }
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
index 51084a9862ce..89d7cb496a41 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -1,5 +1,5 @@
 import java
-import InjectionLib
+import FlowUtils
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 
@@ -17,7 +17,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
 
   override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
     any(TaintPropagatingJexlMethodCall c).taintFlow(fromNode, toNode) or
-    returnsDataFromBean(fromNode, toNode)
+    hasGetterFlow(fromNode, toNode)
   }
 }
 

From e0fcb1573987e27b831aa294f3c0b368d019bc3f Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Mon, 12 Apr 2021 11:49:07 -0700
Subject: [PATCH 212/433] Actions: Add workflow for marking stale questions

This PR adds a workflow for marking and closing issues as stale. Issues must be labeled as _question_. PRs are never marked as stale.
---
 .github/workflows/close-stale.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/workflows/close-stale.yml

diff --git a/.github/workflows/close-stale.yml b/.github/workflows/close-stale.yml
new file mode 100644
index 000000000000..6065f79aa7c1
--- /dev/null
+++ b/.github/workflows/close-stale.yml
@@ -0,0 +1,30 @@
+name: Mark stale issues
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  stale:
+    if: github.repository == 'github/codeql'
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/stale@v3
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `stale` label in order to avoid having this issue closed in 7 days.'
+        close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
+        days-before-stale: 14
+        days-before-close: 7
+        only-labels: question
+        
+        # do not mark PRs as stale
+        days-before-pr-stale: -1
+        days-before-pr-close: -1
+        
+        # Dry-run only. remove this when we are ready to actually change issues
+        debug-only: true
+        operations-per-run: 1000

From e4d74cf0986c59a3cec6f09687e81da7c4f7f0ed Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Mon, 12 Apr 2021 23:47:54 +0200
Subject: [PATCH 213/433] Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 .../src/Security/CWE-327/FluentApiModel.qll   |  7 ++-----
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  | 10 +++++++---
 python/ql/src/Security/CWE-327/Ssl.qll        | 18 ++++++++++-------
 .../src/Security/CWE-327/TlsLibraryModel.qll  | 20 ++++++++++---------
 4 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index b5d6823c44c2..6010417b68d6 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -1,4 +1,4 @@
-import python
+private import python
 import TlsLibraryModel
 
 /**
@@ -89,9 +89,6 @@ predicate unsafe_connection_creation_with_context(
 /**
  * Holds if `conectionCreation` marks the creation of a connetion witout reference to a context
  * and allowing `insecure_version`.
- *
- * `specific` is true iff the context is configured for a specific protocol version rather
- * than for a family of protocols.
  */
 predicate unsafe_connection_creation_without_context(
   DataFlow::CallCfgNode connectionCreation, string insecure_version
@@ -99,7 +96,7 @@ predicate unsafe_connection_creation_without_context(
   exists(TlsLibrary l | connectionCreation = l.insecure_connection_creation(insecure_version))
 }
 
-/** Holds if `contextCreation` is creating a context ties to a specific insecure version. */
+/** Holds if `contextCreation` is creating a context tied to a specific insecure version. */
 predicate unsafe_context_creation(DataFlow::CallCfgNode contextCreation, string insecure_version) {
   exists(TlsLibrary l | contextCreation = l.insecure_context_creation(insecure_version))
 }
diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index 55b77386f2f8..3cd9b064e24c 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -1,5 +1,9 @@
-import python
-import semmle.python.ApiGraphs
+/**
+ * Provides modeling of SSL/TLS functionality of the `OpenSSL` module from the `pyOpenSSL` PyPI package.
+ * See https://www.pyopenssl.org/en/stable/
+ */
+private import python
+private import semmle.python.ApiGraphs
 import TlsLibraryModel
 
 class PyOpenSSLContextCreation extends ContextCreation {
@@ -49,7 +53,7 @@ class SetOptionsCall extends ProtocolRestriction {
 }
 
 class UnspecificPyOpenSSLContextCreation extends PyOpenSSLContextCreation, UnspecificContextCreation {
-  UnspecificPyOpenSSLContextCreation() { library = "pyOpenSSL" }
+  UnspecificPyOpenSSLContextCreation() { library instanceof PyOpenSSL }
 }
 
 class PyOpenSSL extends TlsLibrary {
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index cb19fb8f11ff..b44ae1814151 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -1,5 +1,9 @@
-import python
-import semmle.python.ApiGraphs
+/**
+ * Provides modeling of SSL/TLS functionality of the `ssl` module from the standard library.
+ * See https://docs.python.org/3.9/library/ssl.html
+ */
+private import python
+private import semmle.python.ApiGraphs
 import TlsLibraryModel
 
 class SSLContextCreation extends ContextCreation {
@@ -145,12 +149,12 @@ class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction {
 }
 
 class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContextCreation {
-  UnspecificSSLContextCreation() { library = "ssl" }
+  UnspecificSSLContextCreation() { library instanceof Ssl }
 
   override ProtocolVersion getUnrestriction() {
     result = UnspecificContextCreation.super.getUnrestriction() and
-    // These are turned off by default
-    // see https://docs.python.org/3/library/ssl.html#ssl-contexts
+    // These are turned off by default since Python 3.6
+    // see https://docs.python.org/3.6/library/ssl.html#ssl.SSLContext
     not result in ["SSLv2", "SSLv3"]
   }
 }
@@ -185,8 +189,8 @@ class Ssl extends TlsLibrary {
 
   override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) {
     result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
-    specific_version(version).asCfgNode() =
-      result.asCfgNode().(CallNode).getArgByName("ssl_version") and
+    this.specific_version(version) =
+      result.(DataFlow::CallCfgNode).getArgByName("ssl_version") and
     version.isInsecure()
   }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index 685485004b25..c49113f8f68d 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -1,15 +1,15 @@
-import python
-import semmle.python.ApiGraphs
+private import python
+private import semmle.python.ApiGraphs
 import Ssl
 import PyOpenSSL
 
 /**
- * A specific protocol version.
- * We use this to identify a protocol.
+ * A specific protocol version of SSL or TLS.
  */
 class ProtocolVersion extends string {
   ProtocolVersion() { this in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"] }
 
+  /** Gets a `ProtocolVersion` that is less than this `ProtocolVersion`, if any. */
   predicate lessThan(ProtocolVersion version) {
     this = "SSLv2" and version = "SSLv3"
     or
@@ -20,6 +20,7 @@ class ProtocolVersion extends string {
     this = ["TLSv1", "TLSv1_1", "TLSv1_2"] and version = "TLSv1_3"
   }
 
+  /** Holds if this protocol version is known to be insecure. */
   predicate isInsecure() { this in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1"] }
 }
 
@@ -81,12 +82,13 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
 
 /** A model of a SSL/TLS library. */
 abstract class TlsLibrary extends string {
-  TlsLibrary() { this in ["ssl", "pyOpenSSL"] }
+  bindingset[this]
+  TlsLibrary() { any() }
 
   /** The name of a specific protocol version. */
   abstract string specific_version_name(ProtocolVersion version);
 
-  /** The name of an unspecific protocol version, say TLS, known to have insecure instances. */
+  /** Gets a name, which is a member of `version_constants`,  that can be used to specify the protocol family `family`. */
   abstract string unspecific_version_name(ProtocolFamily family);
 
   /** The module or class holding the version constants. */
@@ -97,12 +99,12 @@ abstract class TlsLibrary extends string {
     result = version_constants().getMember(specific_version_name(version)).getAUse()
   }
 
-  /** A dataflow node representing an unspecific protocol version, say TLS, known to have insecure instances. */
+  /** Gets a dataflow node representing the protocol family `family`. */
   DataFlow::Node unspecific_version(ProtocolFamily family) {
     result = version_constants().getMember(unspecific_version_name(family)).getAUse()
   }
 
-  /** The creation of a context with a deafult protocol. */
+  /** The creation of a context with a default protocol. */
   abstract ContextCreation default_context_creation();
 
   /** The creation of a context with a specific protocol. */
@@ -115,7 +117,7 @@ abstract class TlsLibrary extends string {
     version.isInsecure()
   }
 
-  /** The creation of a context with an unspecific protocol version, say TLS, known to have insecure instances. */
+  /** Gets a context that was created using `family`, known to have insecure instances. */
   ContextCreation unspecific_context_creation(ProtocolFamily family) {
     result in [specific_context_creation(), default_context_creation()] and
     result.getProtocol() = family

From b6bd782746b59aedde860320c6700320de1b395e Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 12 Apr 2021 23:55:59 +0200
Subject: [PATCH 214/433] Python: Modernize via `CallCfgNode`

---
 python/ql/src/Security/CWE-327/PyOpenSSL.qll       | 13 ++++---------
 python/ql/src/Security/CWE-327/Ssl.qll             | 14 ++++++--------
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll | 14 +++++++-------
 3 files changed, 17 insertions(+), 24 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index 3cd9b064e24c..9f42b83572ed 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -2,13 +2,12 @@
  * Provides modeling of SSL/TLS functionality of the `OpenSSL` module from the `pyOpenSSL` PyPI package.
  * See https://www.pyopenssl.org/en/stable/
  */
+
 private import python
 private import semmle.python.ApiGraphs
 import TlsLibraryModel
 
-class PyOpenSSLContextCreation extends ContextCreation {
-  override CallNode node;
-
+class PyOpenSSLContextCreation extends ContextCreation, DataFlow::CallCfgNode {
   PyOpenSSLContextCreation() {
     this = API::moduleImport("OpenSSL").getMember("SSL").getMember("Context").getACall()
   }
@@ -22,9 +21,7 @@ class PyOpenSSLContextCreation extends ContextCreation {
   }
 }
 
-class ConnectionCall extends ConnectionCreation {
-  override CallNode node;
-
+class ConnectionCall extends ConnectionCreation, DataFlow::CallCfgNode {
   ConnectionCall() {
     this = API::moduleImport("OpenSSL").getMember("SSL").getMember("Connection").getACall()
   }
@@ -36,9 +33,7 @@ class ConnectionCall extends ConnectionCreation {
 
 // This cannot be used to unrestrict,
 // see https://www.pyopenssl.org/en/stable/api/ssl.html#OpenSSL.SSL.Context.set_options
-class SetOptionsCall extends ProtocolRestriction {
-  override CallNode node;
-
+class SetOptionsCall extends ProtocolRestriction, DataFlow::CallCfgNode {
   SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
 
   override DataFlow::CfgNode getContext() {
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index b44ae1814151..99bb24b7076e 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -2,13 +2,12 @@
  * Provides modeling of SSL/TLS functionality of the `ssl` module from the standard library.
  * See https://docs.python.org/3.9/library/ssl.html
  */
+
 private import python
 private import semmle.python.ApiGraphs
 import TlsLibraryModel
 
-class SSLContextCreation extends ContextCreation {
-  override CallNode node;
-
+class SSLContextCreation extends ContextCreation, DataFlow::CallCfgNode {
   SSLContextCreation() { this = API::moduleImport("ssl").getMember("SSLContext").getACall() }
 
   override string getProtocol() {
@@ -46,7 +45,7 @@ class WrapSocketCall extends ConnectionCreation, DataFlow::CallCfgNode {
   }
 }
 
-class OptionsAugOr extends ProtocolRestriction {
+class OptionsAugOr extends ProtocolRestriction, DataFlow::CallCfgNode {
   ProtocolVersion restriction;
 
   OptionsAugOr() {
@@ -69,7 +68,7 @@ class OptionsAugOr extends ProtocolRestriction {
   override ProtocolVersion getRestriction() { result = restriction }
 }
 
-class OptionsAugAndNot extends ProtocolUnrestriction {
+class OptionsAugAndNot extends ProtocolUnrestriction, DataFlow::CallCfgNode {
   ProtocolVersion restriction;
 
   OptionsAugAndNot() {
@@ -127,7 +126,7 @@ predicate impliesBitSet(BinaryExpr whole, Expr part, boolean partHasBitSet, bool
   )
 }
 
-class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction {
+class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction, DataFlow::CallCfgNode {
   ProtocolVersion restriction;
 
   ContextSetVersion() {
@@ -189,8 +188,7 @@ class Ssl extends TlsLibrary {
 
   override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) {
     result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
-    this.specific_version(version) =
-      result.(DataFlow::CallCfgNode).getArgByName("ssl_version") and
+    this.specific_version(version) = result.(DataFlow::CallCfgNode).getArgByName("ssl_version") and
     version.isInsecure()
   }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index c49113f8f68d..cd38ad4ab5ec 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -30,30 +30,30 @@ class ProtocolFamily extends string {
 }
 
 /** The creation of a context. */
-abstract class ContextCreation extends DataFlow::CfgNode {
+abstract class ContextCreation extends DataFlow::Node {
   /** Gets the protocol version or family for this context. */
   abstract string getProtocol();
 }
 
 /** The creation of a connection from a context. */
-abstract class ConnectionCreation extends DataFlow::CfgNode {
+abstract class ConnectionCreation extends DataFlow::Node {
   /** Gets the context used to create the connection. */
-  abstract DataFlow::CfgNode getContext();
+  abstract DataFlow::Node getContext();
 }
 
 /** A context is being restricted on which protocols it can accepts. */
-abstract class ProtocolRestriction extends DataFlow::CfgNode {
+abstract class ProtocolRestriction extends DataFlow::Node {
   /** Gets the context being restricted. */
-  abstract DataFlow::CfgNode getContext();
+  abstract DataFlow::Node getContext();
 
   /** Gets the protocol version being disallowed. */
   abstract ProtocolVersion getRestriction();
 }
 
 /** A context is being relaxed on which protocols it can accepts. */
-abstract class ProtocolUnrestriction extends DataFlow::CfgNode {
+abstract class ProtocolUnrestriction extends DataFlow::Node {
   /** Gets the context being relaxed. */
-  abstract DataFlow::CfgNode getContext();
+  abstract DataFlow::Node getContext();
 
   /** Gets the protocol version being allowed. */
   abstract ProtocolVersion getUnrestriction();

From 697b2dcde8faafcc585c41a08dd1036f2ab53e09 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Mon, 12 Apr 2021 18:11:10 -0400
Subject: [PATCH 215/433] C++: Add missing store step for single-field struct
 use

We have special code to handle field flow for single-field structs, but that special case was too specific. Some `Store`s to single-field structs have no `Chi` instruction, which is the case that we handled already. However, it is possible for the `Store` to have a `Chi` instruction (e.g. for `{AllAliased}`), but still have a use of the result of the `Store` directly. We now add a `PostUpdateNode` for the result of the `Store` itself in those cases, just like we already did if the `Store` had no `Chi`.
---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 15 +++++--
 .../ir/dataflow/internal/PrintIRLocalFlow.qll | 29 +-------------
 .../dataflow/internal/PrintIRStoreSteps.qll   | 33 ++++++++++++++++
 .../ir/dataflow/internal/PrintIRUtilities.qll | 39 +++++++++++++++++++
 .../dataflow-ir-consistency.expected          |  2 +
 .../fields/dataflow-ir-consistency.expected   |  4 ++
 .../dataflow/fields/ir-path-flow.expected     |  6 +--
 7 files changed, 93 insertions(+), 35 deletions(-)
 create mode 100644 cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
 create mode 100644 cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 76ca7b215dce..81a07ad9d04a 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -362,15 +362,22 @@ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
 
 /**
  * Not every store instruction generates a chi instruction that we can attach a PostUpdateNode to.
- * For instance, an update to a field of a struct containing only one field. For these cases we
- * attach the PostUpdateNode to the store instruction. There's no obvious pre update node for this case
- * (as the entire memory is updated), so `getPreUpdateNode` is implemented as `none()`.
+ * For instance, an update to a field of a struct containing only one field. Even if the store does 
+ * have a chi instruction, a subsequent use of the result of the store may be linked directly to the
+ * result of the store as an inexact definition if the store totally overlaps the use. For these
+ * cases we attach the PostUpdateNode to the store instruction. There's no obvious pre update node
+ * for this case (as the entire memory is updated), so `getPreUpdateNode` is implemented as
+ * `none()`.
  */
 private class ExplicitSingleFieldStoreQualifierNode extends PartialDefinitionNode {
   override StoreInstruction instr;
 
   ExplicitSingleFieldStoreQualifierNode() {
-    not exists(ChiInstruction chi | chi.getPartial() = instr) and
+    (
+      instr.getAUse().isDefinitionInexact()
+      or
+      not exists(ChiInstruction chi | chi.getPartial() = instr)
+    ) and
     // Without this condition any store would create a `PostUpdateNode`.
     instr.getDestinationAddress() instanceof FieldAddressInstruction
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
index 337dc71a3caa..16182296e400 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
@@ -6,34 +6,7 @@ private import semmle.code.cpp.ir.ValueNumbering
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
-
-/**
- * Gets a short ID for an IR dataflow node.
- * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
- * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
- *   instruction and a dot (e.g. `m128.left`).
- * - For `Variable`s, this is the qualified name of the variable.
- */
-private string nodeId(DataFlow::Node node, int order1, int order2) {
-  exists(Instruction instruction | instruction = node.asInstruction() |
-    result = instruction.getResultId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  exists(Operand operand, Instruction instruction |
-    operand = node.asOperand() and
-    instruction = operand.getUse()
-  |
-    result = instruction.getResultId() + "." + operand.getDumpId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  result = "var(" + node.asVariable().getQualifiedName() + ")" and
-  order1 = 1000000 and
-  order2 = 0
-}
+private import PrintIRUtilities
 
 /**
  * Gets the local dataflow from other nodes in the same function to this node.
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
new file mode 100644
index 000000000000..8c3182162170
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
@@ -0,0 +1,33 @@
+/**
+ * Print the dataflow local store steps in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import PrintIRUtilities
+
+/**
+ * Property provider for local IR dataflow store steps.
+ */
+class LocalFlowPropertyProvider extends IRPropertyProvider {
+  override string getInstructionProperty(Instruction instruction, string key) {
+    exists(DataFlow::Node objectNode, Content content |
+      key = "content[" + content.toString() + "]" and
+      instruction = objectNode.asInstruction() and
+      result =
+        strictconcat(string element, DataFlow::Node fieldNode |
+          storeStep(fieldNode, content, objectNode) and
+          element = nodeId(fieldNode, _, _)
+        |
+          element, ", "
+        )
+    )
+  }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
new file mode 100644
index 000000000000..5fc15cf986c7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
@@ -0,0 +1,39 @@
+/**
+ * Shared utilities used when printing dataflow annotations in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+
+/**
+ * Gets a short ID for an IR dataflow node.
+ * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
+ * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
+ *   instruction and a dot (e.g. `m128.left`).
+ * - For `Variable`s, this is the qualified name of the variable.
+ */
+string nodeId(DataFlow::Node node, int order1, int order2) {
+  exists(Instruction instruction | instruction = node.asInstruction() |
+    result = instruction.getResultId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  exists(Operand operand, Instruction instruction |
+    operand = node.asOperand() and
+    instruction = operand.getUse()
+  |
+    result = instruction.getResultId() + "." + operand.getDumpId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  result = "var(" + node.asVariable().getQualifiedName() + ")" and
+  order1 = 1000000 and
+  order2 = 0
+}
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
index fc6c97aa2a63..db9a86fbb570 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
@@ -26,6 +26,7 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
+| test.cpp:373:5:373:20 | Store | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
@@ -82,4 +83,5 @@ postWithInFlow
 | test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
 | test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
 | test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:20 | Store | PostUpdateNode should not be the target of local flow. |
 | test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
index 63d3b2c0f48f..fe7d8360403c 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
@@ -20,7 +20,9 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
+| D.cpp:57:5:57:42 | Store | PostUpdateNode should have one pre-update node but has 0. |
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:83:9:83:28 | Store | PostUpdateNode should have one pre-update node but has 0. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
@@ -54,6 +56,7 @@ postWithInFlow
 | D.cpp:49:15:49:24 | Chi | PostUpdateNode should not be the target of local flow. |
 | D.cpp:56:15:56:24 | Chi | PostUpdateNode should not be the target of local flow. |
 | D.cpp:57:5:57:42 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:42 | Store | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:9:3:9:22 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:13:3:13:21 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:17:3:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -150,6 +153,7 @@ postWithInFlow
 | simple.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:9:83:28 | Store | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index 37a0dc3832a2..e6234ca17f77 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -228,8 +228,8 @@ edges
 | simple.cpp:65:5:65:22 | Store [i] | simple.cpp:66:12:66:12 | Store [i] |
 | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
 | simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | this indirection [f1] |
-| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Chi [f1] |
+| simple.cpp:83:9:83:28 | Store [f1] | simple.cpp:84:14:84:20 | this indirection [f1] |
+| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Store [f1] |
 | simple.cpp:84:14:84:20 | this indirection [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
 | simple.cpp:92:5:92:22 | Store [i] | simple.cpp:93:20:93:20 | Store [i] |
 | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | Store [i] |
@@ -494,7 +494,7 @@ nodes
 | simple.cpp:65:11:65:20 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:67:13:67:13 | i | semmle.label | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
+| simple.cpp:83:9:83:28 | Store [f1] | semmle.label | Store [f1] |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
 | simple.cpp:84:14:84:20 | this indirection [f1] | semmle.label | this indirection [f1] |

From afd2f58f9fa6a75a390b818a5ea33cc1ae2b63fb Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Mon, 12 Apr 2021 18:21:05 -0400
Subject: [PATCH 216/433] C++: Fix PR feedback

---
 .../cpp/ir/implementation/raw/internal/TranslatedCall.qll   | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
index 0b52937f1cb7..56d4c807ac85 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
@@ -495,10 +495,8 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
   override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType type) {
-    (
-      tag = OnlyInstructionTag() and
-      opcode = sideEffectOpcode
-    ) and
+    tag = OnlyInstructionTag() and
+    opcode = sideEffectOpcode and
     (
       isWrite() and
       (

From be39883166a410baabd3c24e9d7c575962ac7a86 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Tue, 13 Apr 2021 14:10:10 +0800
Subject: [PATCH 217/433] Change the class name and comment,Use
 .(CompileTimeConstantExpr).getStringValue()

---
 .../Security/CWE/CWE-352/JsonStringLib.qll    | 29 ++++++++++++++-----
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  2 +-
 .../CWE/CWE-352/JsonpInjectionLib.qll         | 14 +++++----
 3 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
index 5cc52e97e338..b8f1a13b119b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
@@ -4,10 +4,15 @@ import semmle.code.java.dataflow.FlowSources
 import DataFlow::PathGraph
 
 /** Json string type data. */
-abstract class JsonpStringSource extends DataFlow::Node { }
+abstract class JsonStringSource extends DataFlow::Node { }
 
-/** Convert to String using Gson library. */
-private class GsonString extends JsonpStringSource {
+/**
+ * Convert to String using Gson library. *
+ *
+ * For example, in the method access `Gson.toJson(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class GsonString extends JsonStringSource {
   GsonString() {
     exists(MethodAccess ma, Method m | ma.getMethod() = m |
       m.hasName("toJson") and
@@ -17,8 +22,13 @@ private class GsonString extends JsonpStringSource {
   }
 }
 
-/** Convert to String using Fastjson library. */
-private class FastjsonString extends JsonpStringSource {
+/**
+ * Convert to String using Fastjson library.
+ *
+ * For example, in the method access `JSON.toJSONString(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class FastjsonString extends JsonStringSource {
   FastjsonString() {
     exists(MethodAccess ma, Method m | ma.getMethod() = m |
       m.hasName("toJSONString") and
@@ -28,8 +38,13 @@ private class FastjsonString extends JsonpStringSource {
   }
 }
 
-/** Convert to String using Jackson library. */
-private class JacksonString extends JsonpStringSource {
+/**
+ * Convert to String using Jackson library.
+ *
+ * For example, in the method access `ObjectMapper.writeValueAsString(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class JacksonString extends JsonStringSource {
   JacksonString() {
     exists(MethodAccess ma, Method m | ma.getMethod() = m |
       m.hasName("writeValueAsString") and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index a02891e8a566..927c3db03d25 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -69,4 +69,4 @@ where
   conf.hasFlowPath(source, sink) and
   exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
 select sink.getNode(), source, sink, "Jsonp response might include code from $@.", source.getNode(),
-  "this user input"
\ No newline at end of file
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index f0a1a9de81c8..6a21ce8ff3a8 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -86,17 +86,21 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
   }
 }
 
-/** A concatenate expression using `(` and `)` or `);`. */
+/**
+ * A concatenate expression using `(` and `)` or `);`.
+ *
+ * E.g: `functionName + "(" + json + ")"` or `functionName + "(" + json + ");"`
+ */
 class JsonpBuilderExpr extends AddExpr {
   JsonpBuilderExpr() {
-    getRightOperand().toString().regexpMatch("\"\\);?\"") and
+    getRightOperand().(CompileTimeConstantExpr).getStringValue().regexpMatch("\\);?") and
     getLeftOperand()
         .(AddExpr)
         .getLeftOperand()
         .(AddExpr)
         .getRightOperand()
-        .toString()
-        .regexpMatch("\"\\(\"")
+        .(CompileTimeConstantExpr)
+        .getStringValue() = "("
   }
 
   /** Get the jsonp function name of this expression. */
@@ -123,7 +127,7 @@ class RemoteFlowConfig extends DataFlow2::Configuration {
 class JsonDataFlowConfig extends DataFlow2::Configuration {
   JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
 
-  override predicate isSource(DataFlow::Node src) { src instanceof JsonpStringSource }
+  override predicate isSource(DataFlow::Node src) { src instanceof JsonStringSource }
 
   override predicate isSink(DataFlow::Node sink) {
     exists(JsonpBuilderExpr jhe | jhe.getJsonExpr() = sink.asExpr())

From c37dbb2e68c4d25c4f0702333c08f1b57c072ab2 Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Sat, 10 Apr 2021 03:17:50 +0200
Subject: [PATCH 218/433] Java: Override getAPrimaryQlClass() for more classes

---
 java/ql/src/semmle/code/FileSystem.qll     | 6 ++++++
 java/ql/src/semmle/code/java/Exception.qll | 2 ++
 java/ql/src/semmle/code/java/Modifier.qll  | 2 ++
 java/ql/src/semmle/code/java/Package.qll   | 2 ++
 java/ql/src/semmle/code/java/Variable.qll  | 2 ++
 java/ql/src/semmle/code/xml/XML.qll        | 2 ++
 6 files changed, 16 insertions(+)

diff --git a/java/ql/src/semmle/code/FileSystem.qll b/java/ql/src/semmle/code/FileSystem.qll
index 28015d3ba4da..13908d547dc5 100755
--- a/java/ql/src/semmle/code/FileSystem.qll
+++ b/java/ql/src/semmle/code/FileSystem.qll
@@ -159,6 +159,8 @@ class Folder extends Container, @folder {
 
   /** Gets the URL of this folder. */
   override string getURL() { result = "folder://" + getAbsolutePath() }
+
+  override string getAPrimaryQlClass() { result = "Folder" }
 }
 
 /**
@@ -171,6 +173,8 @@ class File extends Container, @file {
 
   /** Gets the URL of this file. */
   override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
+
+  override string getAPrimaryQlClass() { result = "File" }
 }
 
 /**
@@ -204,4 +208,6 @@ class JarFile extends File {
   string getManifestEntryAttribute(string entry, string key) {
     jarManifestEntries(this, entry, key, result)
   }
+
+  override string getAPrimaryQlClass() { result = "JarFile" }
 }
diff --git a/java/ql/src/semmle/code/java/Exception.qll b/java/ql/src/semmle/code/java/Exception.qll
index 242478aa6c8f..1e6cb54be0f2 100755
--- a/java/ql/src/semmle/code/java/Exception.qll
+++ b/java/ql/src/semmle/code/java/Exception.qll
@@ -27,4 +27,6 @@ class Exception extends Element, @exception {
   override predicate hasName(string name) { this.getType().hasName(name) }
 
   override string toString() { result = this.getType().toString() }
+
+  override string getAPrimaryQlClass() { result = "Exception" }
 }
diff --git a/java/ql/src/semmle/code/java/Modifier.qll b/java/ql/src/semmle/code/java/Modifier.qll
index 8c48ffb117ae..7fb9f9826163 100755
--- a/java/ql/src/semmle/code/java/Modifier.qll
+++ b/java/ql/src/semmle/code/java/Modifier.qll
@@ -8,6 +8,8 @@ import Element
 class Modifier extends Element, @modifier {
   /** Gets the element to which this modifier applies. */
   Element getElement() { hasModifier(result, this) }
+
+  override string getAPrimaryQlClass() { result = "Modifier" }
 }
 
 /** An element of the Java syntax tree that may have a modifier. */
diff --git a/java/ql/src/semmle/code/java/Package.qll b/java/ql/src/semmle/code/java/Package.qll
index 6cb41ca559fc..466c97e561d6 100755
--- a/java/ql/src/semmle/code/java/Package.qll
+++ b/java/ql/src/semmle/code/java/Package.qll
@@ -29,4 +29,6 @@ class Package extends Element, Annotatable, @package {
    * since packages do not have locations.
    */
   string getURL() { result = "file://:0:0:0:0" }
+
+  override string getAPrimaryQlClass() { result = "Package" }
 }
diff --git a/java/ql/src/semmle/code/java/Variable.qll b/java/ql/src/semmle/code/java/Variable.qll
index e038f98beafb..439ee5d3f6b9 100755
--- a/java/ql/src/semmle/code/java/Variable.qll
+++ b/java/ql/src/semmle/code/java/Variable.qll
@@ -53,6 +53,8 @@ class LocalVariableDecl extends @localvar, LocalScopeVariable {
 
   /** Gets the initializer expression of this local variable declaration. */
   override Expr getInitializer() { result = getDeclExpr().getInit() }
+
+  override string getAPrimaryQlClass() { result = "LocalVariableDecl" }
 }
 
 /** A formal parameter of a callable. */
diff --git a/java/ql/src/semmle/code/xml/XML.qll b/java/ql/src/semmle/code/xml/XML.qll
index 5871fed0dddd..7833f1bdb681 100755
--- a/java/ql/src/semmle/code/xml/XML.qll
+++ b/java/ql/src/semmle/code/xml/XML.qll
@@ -149,6 +149,8 @@ class XMLFile extends XMLParent, File {
 
   /** Gets a DTD associated with this XML file. */
   XMLDTD getADTD() { xmlDTDs(result, _, _, _, this) }
+
+  override string getAPrimaryQlClass() { result = "XMLFile" }
 }
 
 /**

From dee974ff2d9ab9e442b03d8ece4520d0ffbcc5a8 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Tue, 13 Apr 2021 09:13:47 +0100
Subject: [PATCH 219/433] Make Call a subclass of ExprParent. All of its
 subclasses are in any case (via Expr or Stmt)

---
 java/ql/src/semmle/code/java/Expr.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/Expr.qll b/java/ql/src/semmle/code/java/Expr.qll
index a1a1412221b6..46186b4ee703 100755
--- a/java/ql/src/semmle/code/java/Expr.qll
+++ b/java/ql/src/semmle/code/java/Expr.qll
@@ -1808,7 +1808,7 @@ class WildcardTypeAccess extends Expr, @wildcardtypeaccess {
  * This includes method calls, constructor and super constructor invocations,
  * and constructors invoked through class instantiation.
  */
-class Call extends Top, @caller {
+class Call extends ExprParent, @caller {
   /** Gets an argument supplied in this call. */
   /*abstract*/ Expr getAnArgument() { none() }
 

From 15c103e42d25b79ec8e9e8d782052d31ec567be4 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 13 Apr 2021 10:57:15 +0200
Subject: [PATCH 220/433] C#: Remove code duplication in `BuildScripts.cs`

---
 .../BuildScripts.cs                           | 50 +++++++------------
 1 file changed, 19 insertions(+), 31 deletions(-)

diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
index 9334181fe5a6..99ad4c8f963f 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
@@ -976,12 +976,11 @@ Microsoft.NETCore.App 2.1.3 [/usr/local/share/dotnet/shared/Microsoft.NETCore.Ap
             TestAutobuilderScript(autobuilder, 0, 9);
         }
 
-        [Fact]
-        public void TestDotnetVersionWindows()
+        private void TestDotnetVersionWindows(Action action, int commandsRun)
         {
             actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
             actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
+            action();
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
@@ -1004,39 +1003,28 @@ public void TestDotnetVersionWindows()
             actions.LoadXml[@"C:\Project\test.csproj"] = xml;
 
             var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
-            TestAutobuilderScript(autobuilder, 0, 6);
+            TestAutobuilderScript(autobuilder, 0, commandsRun);
         }
 
         [Fact]
-        public void TestDotnetVersionWindowsNoPwsh()
+        public void TestDotnetVersionWindowsWithPwsh()
         {
-            actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
-            actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 1;
-            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
-            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
-            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
-            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
-            actions.RunProcess[@"cmd.exe /C C:\odasa\tools\odasa index --auto C:\Project\.dotnet\dotnet build --no-incremental C:\Project\test.csproj"] = 0;
-            actions.FileExists["csharp.log"] = true;
-            actions.FileExists[@"C:\Project\test.csproj"] = true;
-            actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
-            actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_SOURCE_ARCHIVE_DIR"] = "";
-            actions.GetEnvironmentVariable["PATH"] = "/bin:/usr/bin";
-            actions.EnumerateFiles[@"C:\Project"] = "foo.cs\ntest.cs\ntest.csproj";
-            actions.EnumerateDirectories[@"C:\Project"] = "";
-            var xml = new XmlDocument();
-            xml.LoadXml(@"<Project Sdk=""Microsoft.NET.Sdk"">
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp2.1</TargetFramework>
-  </PropertyGroup>
-
-</Project>");
-            actions.LoadXml[@"C:\Project\test.csproj"] = xml;
+            TestDotnetVersionWindows(() =>
+            {
+                actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
+            },
+            6);
+        }
 
-            var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
-            TestAutobuilderScript(autobuilder, 0, 7);
+        [Fact]
+        public void TestDotnetVersionWindowsWithoutPwsh()
+        {
+            TestDotnetVersionWindows(() =>
+            {
+                actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 1;
+                actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
+            },
+            7);
         }
 
         [Fact]

From 7c0b0642c89efb06eca443ba46bb7e2738807aac Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 13 Apr 2021 11:09:27 +0200
Subject: [PATCH 221/433] Python: Add imports to make code compile

---
 python/ql/src/Security/CWE-327/FluentApiModel.qll  | 1 +
 python/ql/src/Security/CWE-327/InsecureProtocol.ql | 1 +
 2 files changed, 2 insertions(+)

diff --git a/python/ql/src/Security/CWE-327/FluentApiModel.qll b/python/ql/src/Security/CWE-327/FluentApiModel.qll
index 6010417b68d6..a66f949e72d6 100644
--- a/python/ql/src/Security/CWE-327/FluentApiModel.qll
+++ b/python/ql/src/Security/CWE-327/FluentApiModel.qll
@@ -1,4 +1,5 @@
 private import python
+private import semmle.python.dataflow.new.DataFlow
 import TlsLibraryModel
 
 /**
diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index e31bf78443b2..99e2d83420d1 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -10,6 +10,7 @@
  */
 
 import python
+import semmle.python.dataflow.new.DataFlow
 import FluentApiModel
 
 // Helper for pretty printer `configName`.

From 178cb6c90faa726331b5b6658863b22d156130c2 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 13 Apr 2021 11:26:05 +0200
Subject: [PATCH 222/433] Python: Bit too eager with the modernisation... Lift
 type restrictions to recover results.

---
 python/ql/src/Security/CWE-327/Ssl.qll | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index 99bb24b7076e..c1c6d65402ce 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -45,7 +45,7 @@ class WrapSocketCall extends ConnectionCreation, DataFlow::CallCfgNode {
   }
 }
 
-class OptionsAugOr extends ProtocolRestriction, DataFlow::CallCfgNode {
+class OptionsAugOr extends ProtocolRestriction, DataFlow::CfgNode {
   ProtocolVersion restriction;
 
   OptionsAugOr() {
@@ -68,7 +68,7 @@ class OptionsAugOr extends ProtocolRestriction, DataFlow::CallCfgNode {
   override ProtocolVersion getRestriction() { result = restriction }
 }
 
-class OptionsAugAndNot extends ProtocolUnrestriction, DataFlow::CallCfgNode {
+class OptionsAugAndNot extends ProtocolUnrestriction, DataFlow::CfgNode {
   ProtocolVersion restriction;
 
   OptionsAugAndNot() {
@@ -126,7 +126,7 @@ predicate impliesBitSet(BinaryExpr whole, Expr part, boolean partHasBitSet, bool
   )
 }
 
-class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction, DataFlow::CallCfgNode {
+class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction, DataFlow::CfgNode {
   ProtocolVersion restriction;
 
   ContextSetVersion() {

From 7c13163413f3167355ec449d08579c704675c7f5 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 1 Apr 2021 11:49:17 +0100
Subject: [PATCH 223/433] JS: Lift JSON accessors to JSONValue

---
 javascript/ql/src/semmle/javascript/JSON.qll | 29 +++++++++++++-------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/JSON.qll b/javascript/ql/src/semmle/javascript/JSON.qll
index f0f4f59e98ef..ed3f6f69637b 100644
--- a/javascript/ql/src/semmle/javascript/JSON.qll
+++ b/javascript/ql/src/semmle/javascript/JSON.qll
@@ -41,6 +41,21 @@ class JSONValue extends @json_value, Locatable {
     )
   }
 
+  /** If this is an object, gets the value of property `name`. */
+  JSONValue getPropValue(string name) { json_properties(this, name, result) }
+
+  /** If this is an array, gets the value of the `i`th element. */
+  JSONValue getElementValue(int i) { result = this.(JSONArray).getChild(i) }
+
+  /** If this is a string constant, gets the value of the string. */
+  string getStringValue() { result = this.(JSONString).getValue() }
+
+  /** If this is an integer constant, gets its numeric value. */
+  int getIntValue() { result = this.(JSONNumber).getValue().toInt() }
+
+  /** If this is a boolean constant, gets its boolean value. */
+  boolean getBooleanValue() { result.toString() = this.(JSONBoolean).getValue() }
+
   override string getAPrimaryQlClass() { result = "JSONValue" }
 }
 
@@ -129,13 +144,10 @@ class JSONString extends @json_string, JSONPrimitiveValue {
  * ```
  */
 class JSONArray extends @json_array, JSONValue {
-  /** Gets the value of the `i`th element of this array. */
-  JSONValue getElementValue(int i) { result = getChild(i) }
+  override string getAPrimaryQlClass() { result = "JSONArray" }
 
   /** Gets the string value of the `i`th element of this array. */
-  string getElementStringValue(int i) { result = getElementValue(i).(JSONString).getValue() }
-
-  override string getAPrimaryQlClass() { result = "JSONArray" }
+  string getElementStringValue(int i) { result = getElementValue(i).getStringValue() }
 }
 
 /**
@@ -148,13 +160,10 @@ class JSONArray extends @json_array, JSONValue {
  * ```
  */
 class JSONObject extends @json_object, JSONValue {
-  /** Gets the value of property `name` of this object. */
-  JSONValue getPropValue(string name) { json_properties(this, name, result) }
+  override string getAPrimaryQlClass() { result = "JSONObject" }
 
   /** Gets the string value of property `name` of this object. */
-  string getPropStringValue(string name) { result = getPropValue(name).(JSONString).getValue() }
-
-  override string getAPrimaryQlClass() { result = "JSONObject" }
+  string getPropStringValue(string name) { result = getPropValue(name).getStringValue() }
 }
 
 /**

From 929d9da4b4c9d9830689ad01960eb1ce22dda406 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 9 Apr 2021 11:37:57 +0100
Subject: [PATCH 224/433] JS: Migrate to new JSON API

---
 .../ql/src/Declarations/UnusedVariable.ql     |  4 ++--
 javascript/ql/src/semmle/javascript/NPM.qll   | 22 +++++++++----------
 javascript/ql/src/semmle/javascript/Paths.qll | 12 +++-------
 .../semmle/javascript/frameworks/Babel.qll    |  8 +++----
 .../security/dataflow/RemoteFlowSources.qll   |  2 +-
 5 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/javascript/ql/src/Declarations/UnusedVariable.ql b/javascript/ql/src/Declarations/UnusedVariable.ql
index 90c3948b634f..738795571598 100644
--- a/javascript/ql/src/Declarations/UnusedVariable.ql
+++ b/javascript/ql/src/Declarations/UnusedVariable.ql
@@ -65,8 +65,8 @@ predicate isReactForJSX(UnusedLocal v) {
       v.getName() =
         tsconfig
             .getPropValue("compilerOptions")
-            .(JSONObject)
-            .getPropStringValue(["jsxFactory", "jsxFragmentFactory"])
+            .getPropValue(["jsxFactory", "jsxFragmentFactory"])
+            .getStringValue()
     )
   )
 }
diff --git a/javascript/ql/src/semmle/javascript/NPM.qll b/javascript/ql/src/semmle/javascript/NPM.qll
index 8351c4266cfc..abea13b9d723 100644
--- a/javascript/ql/src/semmle/javascript/NPM.qll
+++ b/javascript/ql/src/semmle/javascript/NPM.qll
@@ -41,7 +41,7 @@ class PackageJSON extends JSONObject {
 
   /** Gets information for a contributor to this package. */
   ContributorInfo getAContributor() {
-    result = getPropValue("contributors").(JSONArray).getElementValue(_)
+    result = getPropValue("contributors").getElementValue(_)
   }
 
   /** Gets the array of files for this package. */
@@ -57,13 +57,13 @@ class PackageJSON extends JSONObject {
   string getBin(string cmd) {
     cmd = getPackageName() and result = getPropStringValue("bin")
     or
-    result = getPropValue("bin").(JSONObject).getPropStringValue(cmd)
+    result = getPropValue("bin").getPropValue(cmd).getStringValue()
   }
 
   /** Gets a manual page for this package. */
   string getAManFile() {
     result = getPropStringValue("man") or
-    result = getPropValue("man").(JSONArray).getElementStringValue(_)
+    result = getPropValue("man").getElementValue(_).getStringValue()
   }
 
   /** Gets information about the directories of this package. */
@@ -191,12 +191,12 @@ class BugTrackerInfo extends JSONValue {
 
   /** Gets the bug tracker URL. */
   string getUrl() {
-    result = this.(JSONObject).getPropStringValue("url") or
-    result = this.(JSONString).getValue()
+    result = this.getPropValue("url").getStringValue() or
+    result = this.getStringValue()
   }
 
   /** Gets the bug reporting email address. */
-  string getEmail() { result = this.(JSONObject).getPropStringValue("email") }
+  string getEmail() { result = this.getPropValue("email").getStringValue() }
 }
 
 /**
@@ -206,7 +206,7 @@ class ContributorInfo extends JSONValue {
   ContributorInfo() {
     exists(PackageJSON pkg |
       this = pkg.getPropValue("author") or
-      this = pkg.getPropValue("contributors").(JSONArray).getElementValue(_)
+      this = pkg.getPropValue("contributors").getElementValue(_)
     ) and
     (this instanceof JSONObject or this instanceof JSONString)
   }
@@ -217,24 +217,24 @@ class ContributorInfo extends JSONValue {
    * homepage URL.
    */
   private string parseInfo(int group) {
-    result = this.(JSONString).getValue().regexpCapture("(.*?)(?: <(.*?)>)?(?: \\((.*)?\\))", group)
+    result = this.getStringValue().regexpCapture("(.*?)(?: <(.*?)>)?(?: \\((.*)?\\))", group)
   }
 
   /** Gets the contributor's name. */
   string getName() {
-    result = this.(JSONObject).getPropStringValue("name") or
+    result = this.getPropValue("name").getStringValue() or
     result = parseInfo(1)
   }
 
   /** Gets the contributor's email address. */
   string getEmail() {
-    result = this.(JSONObject).getPropStringValue("email") or
+    result = this.getPropValue("email").getStringValue() or
     result = parseInfo(2)
   }
 
   /** Gets the contributor's homepage URL. */
   string getUrl() {
-    result = this.(JSONObject).getPropStringValue("url") or
+    result = this.getPropValue("url").getStringValue() or
     result = parseInfo(3)
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/Paths.qll b/javascript/ql/src/semmle/javascript/Paths.qll
index 37098fc130f1..a166b0d2d94c 100644
--- a/javascript/ql/src/semmle/javascript/Paths.qll
+++ b/javascript/ql/src/semmle/javascript/Paths.qll
@@ -236,10 +236,8 @@ private module TypeScriptOutDir {
     result =
       tsconfig
           .getPropValue("compilerOptions")
-          .(JSONObject)
           .getPropValue("outDir")
-          .(JSONString)
-          .getValue()
+          .getStringValue()
   }
 
   /**
@@ -283,10 +281,8 @@ private module TypeScriptOutDir {
     result =
       getRootFolderFromPath(tsconfig
             .getPropValue("include")
-            .(JSONArray)
             .getElementValue(_)
-            .(JSONString)
-            .getValue())
+            .getStringValue())
   }
 
   /**
@@ -297,10 +293,8 @@ private module TypeScriptOutDir {
     result =
       tsconfig
           .getPropValue("compilerOptions")
-          .(JSONObject)
           .getPropValue("rootDir")
-          .(JSONString)
-          .getValue()
+          .getStringValue()
   }
 }
 
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Babel.qll b/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
index 9e112f057761..bdacce9142b8 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
@@ -24,9 +24,9 @@ module Babel {
         plugins = getPropValue("plugins") and
         result = plugins.getElementValue(_)
       |
-        result.(JSONString).getValue() = pluginName
+        result.getStringValue() = pluginName
         or
-        result.(JSONArray).getElementStringValue(0) = pluginName
+        result.getElementValue(0).getStringValue() = pluginName
       )
     }
 
@@ -67,7 +67,7 @@ module Babel {
     JSONValue getOptions() { result = this.(JSONArray).getElementValue(1) }
 
     /** Gets a named option from the option object, if present. */
-    JSONValue getOption(string name) { result = getOptions().(JSONObject).getPropValue(name) }
+    JSONValue getOption(string name) { result = getOptions().getPropValue(name) }
 
     /** Holds if this plugin applies to `tl`. */
     predicate appliesTo(TopLevel tl) { cfg.appliesTo(tl) }
@@ -186,7 +186,7 @@ module Babel {
     TransformReactJsxConfig() { pluginName = "transform-react-jsx" }
 
     /** Gets the name of the variable used to create JSX elements. */
-    string getJsxFactoryVariableName() { result = getOption("pragma").(JSONString).getValue() }
+    string getJsxFactoryVariableName() { result = getOption("pragma").getStringValue() }
   }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
index c5a39772cf4f..89574f4886b1 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
@@ -108,7 +108,7 @@ private class RemoteFlowSourceAccessPath extends JSONString {
     exists(JSONObject specs |
       specs.isTopLevel() and
       this.getFile().getBaseName() = "codeql-javascript-remote-flow-sources.json" and
-      this = specs.getPropValue(sourceType).(JSONArray).getElementValue(_) and
+      this = specs.getPropValue(sourceType).getElementValue(_) and
       this.getValue().regexpMatch("window(\\.\\w+)+")
     )
   }

From e77117f902a7bc62771d6900fbd615cb54e1ab54 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 13 Apr 2021 10:16:41 +0100
Subject: [PATCH 225/433] JS: Autoformat

---
 javascript/ql/src/semmle/javascript/NPM.qll   |  4 +---
 javascript/ql/src/semmle/javascript/Paths.qll | 17 +++--------------
 2 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/NPM.qll b/javascript/ql/src/semmle/javascript/NPM.qll
index abea13b9d723..8c46cd5901bb 100644
--- a/javascript/ql/src/semmle/javascript/NPM.qll
+++ b/javascript/ql/src/semmle/javascript/NPM.qll
@@ -40,9 +40,7 @@ class PackageJSON extends JSONObject {
   ContributorInfo getAuthor() { result = getPropValue("author") }
 
   /** Gets information for a contributor to this package. */
-  ContributorInfo getAContributor() {
-    result = getPropValue("contributors").getElementValue(_)
-  }
+  ContributorInfo getAContributor() { result = getPropValue("contributors").getElementValue(_) }
 
   /** Gets the array of files for this package. */
   JSONArray getFiles() { result = getPropValue("files") }
diff --git a/javascript/ql/src/semmle/javascript/Paths.qll b/javascript/ql/src/semmle/javascript/Paths.qll
index a166b0d2d94c..64ff25c32208 100644
--- a/javascript/ql/src/semmle/javascript/Paths.qll
+++ b/javascript/ql/src/semmle/javascript/Paths.qll
@@ -233,11 +233,7 @@ private module TypeScriptOutDir {
     tsconfig.getFile().getBaseName().regexpMatch("tsconfig.*\\.json") and
     tsconfig.isTopLevel() and
     tsconfig.getFile().getParentContainer() = parent and
-    result =
-      tsconfig
-          .getPropValue("compilerOptions")
-          .getPropValue("outDir")
-          .getStringValue()
+    result = tsconfig.getPropValue("compilerOptions").getPropValue("outDir").getStringValue()
   }
 
   /**
@@ -279,10 +275,7 @@ private module TypeScriptOutDir {
   pragma[inline]
   private string getARootDirFromInclude(JSONObject tsconfig) {
     result =
-      getRootFolderFromPath(tsconfig
-            .getPropValue("include")
-            .getElementValue(_)
-            .getStringValue())
+      getRootFolderFromPath(tsconfig.getPropValue("include").getElementValue(_).getStringValue())
   }
 
   /**
@@ -290,11 +283,7 @@ private module TypeScriptOutDir {
    */
   pragma[inline]
   private string getRootDir(JSONObject tsconfig) {
-    result =
-      tsconfig
-          .getPropValue("compilerOptions")
-          .getPropValue("rootDir")
-          .getStringValue()
+    result = tsconfig.getPropValue("compilerOptions").getPropValue("rootDir").getStringValue()
   }
 }
 

From 30fbb8f1e7993ba509378c65e78d391aaa604791 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 13 Apr 2021 11:34:47 +0200
Subject: [PATCH 226/433] Python: clean up interface

---
 python/ql/src/Security/CWE-327/PyOpenSSL.qll       |  2 +-
 python/ql/src/Security/CWE-327/Ssl.qll             | 14 +++++++-------
 python/ql/src/Security/CWE-327/TlsLibraryModel.qll |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index 9f42b83572ed..d886d46efefa 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -69,7 +69,7 @@ class PyOpenSSL extends TlsLibrary {
     result instanceof PyOpenSSLContextCreation
   }
 
-  override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) { none() }
+  override DataFlow::Node insecure_connection_creation(ProtocolVersion version) { none() }
 
   override ConnectionCreation connection_creation() { result instanceof ConnectionCall }
 
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index c1c6d65402ce..e943470e917e 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -40,7 +40,7 @@ API::Node sslContextInstance() {
 class WrapSocketCall extends ConnectionCreation, DataFlow::CallCfgNode {
   WrapSocketCall() { this = sslContextInstance().getMember("wrap_socket").getACall() }
 
-  override DataFlow::CfgNode getContext() {
+  override DataFlow::Node getContext() {
     result = this.getFunction().(DataFlow::AttrRead).getObject()
   }
 }
@@ -63,7 +63,7 @@ class OptionsAugOr extends ProtocolRestriction, DataFlow::CfgNode {
     )
   }
 
-  override DataFlow::CfgNode getContext() { result = this }
+  override DataFlow::Node getContext() { result = this }
 
   override ProtocolVersion getRestriction() { result = restriction }
 }
@@ -88,7 +88,7 @@ class OptionsAugAndNot extends ProtocolUnrestriction, DataFlow::CfgNode {
     )
   }
 
-  override DataFlow::CfgNode getContext() { result = this }
+  override DataFlow::Node getContext() { result = this }
 
   override ProtocolVersion getUnrestriction() { result = restriction }
 }
@@ -138,7 +138,7 @@ class ContextSetVersion extends ProtocolRestriction, ProtocolUnrestriction, Data
     )
   }
 
-  override DataFlow::CfgNode getContext() { result = this }
+  override DataFlow::Node getContext() { result = this }
 
   override ProtocolVersion getRestriction() { result.lessThan(restriction) }
 
@@ -159,7 +159,7 @@ class UnspecificSSLContextCreation extends SSLContextCreation, UnspecificContext
 }
 
 class UnspecificSSLDefaultContextCreation extends SSLDefaultContextCreation, ProtocolUnrestriction {
-  override DataFlow::CfgNode getContext() { result = this }
+  override DataFlow::Node getContext() { result = this }
 
   // see https://docs.python.org/3/library/ssl.html#ssl.create_default_context
   override ProtocolVersion getUnrestriction() {
@@ -186,9 +186,9 @@ class Ssl extends TlsLibrary {
 
   override ContextCreation specific_context_creation() { result instanceof SSLContextCreation }
 
-  override DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version) {
+  override DataFlow::CallCfgNode insecure_connection_creation(ProtocolVersion version) {
     result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
-    this.specific_version(version) = result.(DataFlow::CallCfgNode).getArgByName("ssl_version") and
+    this.specific_version(version) = result.getArgByName("ssl_version") and
     version.isInsecure()
   }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index cd38ad4ab5ec..ba54ea3ccd42 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -124,7 +124,7 @@ abstract class TlsLibrary extends string {
   }
 
   /** A connection is created in an insecure manner, not from a context. */
-  abstract DataFlow::CfgNode insecure_connection_creation(ProtocolVersion version);
+  abstract DataFlow::Node insecure_connection_creation(ProtocolVersion version);
 
   /** A connection is created from a context. */
   abstract ConnectionCreation connection_creation();

From 45e1a61d7bc8996af158130449763b00bedd7a69 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Tue, 13 Apr 2021 10:11:37 +0100
Subject: [PATCH 227/433] Mark test as bad-but-missed

This test ought ideally to be caught, but isn't by the current version of the query.
---
 .../security/CWE-1004/SensitiveCookieNotHttpOnly.java         | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
index 4ad7aa5dd95e..627575c84034 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -137,7 +137,9 @@ public void addCookie14(HttpServletRequest request, HttpServletResponse response
         response.addCookie(createCookie("refresh_token", refreshToken, true));
     }
 
-    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
+    // BAD (but not detected) - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
+    // This example is missed because the `cookie.setHttpOnly` call in `createCookie` is thought to maybe set the HTTP-only flag, and the `cookie`
+    // object flows to this `addCookie` call.
     public void addCookie15(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
         response.addCookie(createCookie("refresh_token", refreshToken, false));
     }

From f22b11881e080e49a39773fe9c34d516e6a99b65 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Tue, 13 Apr 2021 10:28:15 +0100
Subject: [PATCH 228/433] Minimise stubs

By removing all business logic from the stubs, we better test that our analysis treats them as opaque and does not rely on their internal structure
---
 .../javax/ws/rs/core/Cookie.java              | 12 -------
 .../javax/ws/rs/core/NewCookie.java           | 36 +++++--------------
 2 files changed, 8 insertions(+), 40 deletions(-)

diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
index 2726c3d27dda..6853f72ecd8d 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
@@ -56,11 +56,6 @@ public class Cookie {
      * Cookies using the default version correspond to RFC 2109.
      */
     public static final int DEFAULT_VERSION = 1;
-    private final String name;
-    private final String value;
-    private final int version;
-    private final String path;
-    private final String domain;
 
     /**
      * Create a new instance.
@@ -74,11 +69,6 @@ public class Cookie {
      */
     public Cookie(final String name, final String value, final String path, final String domain, final int version)
             throws IllegalArgumentException {
-        this.name = name;
-        this.value = value;
-        this.version = version;
-        this.domain = domain;
-        this.path = path;
     }
 
     /**
@@ -92,7 +82,6 @@ public Cookie(final String name, final String value, final String path, final St
      */
     public Cookie(final String name, final String value, final String path, final String domain)
             throws IllegalArgumentException {
-        this(name, value, path, domain, DEFAULT_VERSION);
     }
 
     /**
@@ -104,7 +93,6 @@ public Cookie(final String name, final String value, final String path, final St
      */
     public Cookie(final String name, final String value)
             throws IllegalArgumentException {
-        this(name, value, null, null);
     }
 
     /**
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
index 26279d7fe0a9..046bb15da123 100644
--- a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
@@ -57,12 +57,6 @@ public class NewCookie extends Cookie {
      */
     public static final int DEFAULT_MAX_AGE = -1;
 
-    private final String comment;
-    private final int maxAge;
-    private final Date expiry;
-    private final boolean secure;
-    private final boolean httpOnly;
-
     /**
      * Create a new instance.
      *
@@ -71,7 +65,7 @@ public class NewCookie extends Cookie {
      * @throws IllegalArgumentException if name is {@code null}.
      */
     public NewCookie(String name, String value) {
-        this(name, value, null, null, DEFAULT_VERSION, null, DEFAULT_MAX_AGE, null, false, false);
+        super("", "");
     }
 
     /**
@@ -93,7 +87,7 @@ public NewCookie(String name,
                      String comment,
                      int maxAge,
                      boolean secure) {
-        this(name, value, path, domain, DEFAULT_VERSION, comment, maxAge, null, secure, false);                  
+        super("", "");
     }
 
     /**
@@ -118,7 +112,7 @@ public NewCookie(String name,
                      int maxAge,
                      boolean secure,
                      boolean httpOnly) {
-        this(name, value, path, domain, DEFAULT_VERSION, comment, maxAge, null, secure, httpOnly);
+        super("", "");
     }
 
     /**
@@ -142,7 +136,7 @@ public NewCookie(String name,
                      String comment,
                      int maxAge,
                      boolean secure) {
-        this(name, value, path, domain, version, comment, maxAge, null, secure, false);                 
+        super("", "");
     }
 
     /**
@@ -171,12 +165,7 @@ public NewCookie(String name,
                      Date expiry,
                      boolean secure,
                      boolean httpOnly) {
-            super(name, value, path, domain, version);
-            this.comment = comment;
-            this.maxAge = maxAge;
-            this.expiry = expiry;
-            this.secure = secure;
-            this.httpOnly = httpOnly;
+        super("", "");
     }
 
     /**
@@ -186,7 +175,7 @@ public NewCookie(String name,
      * @throws IllegalArgumentException if cookie is {@code null}.
      */
     public NewCookie(Cookie cookie) {
-        this(cookie, null, DEFAULT_MAX_AGE, null, false, false);
+        super("", "");
     }
 
     /**
@@ -199,7 +188,7 @@ public NewCookie(Cookie cookie) {
      * @throws IllegalArgumentException if cookie is {@code null}.
      */
     public NewCookie(Cookie cookie, String comment, int maxAge, boolean secure) {
-        this(cookie, comment, maxAge, null, secure, false);
+        super("", "");
     }
 
     /**
@@ -215,16 +204,7 @@ public NewCookie(Cookie cookie, String comment, int maxAge, boolean secure) {
      * @since 2.0
      */
     public NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly) {
-        super(cookie == null ? null : cookie.getName(),
-        cookie == null ? null : cookie.getValue(),
-        cookie == null ? null : cookie.getPath(),
-        cookie == null ? null : cookie.getDomain(),
-        cookie == null ? Cookie.DEFAULT_VERSION : cookie.getVersion());
-        this.comment = comment;
-        this.maxAge = maxAge;
-        this.expiry = expiry;
-        this.secure = secure;
-        this.httpOnly = httpOnly;        
+        super("", "");
     }
 
     /**

From 98d936d8b3e8a232355b4dacce7f4971273aba0a Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 11:43:00 +0000
Subject: [PATCH 229/433] Python: Tornado cleanup using API graphs

I wasn't able to roll out API graphs as widely in Tornado as I had
hoped, since we're lacking the "def" part. This means most of the
`InstanceSource` machinery will have to stay.
---
 .../src/semmle/python/frameworks/Tornado.qll  | 195 +++---------------
 1 file changed, 32 insertions(+), 163 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index a43edcaca901..6268c9f0a4dd 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -8,6 +8,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import semmle.python.regex
 
 /**
@@ -19,54 +20,13 @@ private module Tornado {
   // tornado
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `tornado` module. */
-  private DataFlow::Node tornado(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("tornado")
-    or
-    exists(DataFlow::TypeTracker t2 | result = tornado(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `tornado` module. */
-  DataFlow::Node tornado() { result = tornado(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `tornado` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node tornado_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["web", "httputil"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("tornado" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = tornado()
-    )
-    or
-    // Due to bad performance when using normal setup with `tornado_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        tornado_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate tornado_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(tornado_attr(t2, attr_name), res, summary)
-  }
+  API::Node tornado() { result = API::moduleImport("tornado") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `tornado` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node tornado_attr(string attr_name) {
-    result = tornado_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node tornado_attr(string attr_name) { result = tornado().getMember(attr_name) }
 
   /** Provides models for the `tornado` module. */
   module tornado {
@@ -74,7 +34,7 @@ private module Tornado {
     // tornado.web
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.web` module. */
-    DataFlow::Node web() { result = tornado_attr("web") }
+    API::Node web() { result = tornado_attr("web") }
 
     /** Provides models for the `tornado.web` module */
     module web {
@@ -82,41 +42,7 @@ private module Tornado {
        * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node web_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["RequestHandler", "Application"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("tornado.web" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = web()
-        )
-        or
-        // Due to bad performance when using normal setup with `web_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            web_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate web_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(web_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node web_attr(string attr_name) {
-        result = web_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node web_attr(string attr_name) { result = web().getMember(attr_name) }
 
       /**
        * Provides models for the `tornado.web.RequestHandler` class and subclasses.
@@ -125,22 +51,11 @@ private module Tornado {
        */
       module RequestHandler {
         /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
-        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = web_attr("RequestHandler")
-          or
-          // subclasses in project code
-          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
-        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+        API::Node subclassRef() { result = web_attr("RequestHandler").getASubclass*() }
 
         /** A RequestHandler class (most likely in project code). */
         class RequestHandlerClass extends Class {
-          RequestHandlerClass() { this.getParent() = subclassRef().asExpr() }
+          RequestHandlerClass() { this.getParent() = subclassRef().getAUse().asExpr() }
 
           /** Gets a function that could handle incoming requests, if any. */
           Function getARequestHandler() {
@@ -151,7 +66,7 @@ private module Tornado {
           }
 
           /** Gets a reference to this class. */
-          private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode getARef(DataFlow::TypeTracker t) {
             t.start() and
             result.asExpr().(ClassExpr) = this.getParent()
             or
@@ -159,7 +74,7 @@ private module Tornado {
           }
 
           /** Gets a reference to this class. */
-          DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
+          DataFlow::Node getARef() { this.getARef(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -184,7 +99,7 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -192,10 +107,10 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
-        private DataFlow::Node argumentMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode argumentMethod(DataFlow::TypeTracker t) {
           t.startInAttr(["get_argument", "get_body_argument", "get_query_argument"]) and
           result = instance()
           or
@@ -203,10 +118,12 @@ private module Tornado {
         }
 
         /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
-        DataFlow::Node argumentMethod() { result = argumentMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node argumentMethod() {
+          argumentMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
-        private DataFlow::Node argumentsMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode argumentsMethod(DataFlow::TypeTracker t) {
           t.startInAttr(["get_arguments", "get_body_arguments", "get_query_arguments"]) and
           result = instance()
           or
@@ -217,7 +134,7 @@ private module Tornado {
         DataFlow::Node argumentsMethod() { result = argumentsMethod(DataFlow::TypeTracker::end()) }
 
         /** Gets a reference the `redirect` method. */
-        private DataFlow::Node redirectMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode redirectMethod(DataFlow::TypeTracker t) {
           t.startInAttr("redirect") and
           result = instance()
           or
@@ -225,10 +142,12 @@ private module Tornado {
         }
 
         /** Gets a reference the `redirect` method. */
-        DataFlow::Node redirectMethod() { result = redirectMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node redirectMethod() {
+          redirectMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference to the `write` method. */
-        private DataFlow::Node writeMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode writeMethod(DataFlow::TypeTracker t) {
           t.startInAttr("write") and
           result = instance()
           or
@@ -236,7 +155,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `write` method. */
-        DataFlow::Node writeMethod() { result = writeMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node writeMethod() { writeMethod(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
           override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
@@ -279,15 +198,7 @@ private module Tornado {
        */
       module Application {
         /** Gets a reference to the `tornado.web.Application` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = web_attr("Application")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.web.Application` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+        API::Node classRef() { result = web_attr("Application") }
 
         /**
          * A source of instances of `tornado.web.Application`, extend this class to model new instances.
@@ -304,11 +215,11 @@ private module Tornado {
         class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
           override CallNode node;
 
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `tornado.web.Application`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -316,10 +227,10 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of `tornado.web.Application`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to the `add_handlers` method. */
-        private DataFlow::Node add_handlers(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode add_handlers(DataFlow::TypeTracker t) {
           t.startInAttr("add_handlers") and
           result = instance()
           or
@@ -327,7 +238,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `add_handlers` method. */
-        DataFlow::Node add_handlers() { result = add_handlers(DataFlow::TypeTracker::end()) }
+        DataFlow::Node add_handlers() { add_handlers(DataFlow::TypeTracker::end()).flowsTo(result) }
       }
     }
 
@@ -335,7 +246,7 @@ private module Tornado {
     // tornado.httputil
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.httputil` module. */
-    DataFlow::Node httputil() { result = tornado_attr("httputil") }
+    API::Node httputil() { result = tornado_attr("httputil") }
 
     /** Provides models for the `tornado.httputil` module */
     module httputil {
@@ -343,41 +254,7 @@ private module Tornado {
        * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node httputil_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["HTTPServerRequest"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("tornado.httputil" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = httputil()
-        )
-        or
-        // Due to bad performance when using normal setup with `httputil_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            httputil_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate httputil_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(httputil_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node httputil_attr(string attr_name) {
-        result = httputil_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node httputil_attr(string attr_name) { result = httputil().getMember(attr_name) }
 
       /**
        * Provides models for the `tornado.httputil.HttpServerRequest` class
@@ -386,15 +263,7 @@ private module Tornado {
        */
       module HttpServerRequest {
         /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = httputil_attr("HttpServerRequest")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+        API::Node classRef() { result = httputil_attr("HttpServerRequest") }
 
         /**
          * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
@@ -411,7 +280,7 @@ private module Tornado {
         private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
           override CallNode node;
 
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */

From f93b68d4dc2683186a9c6513417c1a38e1fadf0a Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 11:57:59 +0000
Subject: [PATCH 230/433] Python: Get rid of `_attr` methods

---
 .../src/semmle/python/frameworks/Tornado.qll  | 35 ++++++-------------
 1 file changed, 10 insertions(+), 25 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 6268c9f0a4dd..509193c51600 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -22,27 +22,16 @@ private module Tornado {
   /** Gets a reference to the `tornado` module. */
   API::Node tornado() { result = API::moduleImport("tornado") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `tornado` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node tornado_attr(string attr_name) { result = tornado().getMember(attr_name) }
-
   /** Provides models for the `tornado` module. */
   module tornado {
     // -------------------------------------------------------------------------
     // tornado.web
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.web` module. */
-    API::Node web() { result = tornado_attr("web") }
+    API::Node web() { result = tornado().getMember("web") }
 
     /** Provides models for the `tornado.web` module */
     module web {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node web_attr(string attr_name) { result = web().getMember(attr_name) }
 
       /**
        * Provides models for the `tornado.web.RequestHandler` class and subclasses.
@@ -51,7 +40,7 @@ private module Tornado {
        */
       module RequestHandler {
         /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
-        API::Node subclassRef() { result = web_attr("RequestHandler").getASubclass*() }
+        API::Node subclassRef() { result = web().getMember("RequestHandler").getASubclass*() }
 
         /** A RequestHandler class (most likely in project code). */
         class RequestHandlerClass extends Class {
@@ -198,7 +187,7 @@ private module Tornado {
        */
       module Application {
         /** Gets a reference to the `tornado.web.Application` class. */
-        API::Node classRef() { result = web_attr("Application") }
+        API::Node classRef() { result = web().getMember("Application") }
 
         /**
          * A source of instances of `tornado.web.Application`, extend this class to model new instances.
@@ -246,15 +235,10 @@ private module Tornado {
     // tornado.httputil
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.httputil` module. */
-    API::Node httputil() { result = tornado_attr("httputil") }
+    API::Node httputil() { result = tornado().getMember("httputil") }
 
     /** Provides models for the `tornado.httputil` module */
     module httputil {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node httputil_attr(string attr_name) { result = httputil().getMember(attr_name) }
 
       /**
        * Provides models for the `tornado.httputil.HttpServerRequest` class
@@ -263,7 +247,7 @@ private module Tornado {
        */
       module HttpServerRequest {
         /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        API::Node classRef() { result = httputil_attr("HttpServerRequest") }
+        API::Node classRef() { result = httputil().getMember("HttpServerRequest") }
 
         /**
          * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
@@ -284,7 +268,7 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -292,10 +276,11 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
+        
 
         /** Gets a reference to the `full_url` method. */
-        private DataFlow::Node full_url(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode full_url(DataFlow::TypeTracker t) {
           t.startInAttr("full_url") and
           result = instance()
           or
@@ -303,7 +288,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `full_url` method. */
-        DataFlow::Node full_url() { result = full_url(DataFlow::TypeTracker::end()) }
+        DataFlow::Node full_url() { full_url(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
           override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

From 1a4845f4174e51bc439b521bf42cf3ba67f5dbca Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 12:20:08 +0000
Subject: [PATCH 231/433] Python: Restrict types a bit

The `CallCfgNode` restrictions are familiar and useful.

Restricting `InstanceSource` to extend `LocalSourceNode` is novel, but I
think it makes sense. It will act as a good reminder to anyone extending
`InstanceSource` that the node in question is a `LocalSourceNode`, which
will be enforced by the return type of the internal type tracker anyway.
---
 .../src/semmle/python/frameworks/Tornado.qll  | 33 +++++++------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 509193c51600..f82e093cb94f 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -32,7 +32,6 @@ private module Tornado {
 
     /** Provides models for the `tornado.web` module */
     module web {
-
       /**
        * Provides models for the `tornado.web.RequestHandler` class and subclasses.
        *
@@ -75,7 +74,7 @@ private module Tornado {
          *
          * Use the predicate `RequestHandler::instance()` to get references to instances of the `tornado.web.RequestHandler` class or any subclass.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** The `self` parameter in a method on the `tornado.web.RequestHandler` class or any subclass. */
         private class SelfParam extends InstanceSource, RemoteFlowSource::Range,
@@ -120,7 +119,9 @@ private module Tornado {
         }
 
         /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
-        DataFlow::Node argumentsMethod() { result = argumentsMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node argumentsMethod() {
+          argumentsMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference the `redirect` method. */
         private DataFlow::LocalSourceNode redirectMethod(DataFlow::TypeTracker t) {
@@ -198,12 +199,10 @@ private module Tornado {
          *
          * Use the predicate `Application::instance()` to get references to instances of `tornado.web.Application`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** A direct instantiation of `tornado.web.Application`. */
-        class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
+        class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
           ClassInstantiation() { this = classRef().getACall() }
         }
 
@@ -239,7 +238,6 @@ private module Tornado {
 
     /** Provides models for the `tornado.httputil` module */
     module httputil {
-
       /**
        * Provides models for the `tornado.httputil.HttpServerRequest` class
        *
@@ -258,12 +256,10 @@ private module Tornado {
          *
          * Use the predicate `HttpServerRequest::instance()` to get references to instances of `tornado.httputil.HttpServerRequest`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** A direct instantiation of `tornado.httputil.HttpServerRequest`. */
-        private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
+        private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
           ClassInstantiation() { this = classRef().getACall() }
         }
 
@@ -277,7 +273,6 @@ private module Tornado {
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
         DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
-        
 
         /** Gets a reference to the `full_url` method. */
         private DataFlow::LocalSourceNode full_url(DataFlow::TypeTracker t) {
@@ -430,11 +425,9 @@ private module Tornado {
    * See https://www.tornadoweb.org/en/stable/web.html?highlight=write#tornado.web.RequestHandler.redirect
    */
   private class TornadoRequestHandlerRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
+    DataFlow::CallCfgNode {
     TornadoRequestHandlerRedirectCall() {
-      node.getFunction() = tornado::web::RequestHandler::redirectMethod().asCfgNode()
+      this.getFunction() = tornado::web::RequestHandler::redirectMethod()
     }
 
     override DataFlow::Node getRedirectLocation() {
@@ -454,11 +447,9 @@ private module Tornado {
    * See https://www.tornadoweb.org/en/stable/web.html?highlight=write#tornado.web.RequestHandler.write
    */
   private class TornadoRequestHandlerWriteCall extends HTTP::Server::HttpResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
+    DataFlow::CallCfgNode {
     TornadoRequestHandlerWriteCall() {
-      node.getFunction() = tornado::web::RequestHandler::writeMethod().asCfgNode()
+      this.getFunction() = tornado::web::RequestHandler::writeMethod()
     }
 
     override DataFlow::Node getBody() {

From 7825a2cdfcc99c940cae55acc95058df534c48e4 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 12:48:45 +0000
Subject: [PATCH 232/433] Python: Add change note

---
 python/change-notes/2021-04-13-pep249-api-graphs.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 python/change-notes/2021-04-13-pep249-api-graphs.md

diff --git a/python/change-notes/2021-04-13-pep249-api-graphs.md b/python/change-notes/2021-04-13-pep249-api-graphs.md
new file mode 100644
index 000000000000..d06b2bffd0cf
--- /dev/null
+++ b/python/change-notes/2021-04-13-pep249-api-graphs.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* Modelling of libraries supporting PEP249 has been changed to use API graphs. When defining new
+  models, the relevant extension point is now `PEP249ModuleApiNode` in the `PEP249` module, instead
+  of `PEP249Module`. The latter class has now been deprecated.

From a404faa302b634a77fb220118d906f9e240fc02f Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Tue, 13 Apr 2021 15:05:44 +0200
Subject: [PATCH 233/433] Python: Use American English in change note

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 python/change-notes/2021-04-13-pep249-api-graphs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/change-notes/2021-04-13-pep249-api-graphs.md b/python/change-notes/2021-04-13-pep249-api-graphs.md
index d06b2bffd0cf..fb8e2f0b1fbc 100644
--- a/python/change-notes/2021-04-13-pep249-api-graphs.md
+++ b/python/change-notes/2021-04-13-pep249-api-graphs.md
@@ -1,4 +1,4 @@
 lgtm,codescanning
-* Modelling of libraries supporting PEP249 has been changed to use API graphs. When defining new
+* Modeling of libraries supporting PEP249 has been changed to use API graphs. When defining new
   models, the relevant extension point is now `PEP249ModuleApiNode` in the `PEP249` module, instead
   of `PEP249Module`. The latter class has now been deprecated.

From d1457995dd9fd565e18ec0c28fa5f1aa7199115b Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 13 Apr 2021 16:15:37 +0200
Subject: [PATCH 234/433] C++: Use range analysis in Overflow.qll

---
 cpp/ql/src/semmle/code/cpp/security/Overflow.qll           | 7 +++++--
 .../semmle/extreme/ArithmeticWithExtremeValues.expected    | 2 --
 .../query-tests/Security/CWE/CWE-190/semmle/extreme/test.c | 4 ++--
 .../CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected  | 3 ---
 4 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
index e7ad1c559e63..3f7a7b17b059 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -5,6 +5,7 @@
 
 import cpp
 import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
 /**
  * Holds if the value of `use` is guarded using `abs`.
@@ -94,9 +95,10 @@ predicate guardedGreater(Operation e, Expr use) {
 VariableAccess varUse(LocalScopeVariable v) { result = v.getAnAccess() }
 
 /**
- * Holds if `e` is not guarded against overflow by `use`.
+ * Holds if `e` potentially overflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
+  convertedExprMightOverflow(e) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // overflow possible if large
@@ -115,9 +117,10 @@ predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
 }
 
 /**
- * Holds if `e` is not guarded against underflow by `use`.
+ * Holds if `e` potentially underflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstUnderflow(Operation e, VariableAccess use) {
+  convertedExprMightOverflowNegatively(e) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // underflow possible if use is left operand and small
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
index a46371f36b6c..cbaf5d630795 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
@@ -3,6 +3,4 @@
 | test.c:50:3:50:5 | sc3 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:49:9:49:16 | 127 | Extreme value |
 | test.c:59:3:59:5 | sc6 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value |
 | test.c:63:3:63:5 | sc8 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value |
-| test.c:75:3:75:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
-| test.c:76:3:76:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
 | test.c:124:9:124:9 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:118:17:118:23 | 2147483647 | Extreme value |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
index 8c40d984ee0a..8760641c8e2d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
@@ -72,8 +72,8 @@ void test_negatives() {
   signed char sc1, sc2, sc3, sc4, sc5, sc6, sc7, sc8;
 
   sc1 = CHAR_MAX;
-  sc1 += 0; // GOOD [FALSE POSITIVE]
-  sc1 += -1; // GOOD [FALSE POSITIVE]
+  sc1 += 0; // GOOD
+  sc1 += -1; // GOOD
   sc2 = CHAR_MIN;
   sc2 += -1; // BAD [NOT DETECTED]
   sc3 = CHAR_MIN;
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
index 8bb25025b868..bdf00e0a5df5 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
@@ -1,8 +1,5 @@
 | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
 | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
-| test3.c:15:10:15:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
-| test3.c:15:14:15:14 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
-| test3.c:15:18:15:18 | z | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
 | test5.cpp:17:6:17:18 | call to getTaintedInt | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
 | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
 | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |

From 10084115947e610724e8b6fd2d42e1f4ea7d7327 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 14:49:44 +0000
Subject: [PATCH 235/433] Python: Use API graphs in Fabric model

---
 .../src/semmle/python/frameworks/Fabric.qll   | 360 ++----------------
 1 file changed, 41 insertions(+), 319 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Fabric.qll b/python/ql/src/semmle/python/frameworks/Fabric.qll
index 764dce0de808..6e92cddfdfd7 100644
--- a/python/ql/src/semmle/python/frameworks/Fabric.qll
+++ b/python/ql/src/semmle/python/frameworks/Fabric.qll
@@ -11,6 +11,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
 /**
  * Provides classes modeling security-relevant aspects of the `fabric` PyPI package, for
@@ -20,54 +21,13 @@ private import semmle.python.Concepts
  */
 private module FabricV1 {
   /** Gets a reference to the `fabric` module. */
-  private DataFlow::Node fabric(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("fabric")
-    or
-    exists(DataFlow::TypeTracker t2 | result = fabric(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `fabric` module. */
-  DataFlow::Node fabric() { result = fabric(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["api"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("fabric" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = fabric()
-    )
-    or
-    // Due to bad performance when using normal setup with `fabric_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        fabric_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate fabric_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(fabric_attr(t2, attr_name), res, summary)
-  }
+  API::Node fabric() { result = API::moduleImport("fabric") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `fabric` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node fabric_attr(string attr_name) {
-    result = fabric_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node fabric_attr(string attr_name) { result = fabric().getMember(attr_name) }
 
   /** Provides models for the `fabric` module. */
   module fabric {
@@ -75,7 +35,7 @@ private module FabricV1 {
     // fabric.api
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.api` module. */
-    DataFlow::Node api() { result = fabric_attr("api") }
+    API::Node api() { result = fabric_attr("api") }
 
     /** Provides models for the `fabric.api` module */
     module api {
@@ -83,41 +43,7 @@ private module FabricV1 {
        * Gets a reference to the attribute `attr_name` of the `fabric.api` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node api_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["run", "local", "sudo"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.api" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = api()
-        )
-        or
-        // Due to bad performance when using normal setup with `api_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            api_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate api_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(api_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.api` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node api_attr(string attr_name) {
-        result = api_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node api_attr(string attr_name) { result = api().getMember(attr_name) }
 
       /**
        * A call to either
@@ -130,12 +56,8 @@ private module FabricV1 {
        * - https://docs.fabfile.org/en/1.14/api/core/operations.html#fabric.operations.sudo
        */
       private class FabricApiLocalRunSudoCall extends SystemCommandExecution::Range,
-        DataFlow::CfgNode {
-        override CallNode node;
-
-        FabricApiLocalRunSudoCall() {
-          node.getFunction() = api_attr(["local", "run", "sudo"]).asCfgNode()
-        }
+        DataFlow::CallCfgNode {
+        FabricApiLocalRunSudoCall() { this = api_attr(["local", "run", "sudo"]).getACall() }
 
         override DataFlow::Node getCommand() {
           result.asCfgNode() = [node.getArg(0), node.getArgByName("command")]
@@ -153,61 +75,13 @@ private module FabricV1 {
  */
 private module FabricV2 {
   /** Gets a reference to the `fabric` module. */
-  private DataFlow::Node fabric(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("fabric")
-    or
-    exists(DataFlow::TypeTracker t2 | result = fabric(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `fabric` module. */
-  DataFlow::Node fabric() { result = fabric(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        // connection.py
-        "connection", "Connection",
-        // group.py
-        "group", "SerialGroup", "ThreadingGroup",
-        // tasks.py
-        "tasks", "task"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("fabric" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = fabric()
-    )
-    or
-    // Due to bad performance when using normal setup with `fabric_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        fabric_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate fabric_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(fabric_attr(t2, attr_name), res, summary)
-  }
+  API::Node fabric() { result = API::moduleImport("fabric") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `fabric` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node fabric_attr(string attr_name) {
-    result = fabric_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node fabric_attr(string attr_name) { result = fabric().getMember(attr_name) }
 
   /** Provides models for the `fabric` module. */
   module fabric {
@@ -215,7 +89,7 @@ private module FabricV2 {
     // fabric.connection
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.connection` module. */
-    DataFlow::Node connection() { result = fabric_attr("connection") }
+    API::Node connection() { result = fabric_attr("connection") }
 
     /** Provides models for the `fabric.connection` module */
     module connection {
@@ -223,40 +97,8 @@ private module FabricV2 {
        * Gets a reference to the attribute `attr_name` of the `fabric.connection` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node connection_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["Connection"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.connection" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = connection()
-        )
-        or
-        // Due to bad performance when using normal setup with `connection_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            connection_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate connection_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(connection_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.connection` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node connection_attr(string attr_name) {
-        result = connection_attr(DataFlow::TypeTracker::end(), attr_name)
+      private API::Node connection_attr(string attr_name) {
+        result = connection().getMember(attr_name)
       }
 
       /**
@@ -266,20 +108,10 @@ private module FabricV2 {
        */
       module Connection {
         /** Gets a reference to the `fabric.connection.Connection` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = connection_attr("Connection")
-          or
-          // handle `fabric.Connection` alias
-          t.start() and
-          result = fabric_attr("Connection")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+        API::Node classRef() {
+          result in [fabric_attr("Connection"), connection_attr("Connection")]
         }
 
-        /** Gets a reference to the `fabric.connection.Connection` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
         /**
          * A source of instances of `fabric.connection.Connection`, extend this class to model new instances.
          *
@@ -289,16 +121,14 @@ private module FabricV2 {
          *
          * Use the predicate `Connection::instance()` to get references to instances of `fabric.connection.Connection`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
-
-        private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -306,7 +136,7 @@ private module FabricV2 {
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /**
          * Gets a reference to either `run`, `sudo`, or `local` method on a
@@ -317,7 +147,7 @@ private module FabricV2 {
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.sudo
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
          */
-        private DataFlow::Node instanceRunMethods(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instanceRunMethods(DataFlow::TypeTracker t) {
           t.startInAttr(["run", "sudo", "local"]) and
           result = instance()
           or
@@ -334,7 +164,7 @@ private module FabricV2 {
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
          */
         DataFlow::Node instanceRunMethods() {
-          result = instanceRunMethods(DataFlow::TypeTracker::end())
+          instanceRunMethods(DataFlow::TypeTracker::end()).flowsTo(result)
         }
       }
     }
@@ -347,11 +177,9 @@ private module FabricV2 {
      * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
      */
     private class FabricConnectionRunSudoLocalCall extends SystemCommandExecution::Range,
-      DataFlow::CfgNode {
-      override CallNode node;
-
+      DataFlow::CallCfgNode {
       FabricConnectionRunSudoLocalCall() {
-        node.getFunction() = fabric::connection::Connection::instanceRunMethods().asCfgNode()
+        this.getFunction() = fabric::connection::Connection::instanceRunMethods()
       }
 
       override DataFlow::Node getCommand() {
@@ -363,34 +191,19 @@ private module FabricV2 {
     // fabric.tasks
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.tasks` module. */
-    DataFlow::Node tasks() { result = fabric_attr("tasks") }
+    API::Node tasks() { result = fabric_attr("tasks") }
 
     /** Provides models for the `fabric.tasks` module */
     module tasks {
       /** Gets a reference to the `fabric.tasks.task` decorator. */
-      private DataFlow::Node task(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("fabric.tasks.task")
-        or
-        t.startInAttr("task") and
-        result = tasks()
-        or
-        // Handle `fabric.task` alias
-        t.startInAttr("task") and
-        result = fabric()
-        or
-        exists(DataFlow::TypeTracker t2 | result = task(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `fabric.tasks.task` decorator. */
-      DataFlow::Node task() { result = task(DataFlow::TypeTracker::end()) }
+      API::Node task() { result in [tasks().getMember("task"), fabric().getMember("task")] }
     }
 
     class FabricTaskFirstParamConnectionInstance extends fabric::connection::Connection::InstanceSource,
       DataFlow::ParameterNode {
       FabricTaskFirstParamConnectionInstance() {
         exists(Function func |
-          func.getADecorator() = fabric::tasks::task().asExpr() and
+          func.getADecorator() = fabric::tasks::task().getAUse().asExpr() and
           this.getParameter() = func.getArg(0)
         )
       }
@@ -400,7 +213,7 @@ private module FabricV2 {
     // fabric.group
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.group` module. */
-    DataFlow::Node group() { result = fabric_attr("group") }
+    API::Node group() { result = fabric_attr("group") }
 
     /** Provides models for the `fabric.group` module */
     module group {
@@ -408,41 +221,7 @@ private module FabricV2 {
        * Gets a reference to the attribute `attr_name` of the `fabric.group` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node group_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["SerialGroup", "ThreadingGroup"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.group" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = group()
-        )
-        or
-        // Due to bad performance when using normal setup with `group_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            group_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate group_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(group_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.group` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node group_attr(string attr_name) {
-        result = group_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node group_attr(string attr_name) { result = group().getMember(attr_name) }
 
       /**
        * Provides models for the `fabric.group.Group` class and its subclasses.
@@ -465,41 +244,20 @@ private module FabricV2 {
          *
          * Use `Group::subclassInstance()` predicate to get references to an instance of a subclass of `fabric.group.Group`.
          */
-        abstract class SubclassInstanceSource extends DataFlow::Node { }
-
-        /** Gets a reference to an instance of a subclass of `fabric.group.Group`. */
-        private DataFlow::Node subclassInstance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof SubclassInstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassInstance(t2).track(t2, t))
+        abstract class ModeledSubclass extends API::Node {
+          /** Gets a string representation of this element. */
+          override string toString() { result = this.(API::Node).toString() }
         }
 
         /** Gets a reference to an instance of a subclass of `fabric.group.Group`. */
-        DataFlow::Node subclassInstance() {
-          result = subclassInstance(DataFlow::TypeTracker::end())
-        }
+        API::Node subclassInstance() { result = any(ModeledSubclass m).getASubclass*().getReturn() }
 
         /**
          * Gets a reference to the `run` method on an instance of a subclass of `fabric.group.Group`.
          *
          * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
          */
-        private DataFlow::Node subclassInstanceRunMethod(DataFlow::TypeTracker t) {
-          t.startInAttr("run") and
-          result = subclassInstance()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassInstanceRunMethod(t2).track(t2, t))
-        }
-
-        /**
-         * Gets a reference to the `run` method on an instance of a subclass of `fabric.group.Group`.
-         *
-         * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
-         */
-        DataFlow::Node subclassInstanceRunMethod() {
-          result = subclassInstanceRunMethod(DataFlow::TypeTracker::end())
-        }
+        API::Node subclassInstanceRunMethod() { result = subclassInstance().getMember("run") }
       }
 
       /**
@@ -507,12 +265,8 @@ private module FabricV2 {
        *
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
        */
-      private class FabricGroupRunCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-        override CallNode node;
-
-        FabricGroupRunCall() {
-          node.getFunction() = fabric::group::Group::subclassInstanceRunMethod().asCfgNode()
-        }
+      private class FabricGroupRunCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+        FabricGroupRunCall() { this = fabric::group::Group::subclassInstanceRunMethod().getACall() }
 
         override DataFlow::Node getCommand() {
           result.asCfgNode() = [node.getArg(0), node.getArgByName("command")]
@@ -525,25 +279,8 @@ private module FabricV2 {
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.SerialGroup.
        */
       module SerialGroup {
-        /** Gets a reference to the `fabric.group.SerialGroup` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = group_attr("SerialGroup")
-          or
-          // Handle `fabric.SerialGroup` alias
-          t.start() and
-          result = fabric_attr("SerialGroup")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `fabric.group.SerialGroup` class. */
-        private DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
-        private class ClassInstantiation extends Group::SubclassInstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends Group::ModeledSubclass {
+          ClassInstantiation() { this in [group_attr("SerialGroup"), fabric_attr("SerialGroup")] }
         }
       }
 
@@ -553,25 +290,10 @@ private module FabricV2 {
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.ThreadingGroup.
        */
       module ThreadingGroup {
-        /** Gets a reference to the `fabric.group.ThreadingGroup` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = group_attr("ThreadingGroup")
-          or
-          // Handle `fabric.ThreadingGroup` alias
-          t.start() and
-          result = fabric_attr("ThreadingGroup")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `fabric.group.ThreadingGroup` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
-        private class ClassInstantiation extends Group::SubclassInstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends Group::ModeledSubclass {
+          ClassInstantiation() {
+            this in [group_attr("ThreadingGroup"), fabric_attr("ThreadingGroup")]
+          }
         }
       }
     }

From 7f131c1f352e7829fff6fab17fa38a51dd65dee7 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 14:55:44 +0000
Subject: [PATCH 236/433] Python: Get rid of `_attr` predicates

---
 .../src/semmle/python/frameworks/Fabric.qll   | 52 ++++---------------
 1 file changed, 11 insertions(+), 41 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Fabric.qll b/python/ql/src/semmle/python/frameworks/Fabric.qll
index 6e92cddfdfd7..177f5592f665 100644
--- a/python/ql/src/semmle/python/frameworks/Fabric.qll
+++ b/python/ql/src/semmle/python/frameworks/Fabric.qll
@@ -23,28 +23,16 @@ private module FabricV1 {
   /** Gets a reference to the `fabric` module. */
   API::Node fabric() { result = API::moduleImport("fabric") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node fabric_attr(string attr_name) { result = fabric().getMember(attr_name) }
-
   /** Provides models for the `fabric` module. */
   module fabric {
     // -------------------------------------------------------------------------
     // fabric.api
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.api` module. */
-    API::Node api() { result = fabric_attr("api") }
+    API::Node api() { result = fabric().getMember("api") }
 
     /** Provides models for the `fabric.api` module */
     module api {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.api` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node api_attr(string attr_name) { result = api().getMember(attr_name) }
-
       /**
        * A call to either
        * - `fabric.api.local`
@@ -57,7 +45,7 @@ private module FabricV1 {
        */
       private class FabricApiLocalRunSudoCall extends SystemCommandExecution::Range,
         DataFlow::CallCfgNode {
-        FabricApiLocalRunSudoCall() { this = api_attr(["local", "run", "sudo"]).getACall() }
+        FabricApiLocalRunSudoCall() { this = api().getMember(["local", "run", "sudo"]).getACall() }
 
         override DataFlow::Node getCommand() {
           result.asCfgNode() = [node.getArg(0), node.getArgByName("command")]
@@ -77,30 +65,16 @@ private module FabricV2 {
   /** Gets a reference to the `fabric` module. */
   API::Node fabric() { result = API::moduleImport("fabric") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node fabric_attr(string attr_name) { result = fabric().getMember(attr_name) }
-
   /** Provides models for the `fabric` module. */
   module fabric {
     // -------------------------------------------------------------------------
     // fabric.connection
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.connection` module. */
-    API::Node connection() { result = fabric_attr("connection") }
+    API::Node connection() { result = fabric().getMember("connection") }
 
     /** Provides models for the `fabric.connection` module */
     module connection {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.connection` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node connection_attr(string attr_name) {
-        result = connection().getMember(attr_name)
-      }
-
       /**
        * Provides models for the `fabric.connection.Connection` class
        *
@@ -109,7 +83,7 @@ private module FabricV2 {
       module Connection {
         /** Gets a reference to the `fabric.connection.Connection` class. */
         API::Node classRef() {
-          result in [fabric_attr("Connection"), connection_attr("Connection")]
+          result in [fabric().getMember("Connection"), connection().getMember("Connection")]
         }
 
         /**
@@ -136,7 +110,7 @@ private module FabricV2 {
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
+        DataFlow::LocalSourceNode instance() { result = instance(DataFlow::TypeTracker::end()) }
 
         /**
          * Gets a reference to either `run`, `sudo`, or `local` method on a
@@ -191,7 +165,7 @@ private module FabricV2 {
     // fabric.tasks
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.tasks` module. */
-    API::Node tasks() { result = fabric_attr("tasks") }
+    API::Node tasks() { result = fabric().getMember("tasks") }
 
     /** Provides models for the `fabric.tasks` module */
     module tasks {
@@ -213,16 +187,10 @@ private module FabricV2 {
     // fabric.group
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.group` module. */
-    API::Node group() { result = fabric_attr("group") }
+    API::Node group() { result = fabric().getMember("group") }
 
     /** Provides models for the `fabric.group` module */
     module group {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.group` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node group_attr(string attr_name) { result = group().getMember(attr_name) }
-
       /**
        * Provides models for the `fabric.group.Group` class and its subclasses.
        *
@@ -280,7 +248,9 @@ private module FabricV2 {
        */
       module SerialGroup {
         private class ClassInstantiation extends Group::ModeledSubclass {
-          ClassInstantiation() { this in [group_attr("SerialGroup"), fabric_attr("SerialGroup")] }
+          ClassInstantiation() {
+            this in [group().getMember("SerialGroup"), fabric().getMember("SerialGroup")]
+          }
         }
       }
 
@@ -292,7 +262,7 @@ private module FabricV2 {
       module ThreadingGroup {
         private class ClassInstantiation extends Group::ModeledSubclass {
           ClassInstantiation() {
-            this in [group_attr("ThreadingGroup"), fabric_attr("ThreadingGroup")]
+            this in [group().getMember("ThreadingGroup"), fabric().getMember("ThreadingGroup")]
           }
         }
       }

From 89a5acf6e884f2f897c068ebe8272798d0013d4d Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Tue, 13 Apr 2021 17:03:45 +0200
Subject: [PATCH 237/433] Java: Revert overriding XMLFile.getAPrimaryQlClass()

Library file has to be kept in sync with the other languages, however except
cpp none of them have the getAPrimaryQlClass() predicate declared in a
superclass. Therefore for simplicity revert the change for Java.
---
 java/ql/src/semmle/code/xml/XML.qll | 2 --
 1 file changed, 2 deletions(-)

diff --git a/java/ql/src/semmle/code/xml/XML.qll b/java/ql/src/semmle/code/xml/XML.qll
index 7833f1bdb681..5871fed0dddd 100755
--- a/java/ql/src/semmle/code/xml/XML.qll
+++ b/java/ql/src/semmle/code/xml/XML.qll
@@ -149,8 +149,6 @@ class XMLFile extends XMLParent, File {
 
   /** Gets a DTD associated with this XML file. */
   XMLDTD getADTD() { xmlDTDs(result, _, _, _, this) }
-
-  override string getAPrimaryQlClass() { result = "XMLFile" }
 }
 
 /**

From aa5258512048c2d6404acc221b6c4f66e98eab81 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 13 Apr 2021 17:17:05 +0200
Subject: [PATCH 238/433] C++: Add change-note.

---
 cpp/change-notes/2021-04-13-arithmetic-queries.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 cpp/change-notes/2021-04-13-arithmetic-queries.md

diff --git a/cpp/change-notes/2021-04-13-arithmetic-queries.md b/cpp/change-notes/2021-04-13-arithmetic-queries.md
new file mode 100644
index 000000000000..4d0f8833adc9
--- /dev/null
+++ b/cpp/change-notes/2021-04-13-arithmetic-queries.md
@@ -0,0 +1,2 @@
+lgtm
+* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

From 7ed09904b48867367a3f6445d9187ad75c72b8d2 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 15:21:19 +0000
Subject: [PATCH 239/433] Python: Use API graphs for Invoke

A few stragglers remain, as they are modelling the use of decorators.

They will be dealt with at a later date.
---
 .../src/semmle/python/frameworks/Invoke.qll   | 104 ++++--------------
 1 file changed, 21 insertions(+), 83 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Invoke.qll b/python/ql/src/semmle/python/frameworks/Invoke.qll
index 02db1cb5db2b..5b5a5e6e7f06 100644
--- a/python/ql/src/semmle/python/frameworks/Invoke.qll
+++ b/python/ql/src/semmle/python/frameworks/Invoke.qll
@@ -6,6 +6,7 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
 /**
  * Provides models for the `invoke` PyPI package.
@@ -16,102 +17,44 @@ private module Invoke {
   // invoke
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `invoke` module. */
-  private DataFlow::Node invoke(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("invoke")
-    or
-    exists(DataFlow::TypeTracker t2 | result = invoke(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `invoke` module. */
-  DataFlow::Node invoke() { result = invoke(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `invoke` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node invoke_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["run", "sudo", "context", "Context", "task"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("invoke." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("invoke")
-    )
-    or
-    // Due to bad performance when using normal setup with `invoke_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        invoke_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate invoke_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(invoke_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `invoke` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node invoke_attr(string attr_name) {
-    result = invoke_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node invoke() { result = API::moduleImport("invoke") }
 
   /** Provides models for the `invoke` module. */
   module invoke {
     /** Gets a reference to the `invoke.context` module. */
-    DataFlow::Node context() { result = invoke_attr("context") }
+    API::Node context() { result = invoke().getMember("context") }
 
     /** Provides models for the `invoke.context` module */
     module context {
       /** Provides models for the `invoke.context.Context` class */
       module Context {
         /** Gets a reference to the `invoke.context.Context` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("invoke.context.Context")
-          or
-          t.startInAttr("Context") and
-          result = invoke::context()
-          or
-          // handle invoke.Context alias
-          t.start() and
-          result = invoke_attr("Context")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+        API::Node classRef() {
+          result =
+            [API::moduleImport("invoke").getMember("context"), API::moduleImport("invoke")]
+                .getMember("Context")
         }
 
-        /** Gets a reference to the `invoke.context.Context` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
         /** Gets a reference to an instance of `invoke.context.Context`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
-          result.asCfgNode().(CallNode).getFunction() =
-            invoke::context::Context::classRef().asCfgNode()
-          or
-          t.start() and
-          exists(Function func |
-            func.getADecorator() = invoke_attr("task").asExpr() and
-            result.(DataFlow::ParameterNode).getParameter() = func.getArg(0)
+          (
+            result = invoke::context::Context::classRef().getACall()
+            or
+            exists(Function func |
+              func.getADecorator() = invoke().getMember("task").getAUse().asExpr() and
+              result.(DataFlow::ParameterNode).getParameter() = func.getArg(0)
+            )
           )
           or
           exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
         }
 
         /** Gets a reference to an instance of `invoke.context.Context`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::LocalSourceNode instance() { result = instance(DataFlow::TypeTracker::end()) }
 
         /** Gets a reference to the `run` or `sudo` methods on a `invoke.context.Context` instance. */
-        private DataFlow::Node instanceRunMethods(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instanceRunMethods(DataFlow::TypeTracker t) {
           t.startInAttr(["run", "sudo"]) and
           result = invoke::context::Context::instance()
           or
@@ -120,7 +63,7 @@ private module Invoke {
 
         /** Gets a reference to the `run` or `sudo` methods on a `invoke.context.Context` instance. */
         DataFlow::Node instanceRunMethods() {
-          result = instanceRunMethods(DataFlow::TypeTracker::end())
+          instanceRunMethods(DataFlow::TypeTracker::end()).flowsTo(result)
         }
       }
     }
@@ -131,15 +74,10 @@ private module Invoke {
    * - `invoke.run` or `invoke.sudo` functions (http://docs.pyinvoke.org/en/stable/api/__init__.html)
    * - `run` or `sudo` methods on a `invoke.context.Context` instance (http://docs.pyinvoke.org/en/stable/api/context.html#invoke.context.Context.run)
    */
-  private class InvokeRunCommandCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class InvokeRunCommandCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     InvokeRunCommandCall() {
-      exists(DataFlow::Node callFunction | node.getFunction() = callFunction.asCfgNode() |
-        callFunction = invoke_attr(["run", "sudo"])
-        or
-        callFunction = invoke::context::Context::instanceRunMethods()
-      )
+      this = invoke().getMember(["run", "sudo"]).getACall() or
+      this.getFunction() = invoke::context::Context::instanceRunMethods()
     }
 
     override DataFlow::Node getCommand() {

From 2890fe6d61566c8adce3ad63fcdaf102239f48ff Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 15:26:54 +0000
Subject: [PATCH 240/433] Python: Use API graphs in Dill model

If only all rewrites were this smooth...
---
 .../ql/src/semmle/python/frameworks/Dill.qll  | 38 ++-----------------
 1 file changed, 4 insertions(+), 34 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Dill.qll b/python/ql/src/semmle/python/frameworks/Dill.qll
index d105bd47603f..1985b7f84cf1 100644
--- a/python/ql/src/semmle/python/frameworks/Dill.qll
+++ b/python/ql/src/semmle/python/frameworks/Dill.qll
@@ -7,50 +7,20 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
-
-private module Dill {
-  /** Gets a reference to the `dill` module. */
-  private DataFlow::Node dill(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("dill")
-    or
-    exists(DataFlow::TypeTracker t2 | result = dill(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `dill` module. */
-  DataFlow::Node dill() { result = dill(DataFlow::TypeTracker::end()) }
-
-  /** Provides models for the `dill` module. */
-  module dill {
-    /** Gets a reference to the `dill.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode("dill.loads")
-      or
-      t.startInAttr("loads") and
-      result = dill()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `dill.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
-  }
-}
+private import semmle.python.ApiGraphs
 
 /**
  * A call to `dill.loads`
  * See https://pypi.org/project/dill/ (which currently refers you
  * to https://docs.python.org/3/library/pickle.html#pickle.loads)
  */
-private class DillLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-  override CallNode node;
+private class DillLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
 
-  DillLoadsCall() { node.getFunction() = Dill::dill::loads().asCfgNode() }
+  DillLoadsCall() { this = API::moduleImport("dill").getMember("loads").getACall()}
 
   override predicate mayExecuteInput() { any() }
 
-  override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+  override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
   override DataFlow::Node getOutput() { result = this }
 

From 6e73d136702f882c7582da0dffd9ee635d53c739 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Tue, 13 Apr 2021 23:48:45 +0800
Subject: [PATCH 241/433] Update
 java/ql/src/semmle/code/java/frameworks/Servlets.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/semmle/code/java/frameworks/Servlets.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index a99df9816f15..3c57b8b7c828 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -354,7 +354,7 @@ class FilterChain extends Interface {
 
 /** Holds if `m` is a filter handler method (for example `doFilter`). */
 predicate isDoFilterMethod(Method m) {
-  m.getName() ="doFilter" and
+  m.getName() = "doFilter" and
   m.getDeclaringType() instanceof FilterClass and
   m.getNumberOfParameters() = 3 and
   m.getParameter(0).getType() instanceof ServletRequest and

From 7be45e7c5e450129253458072b766d9717d8b0ce Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Tue, 13 Apr 2021 23:56:17 +0800
Subject: [PATCH 242/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index 927c3db03d25..f9c16a546ca0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -52,7 +52,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSink(DataFlow::Node sink) {
     sink instanceof XssSink and
-    getACallingCallableOrSelf(sink.getEnclosingCallable()) instanceof RequestGetMethod
+    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {

From 5f7d3d0d36869014be58ae28d0a034b92b31b2c2 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 15:57:21 +0000
Subject: [PATCH 243/433] Python: Use API graphs in Werkzeug

---
 .../ql/src/semmle/python/frameworks/Flask.qll |  6 ++-
 .../src/semmle/python/frameworks/Werkzeug.qll | 46 +++++--------------
 2 files changed, 16 insertions(+), 36 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index 8b045c2ee833..b4c5b5dcf8bb 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -401,13 +401,15 @@ module Flask {
     }
   }
 
-  private class RequestAttrMultiDict extends Werkzeug::werkzeug::datastructures::MultiDict::InstanceSource {
+  private class RequestAttrMultiDict extends Werkzeug::werkzeug::datastructures::MultiDict::InstanceSourceApiNode {
     string attr_name;
 
     RequestAttrMultiDict() {
       attr_name in ["args", "values", "form", "files"] and
-      this = request().getMember(attr_name).getAnImmediateUse()
+      this = request().getMember(attr_name)
     }
+
+    override string toString() { result = this.(API::Node).toString() }
   }
 
   private class RequestAttrFiles extends RequestAttrMultiDict {
diff --git a/python/ql/src/semmle/python/frameworks/Werkzeug.qll b/python/ql/src/semmle/python/frameworks/Werkzeug.qll
index 172c94682521..63b8067b2664 100644
--- a/python/ql/src/semmle/python/frameworks/Werkzeug.qll
+++ b/python/ql/src/semmle/python/frameworks/Werkzeug.qll
@@ -5,6 +5,7 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.ApiGraphs
 
 /**
  * Provides models for the `Werkzeug` PyPI package.
@@ -23,6 +24,9 @@ module Werkzeug {
        * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.MultiDict.
        */
       module MultiDict {
+        /** DEPRECATED. Use `InstanceSourceApiNode` instead. */
+        abstract deprecated class InstanceSource extends DataFlow::Node { }
+
         /**
          * A source of instances of `werkzeug.datastructures.MultiDict`, extend this class to model new instances.
          *
@@ -32,37 +36,16 @@ module Werkzeug {
          *
          * Use the predicate `MultiDict::instance()` to get references to instances of `werkzeug.datastructures.MultiDict`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.MultiDict`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof InstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-        }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.MultiDict`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        abstract class InstanceSourceApiNode extends API::Node { }
 
         /**
          * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`.
          *
          * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist
          */
-        private DataFlow::Node getlist(DataFlow::TypeTracker t) {
-          t.startInAttr("getlist") and
-          result = instance()
-          or
-          exists(DataFlow::TypeTracker t2 | result = getlist(t2).track(t2, t))
+        DataFlow::Node getlist() {
+          result = any(InstanceSourceApiNode a).getMember("getlist").getAUse()
         }
-
-        /**
-         * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`.
-         *
-         * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist
-         */
-        DataFlow::Node getlist() { result = getlist(DataFlow::TypeTracker::end()) }
       }
 
       /**
@@ -71,6 +54,9 @@ module Werkzeug {
        * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage.
        */
       module FileStorage {
+        /** DEPRECATED. Use `InstanceSourceApiNode` instead. */
+        abstract deprecated class InstanceSource extends DataFlow::Node { }
+
         /**
          * A source of instances of `werkzeug.datastructures.FileStorage`, extend this class to model new instances.
          *
@@ -80,18 +66,10 @@ module Werkzeug {
          *
          * Use the predicate `FileStorage::instance()` to get references to instances of `werkzeug.datastructures.FileStorage`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof InstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-        }
+        abstract class InstanceSourceApiNode extends API::Node { }
 
         /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { result = any(InstanceSourceApiNode a).getAUse() }
       }
     }
   }

From 25b012db48c7b67f8801770d5056ac39681e3622 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Tue, 13 Apr 2021 23:58:28 +0800
Subject: [PATCH 244/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index f9c16a546ca0..e3673e504100 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -47,7 +47,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) {
     source instanceof RemoteFlowSource and
-    getACallingCallableOrSelf(source.getEnclosingCallable()) instanceof RequestGetMethod
+    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
   }
 
   override predicate isSink(DataFlow::Node sink) {

From 00235ed3b39a51adbbeadc42f97cdc5cd5d5c780 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Tue, 13 Apr 2021 23:58:52 +0800
Subject: [PATCH 245/433] Update
 java/ql/src/semmle/code/java/frameworks/Servlets.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/semmle/code/java/frameworks/Servlets.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index 3c57b8b7c828..c733023bbdce 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -352,7 +352,7 @@ class FilterChain extends Interface {
   FilterChain() { hasQualifiedName("javax.servlet", "FilterChain") }
 }
 
-/** Holds if `m` is a filter handler method (for example `doFilter`). */
+/** Holds if `m` is an implementation of `javax.servlet.Filter.doFilter`. */
 predicate isDoFilterMethod(Method m) {
   m.getName() = "doFilter" and
   m.getDeclaringType() instanceof FilterClass and

From 273e8ce4efb3646a3f449ed61ac73e37e8c6e1bf Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 16:04:07 +0000
Subject: [PATCH 246/433] Python: Add change note

---
 python/change-notes/2021-04-13-werkzeug-api-graphs.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 python/change-notes/2021-04-13-werkzeug-api-graphs.md

diff --git a/python/change-notes/2021-04-13-werkzeug-api-graphs.md b/python/change-notes/2021-04-13-werkzeug-api-graphs.md
new file mode 100644
index 000000000000..041e5a31a2b7
--- /dev/null
+++ b/python/change-notes/2021-04-13-werkzeug-api-graphs.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* The Werkzeug model has been changed to use API graphs. When defining new models for classes based
+  on the `MultiDict` and `FileStorage` classes in `werkzeug.datastructures`, the relevant extension
+  points are now the two `InstanceSourceApiNode` classes in the `semmle.python.frameworks.Werkzeug`
+  module, instead of `InstanceSource`. The latter classes have now been deprecated.

From 079c7e089df9cada5406147468abb5d3a4645a44 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 16:05:45 +0000
Subject: [PATCH 247/433] Python: Autoformat

---
 python/ql/src/semmle/python/frameworks/Dill.qll | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Dill.qll b/python/ql/src/semmle/python/frameworks/Dill.qll
index 1985b7f84cf1..94af905756bc 100644
--- a/python/ql/src/semmle/python/frameworks/Dill.qll
+++ b/python/ql/src/semmle/python/frameworks/Dill.qll
@@ -15,8 +15,7 @@ private import semmle.python.ApiGraphs
  * to https://docs.python.org/3/library/pickle.html#pickle.loads)
  */
 private class DillLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
-
-  DillLoadsCall() { this = API::moduleImport("dill").getMember("loads").getACall()}
+  DillLoadsCall() { this = API::moduleImport("dill").getMember("loads").getACall() }
 
   override predicate mayExecuteInput() { any() }
 

From a6bb9ebb9ff619fea60d77cd54fe44d186bb49b8 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 13 Apr 2021 16:08:41 +0000
Subject: [PATCH 248/433] Python: Re-introduce `abstract toString`

This seems like the easier solution in the short run.
---
 python/ql/src/semmle/python/ApiGraphs.qll         | 2 +-
 python/ql/src/semmle/python/frameworks/PEP249.qll | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 9689fb06a77c..5aab059d58e6 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -157,7 +157,7 @@ module API {
     /**
      * Gets a textual representation of this element.
      */
-    string toString() { none() }
+    abstract string toString();
 
     /**
      * Gets a path of the given `length` from the root to this node.
diff --git a/python/ql/src/semmle/python/frameworks/PEP249.qll b/python/ql/src/semmle/python/frameworks/PEP249.qll
index c449ae92bf24..f2b21d08e7c3 100644
--- a/python/ql/src/semmle/python/frameworks/PEP249.qll
+++ b/python/ql/src/semmle/python/frameworks/PEP249.qll
@@ -20,7 +20,10 @@ abstract deprecated class PEP249Module extends DataFlow::Node { }
  * An abstract class encompassing API graph nodes that implement PEP 249.
  * Extend this class for implementations.
  */
-abstract class PEP249ModuleApiNode extends API::Node { }
+abstract class PEP249ModuleApiNode extends API::Node {
+  /** Gets a string representation of this element. */
+  override string toString() { result = this.(API::Node).toString() }
+}
 
 /** Gets a reference to a connect call. */
 DataFlow::Node connect() { result = any(PEP249ModuleApiNode a).getMember("connect").getAUse() }

From d853f0c40028958a292d483c3ace880e6cd5dd00 Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Fri, 2 Apr 2021 18:51:02 +0200
Subject: [PATCH 249/433] Java: Add MemberType

---
 .../Performance/InnerClassCouldBeStatic.ql    |  3 +-
 java/ql/src/semmle/code/java/PrintAst.qll     |  4 +-
 java/ql/src/semmle/code/java/Type.qll         | 42 ++++++++++++++++---
 .../semmle/code/java/frameworks/play/Play.qll | 10 +----
 4 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/java/ql/src/Performance/InnerClassCouldBeStatic.ql b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
index a18d801549d3..5dba77761c6e 100644
--- a/java/ql/src/Performance/InnerClassCouldBeStatic.ql
+++ b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
@@ -100,8 +100,7 @@ predicate potentiallyStatic(InnerClass c) {
     m = a.getEnclosingCallable() and
     m.getDeclaringType() = c
   ) and
-  not c instanceof AnonymousClass and
-  not c instanceof LocalClass and
+  c instanceof MemberType and
   forall(
     InnerClass other // If nested and non-static, ...
   |
diff --git a/java/ql/src/semmle/code/java/PrintAst.qll b/java/ql/src/semmle/code/java/PrintAst.qll
index 4e219603024f..6a74c15316c0 100644
--- a/java/ql/src/semmle/code/java/PrintAst.qll
+++ b/java/ql/src/semmle/code/java/PrintAst.qll
@@ -433,9 +433,7 @@ final class ClassInterfaceNode extends ElementNode {
     or
     result.(FieldDeclaration).getAField().getDeclaringType() = ty
     or
-    result.(NestedType).getEnclosingType().getSourceDeclaration() = ty and
-    not result instanceof AnonymousClass and
-    not result instanceof LocalClass
+    result.(MemberType).getEnclosingType().getSourceDeclaration() = ty
     or
     isInitBlock(ty, result)
   }
diff --git a/java/ql/src/semmle/code/java/Type.qll b/java/ql/src/semmle/code/java/Type.qll
index 10d9b8b3a31d..e81f64e4616b 100755
--- a/java/ql/src/semmle/code/java/Type.qll
+++ b/java/ql/src/semmle/code/java/Type.qll
@@ -517,7 +517,12 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
   /** Holds if this is a top-level type, which is not nested inside any other types. */
   predicate isTopLevel() { this instanceof TopLevelType }
 
-  /** Holds if this type is declared in a specified package with the specified name. */
+  /**
+   * Holds if this type is declared in a specified package with the specified name.
+   *
+   * For nested types the name of the nested type is prefixed with a `$` and appended
+   * to the name of the enclosing type, which might be a nested type as well.
+   */
   predicate hasQualifiedName(string package, string type) {
     this.getPackage().hasName(package) and type = this.nestedName()
   }
@@ -532,7 +537,12 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
   }
 
   /**
-   * Gets the qualified name of this type.
+   * Gets the qualified name of this type, consisting of the package name followed by
+   * a `.` and the name of this type.
+   *
+   * For nested types the name of the nested type is prefixed with a `$` and appended
+   * to the name of the enclosing type, which might be a nested type as well. For example:
+   * `java.util.Map$Entry`.
    */
   string getQualifiedName() {
     exists(string pkgName | pkgName = getPackage().getName() |
@@ -540,7 +550,13 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
     )
   }
 
-  /** Gets the nested name of this type. */
+  /**
+   * Gets the nested name of this type.
+   *
+   * If this type is not a nested type, the result is the same as `getName()`.
+   * Otherwise the name of the nested type is prefixed with a `$` and appended to
+   * the name of the enclosing type, which might be a nested type as well.
+   */
   string nestedName() {
     not this instanceof NestedType and result = this.getName()
     or
@@ -788,6 +804,21 @@ class NestedType extends RefType {
   }
 }
 
+/**
+ * A nested type which is a direct member of the enclosing type,
+ * that is, neither an anonymous nor local class.
+ */
+class MemberType extends NestedType, Member {
+  /**
+   * Gets the qualified name of this member type.
+   *
+   * The qualified name consists of the package name, a `.`, the name of the declaring
+   * type (which might be a nested or member type as well), followed by a `$` and the
+   * name of this member type. For example: `java.util.Map$Entry`.
+   */
+  override string getQualifiedName() { result = NestedType.super.getQualifiedName() }
+}
+
 /**
  * A class declared within another type.
  *
@@ -797,8 +828,9 @@ class NestedType extends RefType {
 class NestedClass extends NestedType, Class { }
 
 /**
- * An inner class is a nested class that is neither
- * explicitly nor implicitly declared static.
+ * An inner class is a nested class that is neither explicitly nor
+ * implicitly declared static. This includes anonymous and local
+ * classes.
  */
 class InnerClass extends NestedClass {
   InnerClass() { not this.isStatic() }
diff --git a/java/ql/src/semmle/code/java/frameworks/play/Play.qll b/java/ql/src/semmle/code/java/frameworks/play/Play.qll
index 0498ba9317c5..96c45cb22449 100644
--- a/java/ql/src/semmle/code/java/frameworks/play/Play.qll
+++ b/java/ql/src/semmle/code/java/frameworks/play/Play.qll
@@ -44,14 +44,8 @@ class PlayAddCsrfTokenAnnotation extends Annotation {
 /**
  * The type `play.libs.F.Promise<Result>`.
  */
-class PlayAsyncResultPromise extends Member {
-  PlayAsyncResultPromise() {
-    exists(Class c |
-      c.hasQualifiedName("play.libs", "F") and
-      this = c.getAMember() and
-      this.getQualifiedName() = "F.Promise<Result>"
-    )
-  }
+class PlayAsyncResultPromise extends MemberType {
+  PlayAsyncResultPromise() { hasQualifiedName("play.libs", "F$Promise<Result>") }
 }
 
 /**

From 37dae67a0d57589a6fd97c842d05f2b5c9cf830d Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 14 Apr 2021 09:55:24 +0800
Subject: [PATCH 250/433] Fix RequestResponseFlowConfig.isSink error

---
 .../experimental/Security/CWE/CWE-352/JsonpInjection.ql    | 2 +-
 .../Security/CWE/CWE-352/JsonpInjectionLib.qll             | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index e3673e504100..f6f876488120 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -52,7 +52,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSink(DataFlow::Node sink) {
     sink instanceof XssSink and
-    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
+    any(RequestGetMethod m).polyCalls*(sink.getEnclosingCallable())
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 6a21ce8ff3a8..5f2ad8e85321 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -77,10 +77,13 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
     this.getAnAnnotation()
         .getType()
         .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
-    this.getAnAnnotation().getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}") and
+    (
+      this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
+      this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
+    ) and
     not exists(MethodAccess ma |
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
-      this = getACallingCallableOrSelf(ma.getEnclosingCallable())
+      any(this).polyCalls*(ma.getEnclosingCallable())
     ) and
     not this.getAParamType().getName() = "MultipartFile"
   }

From e2ed0d02b0182dee63b7f0ab855dd3d145c13209 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 14 Apr 2021 12:34:52 +0800
Subject: [PATCH 251/433] Delete existsFilterVerificationMethod and
 existsServletVerificationMethod, add from get handler to filter

---
 .../Security/CWE/CWE-352/JsonpInjection.ql    |  27 ---
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  24 +-
 .../JsonpController.java                      | 218 ------------------
 .../JsonpInjection.expected                   |  81 -------
 .../JsonpInjection.qlref                      |   1 -
 .../JsonpInjectionServlet1.java               |  64 -----
 .../JsonpInjectionServlet2.java               |  50 ----
 .../RefererFilter.java                        |  43 ----
 .../CWE-352/JsonpInjectionWithFilter/options  |   1 -
 .../JsonpInjection.expected                   |   6 -
 .../JsonpInjection.expected                   |   9 -
 11 files changed, 12 insertions(+), 512 deletions(-)
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index f6f876488120..c28af8aaa152 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -16,31 +16,6 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.deadcode.WebEntryPoints
 import DataFlow::PathGraph
 
-/**
- * Holds if some `Filter.doFilter` method exists in the whole program that takes some user-controlled
- * input and tests it with what appears to be a token- or authentication-checking function.
- */
-predicate existsFilterVerificationMethod() {
-  exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc, Method m |
-    vmfc.hasFlow(source, sink) and
-    m = getACallingCallableOrSelf(source.getEnclosingCallable()) and
-    isDoFilterMethod(m)
-  )
-}
-
-/**
- * Holds if somewhere in the whole program some user-controlled
- * input is tested with what appears to be a token- or authentication-checking function,
- * and `checkNode` is reachable from any function that can reach the user-controlled input source.
- */
-predicate existsServletVerificationMethod(Node checkNode) {
-  exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
-    vmfc.hasFlow(source, sink) and
-    getACallingCallableOrSelf(source.getEnclosingCallable()) =
-      getACallingCallableOrSelf(checkNode.getEnclosingCallable())
-  )
-}
-
 /** Taint-tracking configuration tracing flow from get method request sources to output jsonp data. */
 class RequestResponseFlowConfig extends TaintTracking::Configuration {
   RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
@@ -64,8 +39,6 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, RequestResponseFlowConfig conf
 where
-  not existsServletVerificationMethod(source.getNode()) and
-  not existsFilterVerificationMethod() and
   conf.hasFlowPath(source, sink) and
   exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
 select sink.getNode(), source, sink, "Jsonp response might include code from $@.", source.getNode(),
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 5f2ad8e85321..af9cebb865ce 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -42,17 +42,21 @@ class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   }
 }
 
-/** Get Callable by recursive method. */
-Callable getACallingCallableOrSelf(Callable call) {
-  result = call
-  or
-  result = getACallingCallableOrSelf(call.getAReference().getEnclosingCallable())
-}
-
 /**
  * A method that is called to handle an HTTP GET request.
  */
-abstract class RequestGetMethod extends Method { }
+abstract class RequestGetMethod extends Method {
+  RequestGetMethod() {
+    not exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
+      vmfc.hasFlow(source, sink) and
+      any(this).polyCalls*(source.getEnclosingCallable())
+    ) and
+    not exists(MethodAccess ma |
+      ma.getMethod() instanceof ServletRequestGetBodyMethod and
+      any(this).polyCalls*(ma.getEnclosingCallable())
+    )
+  }
+}
 
 /** Override method of `doGet` of `Servlet` subclass. */
 private class ServletGetMethod extends RequestGetMethod {
@@ -81,10 +85,6 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
       this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
       this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
     ) and
-    not exists(MethodAccess ma |
-      ma.getMethod() instanceof ServletRequestGetBodyMethod and
-      any(this).polyCalls*(ma.getEnclosingCallable())
-    ) and
     not this.getAParamType().getName() = "MultipartFile"
   }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
deleted file mode 100644
index e875da2f6995..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java
+++ /dev/null
@@ -1,218 +0,0 @@
-import com.alibaba.fastjson.JSONObject;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.google.gson.Gson;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.multipart.MultipartFile;
-
-@Controller
-public class JsonpController {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    @GetMapping(value = "jsonp1")
-    @ResponseBody
-    public String bad1(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp2")
-    @ResponseBody
-    public String bad2(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp3")
-    @ResponseBody
-    public String bad3(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp4")
-    @ResponseBody
-    public String bad4(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp5")
-    @ResponseBody
-    public void bad5(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp6")
-    @ResponseBody
-    public void bad6(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        ObjectMapper mapper = new ObjectMapper();
-        String result = mapper.writeValueAsString(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
-    @ResponseBody
-    public String bad7(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp8")
-    @ResponseBody
-    public String bad8(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token); //Just check.
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-
-    @GetMapping(value = "jsonp9")
-    @ResponseBody
-    public String good1(HttpServletRequest request) {
-        String resultStr = null;
-        String referer = request.getParameter("referer");
-        if (verifReferer(referer)){
-            String jsonpCallback = request.getParameter("jsonpCallback");
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
-        }
-        return "error";
-    }
-
-
-    @GetMapping(value = "jsonp10")
-    @ResponseBody
-    public String good2(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token);
-        if (result){
-            return "";
-        }
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @RequestMapping(value = "jsonp11")
-    @ResponseBody
-    public String good3(HttpServletRequest request) {
-        JSONObject parameterObj = readToJSONObect(request);
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @RequestMapping(value = "jsonp12")
-    @ResponseBody
-    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
-        if(null == file){
-            return "upload file error";
-        }
-        String fileName = file.getOriginalFilename();
-        System.out.println("file operations");
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    public static JSONObject readToJSONObect(HttpServletRequest request){
-        String jsonText = readPostContent(request);
-        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
-        return jsonObj;
-    }
-
-    public static String readPostContent(HttpServletRequest request){
-        BufferedReader in= null;
-        String content = null;
-        String line = null;
-        try {
-            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
-            StringBuilder buf = new StringBuilder();
-            while ((line = in.readLine()) != null) {
-                buf.append(line);
-            }
-            content = buf.toString();
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
-        String uri = request.getRequestURI();
-        return content;
-    }
-
-    public static String getJsonStr(Object result) {
-        return JSONObject.toJSONString(result);
-    }
-
-    public static boolean verifToken(String token){
-        if (token != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-
-    public static boolean verifReferer(String str){
-        if (str != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
deleted file mode 100644
index 3da805c6a698..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.expected
+++ /dev/null
@@ -1,81 +0,0 @@
-edges
-| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
-| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
-| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
-| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
-| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
-| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
-| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
-| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
-| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
-| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
-| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
-| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
-| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
-| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
-| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-nodes
-| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-#select
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
deleted file mode 100644
index 3f5fc4506696..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java
deleted file mode 100644
index 14ef76275b1d..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet1.java
+++ /dev/null
@@ -1,64 +0,0 @@
-import com.google.gson.Gson;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class JsonpInjectionServlet1 extends HttpServlet {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    private static final long serialVersionUID = 1L;
-
-    private String key = "test";
-    @Override
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        doPost(req, resp);
-    }
-
-    @Override
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        resp.setContentType("application/json");
-        String jsonpCallback = req.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String jsonResult = gson.toJson(hashMap);
-
-        String referer = req.getHeader("Referer");
-
-        boolean result = verifReferer(referer);
-
-        // good
-        if (result){
-            String resultStr = null;
-            pw = resp.getWriter();
-            resultStr = jsonpCallback + "(" + jsonResult + ")";
-            pw.println(resultStr);
-            pw.flush();
-        }
-    }
-
-    public static boolean verifReferer(String referer){
-        if (!referer.startsWith("http://test.com/")){
-            return false;
-        }
-        return true;
-    }
-
-    @Override
-    public void init(ServletConfig config) throws ServletException {
-        this.key = config.getInitParameter("key");
-        System.out.println("初始化" + this.key);
-        super.init(config);
-    }
-
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java
deleted file mode 100644
index bbfbc2dc4360..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpInjectionServlet2.java
+++ /dev/null
@@ -1,50 +0,0 @@
-import com.google.gson.Gson;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class JsonpInjectionServlet2  extends HttpServlet {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    private static final long serialVersionUID = 1L;
-
-    private String key = "test";
-    @Override
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        doPost(req, resp);
-    }
-
-    @Override
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        resp.setContentType("application/json");
-        String jsonpCallback = req.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-
-        String resultStr = null;
-        pw = resp.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-        pw.flush();
-    }
-
-    @Override
-    public void init(ServletConfig config) throws ServletException {
-        this.key = config.getInitParameter("key");
-        System.out.println("初始化" + this.key);
-        super.init(config);
-    }
-
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java
deleted file mode 100644
index 97444932ae17..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/RefererFilter.java
+++ /dev/null
@@ -1,43 +0,0 @@
-import java.io.IOException;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.util.StringUtils;
-
-public class RefererFilter implements Filter {
-
-    @Override
-    public void init(FilterConfig filterConfig) throws ServletException {
-    }
-
-    @Override
-    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
-        HttpServletRequest request = (HttpServletRequest) servletRequest;
-        HttpServletResponse response = (HttpServletResponse) servletResponse;
-        String refefer = request.getHeader("Referer");
-        boolean result = verifReferer(refefer);
-        if (result){
-            filterChain.doFilter(servletRequest, servletResponse);
-        }
-        response.sendError(444, "Referer xxx.");
-    }
-
-    @Override
-    public void destroy() {
-    }
-
-    public static boolean verifReferer(String referer){
-        if (StringUtils.isEmpty(referer)){
-            return false;
-        }
-        if (referer.startsWith("http://www.baidu.com/")){
-            return true;
-        }
-        return false;
-    }
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options
deleted file mode 100644
index c53e31e467fa..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
index 2e4bc97ff973..83f2b7f206a5 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
@@ -15,9 +15,7 @@ edges
 | JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
 | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
 | JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
 | JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
 | JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
 | JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
 | JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
@@ -54,14 +52,10 @@ nodes
 | JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
index d90d51ab5524..dfbe0628760b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
@@ -15,13 +15,10 @@ edges
 | JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
 | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
 | JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | JsonpController.java:130:20:130:28 | resultStr |
 | JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | JsonpController.java:148:16:148:24 | resultStr |
 | JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
 | JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
 | JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
 | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
 | JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
@@ -58,22 +55,16 @@ nodes
 | JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:127:36:127:72 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:145:32:145:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
 | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |

From 77208bcc91d7dfc0d53a8eb2f429b1deebded47b Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Wed, 14 Apr 2021 13:14:43 +0800
Subject: [PATCH 252/433] Fix the error that there is no
 VerificationMethodToIfFlowConfig

---
 .../CWE/CWE-352/JsonpInjectionLib.qll         | 44 ++++++++++++-------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index af9cebb865ce..6b989c3c0cff 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -7,11 +7,32 @@ import semmle.code.java.dataflow.DataFlow3
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
+/** A data flow configuration tracing flow from the result of a method whose name includes token/auth/referer/origin to an if-statement condition. */
+class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
+  VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(MethodAccess ma | ma instanceof BarrierGuard |
+      (
+        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        or
+        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+      ) and
+      ma = src.asExpr()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(IfStmt is | is.getCondition() = sink.asExpr())
+  }
+}
+
 /**
  * Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
  *
  * For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
- * the flow from `getHeader(...)` to the argument to `checkToken`, and then the flow from `checkToken`'s result to the condition of `if(isGood)`.
+ * the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
+ * and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
  */
 class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
@@ -19,25 +40,16 @@ class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(IfStmt is, Method m | is.getEnclosingCallable() = m |
-      (
-        not m.getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-        or
-        not m.getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-      ) and
-      sink.asExpr() = is.getCondition()
-    )
-  }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node prod, DataFlow::Node succ) {
-    exists(MethodAccess ma |
+    exists(MethodAccess ma, int i, VerificationMethodToIfFlowConfig vmtifc |
+      ma instanceof BarrierGuard
+    |
       (
-        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
+        ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
         or
         ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
       ) and
-      ma.getAnArgument() = prod.asExpr() and
-      ma = succ.asExpr()
+      ma.getArgument(i) = sink.asExpr() and
+      vmtifc.hasFlow(exprNode(ma), _)
     )
   }
 }

From 4810308b16d9c6af09f2bababb64992482a328bc Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Wed, 14 Apr 2021 09:16:31 +0200
Subject: [PATCH 253/433] C#: Add `Customizations.qll`

---
 csharp/ql/src/Customizations.qll | 12 ++++++++++++
 csharp/ql/src/csharp.qll         |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 csharp/ql/src/Customizations.qll

diff --git a/csharp/ql/src/Customizations.qll b/csharp/ql/src/Customizations.qll
new file mode 100644
index 000000000000..d5378a44f0de
--- /dev/null
+++ b/csharp/ql/src/Customizations.qll
@@ -0,0 +1,12 @@
+/**
+ * Contains customizations to the standard library.
+ *
+ * This module is imported by `csharp.qll`, so any customizations defined here automatically
+ * apply to all queries.
+ *
+ * Typical examples of customizations include adding new subclasses of abstract classes such as
+ * the `RemoteFlowSource` and `SummarizedCallable` classes associated with the security queries
+ * to model frameworks that are not covered by the standard library.
+ */
+
+import csharp
diff --git a/csharp/ql/src/csharp.qll b/csharp/ql/src/csharp.qll
index 3c821c9a4433..dc187fc8d923 100644
--- a/csharp/ql/src/csharp.qll
+++ b/csharp/ql/src/csharp.qll
@@ -2,6 +2,7 @@
  * The default C# QL library.
  */
 
+import Customizations
 import semmle.code.csharp.Attribute
 import semmle.code.csharp.Callable
 import semmle.code.csharp.Comments

From 36fe72246b9dc5d19397fab44c86187e81feaf1a Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Wed, 14 Apr 2021 09:22:16 +0200
Subject: [PATCH 254/433] C#: Add change note

---
 csharp/change-notes/2021-04-14-customizations.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 csharp/change-notes/2021-04-14-customizations.md

diff --git a/csharp/change-notes/2021-04-14-customizations.md b/csharp/change-notes/2021-04-14-customizations.md
new file mode 100644
index 000000000000..a2f957ca9230
--- /dev/null
+++ b/csharp/change-notes/2021-04-14-customizations.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A new library, `Customizations.qll`, has been added, which allows for global customizations that affect all queries.
\ No newline at end of file

From 5158e7964eb51236ed6ea9308c285af55594d9cd Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Wed, 14 Apr 2021 08:25:12 +0100
Subject: [PATCH 255/433] Add change note

---
 java/change-notes/2021-04-14-membertype.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 java/change-notes/2021-04-14-membertype.md

diff --git a/java/change-notes/2021-04-14-membertype.md b/java/change-notes/2021-04-14-membertype.md
new file mode 100644
index 000000000000..910a5c914232
--- /dev/null
+++ b/java/change-notes/2021-04-14-membertype.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A CodeQL class `MemberType` is introduced to describe nested classes. Its `getQualifiedName` method returns `$`-delimited nested type names (for example, `mypackage.Outer$Middle$Inner`), where previously the same type would be named differently depending on whether it was addressed as a `NestedType` or a `Member`.

From 2965a1f204a908738f56b475ae60928b9efc504d Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Wed, 14 Apr 2021 08:43:05 +0100
Subject: [PATCH 256/433] Use Thread$State as an inner-class example

Map<>$Entry currently has odd generic notation that may be about to change.
---
 java/ql/src/semmle/code/java/Type.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/Type.qll b/java/ql/src/semmle/code/java/Type.qll
index e81f64e4616b..5eaa52ee5482 100755
--- a/java/ql/src/semmle/code/java/Type.qll
+++ b/java/ql/src/semmle/code/java/Type.qll
@@ -542,7 +542,7 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
    *
    * For nested types the name of the nested type is prefixed with a `$` and appended
    * to the name of the enclosing type, which might be a nested type as well. For example:
-   * `java.util.Map$Entry`.
+   * `java.lang.Thread$State`.
    */
   string getQualifiedName() {
     exists(string pkgName | pkgName = getPackage().getName() |
@@ -814,7 +814,7 @@ class MemberType extends NestedType, Member {
    *
    * The qualified name consists of the package name, a `.`, the name of the declaring
    * type (which might be a nested or member type as well), followed by a `$` and the
-   * name of this member type. For example: `java.util.Map$Entry`.
+   * name of this member type. For example: `java.lang.Thread$State`.
    */
   override string getQualifiedName() { result = NestedType.super.getQualifiedName() }
 }

From 55723618a9041e18221cbce243a81f1972fbd96b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
Date: Wed, 14 Apr 2021 10:05:50 +0200
Subject: [PATCH 257/433] Python: Apply suggestions from code review

Co-authored-by: Taus <tausbn@github.com>
---
 python/ql/src/semmle/python/frameworks/Django.qll | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index f41920c86b8a..4ef93e5cb60f 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -16,7 +16,7 @@ private import semmle.python.regex
  * Provides models for the `django` PyPI package.
  * See https://www.djangoproject.com/.
  */
-module Django {
+private module Django {
   /** Provides models for the `django.views` module */
   module Views {
     /**
@@ -28,7 +28,7 @@ module Django {
      */
     module View {
       /**
-       * An `API::Node` for references to `django.views.generic.View` or any subclass
+       * An `API::Node` representing the `django.views.generic.View` class or any subclass
        * that has explicitly been modeled in the CodeQL libraries.
        */
       abstract class ModeledSubclass extends API::Node {
@@ -94,7 +94,7 @@ module Django {
      */
     module Form {
       /**
-       * An `API::Node` for references to `django.forms.forms.BaseForm` or any subclass
+       * An `API::Node` representing the `django.forms.forms.BaseForm` class or any subclass
        * that has explicitly been modeled in the CodeQL libraries.
        */
       abstract class ModeledSubclass extends API::Node {
@@ -190,7 +190,7 @@ module Django {
      */
     module Field {
       /**
-       * An `API::Node` for references to `django.forms.fields.Field` or any subclass
+       * An `API::Node` representing the `django.forms.fields.Field` class or any subclass
        * that has explicitly been modeled in the CodeQL libraries.
        */
       abstract class ModeledSubclass extends API::Node {

From fd23e0bdda63169e2ca2c4dd86ecd3e796b8da57 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 14 Apr 2021 11:47:15 +0200
Subject: [PATCH 258/433] use more API nodes in XmlParsers, and recognize more
 results from parsing XML

---
 .../ql/src/semmle/javascript/ApiGraphs.qll    |   2 +-
 .../javascript/frameworks/XmlParsers.qll      | 155 +++++++++++++-----
 .../TaintTracking/BasicTaintTracking.expected |   4 +
 .../test/library-tests/TaintTracking/xml.js   |  25 ++-
 4 files changed, 139 insertions(+), 47 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index c0d28d913f70..385dc1e76d32 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -924,7 +924,7 @@ private module Label {
       result = member(pn) and
       // only consider properties with alphanumeric(-ish) names, excluding special properties
       // and properties whose names look like they are meant to be internal
-      pn.regexpMatch("(?!prototype$|__)[a-zA-Z_$][\\w\\-.$]*")
+      pn.regexpMatch("(?!prototype$|__)[\\w_$][\\w\\-.$]*")
     )
     or
     not exists(pr.getPropertyName()) and
diff --git a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
index 1e6677ff9e14..94bf5b093639 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
@@ -2,7 +2,9 @@
  * Provides classes for working with XML parser APIs.
  */
 
-import javascript as js
+private import javascript as js
+private import js::DataFlow as DataFlow
+private import js::API as API
 
 module XML {
   /**
@@ -12,9 +14,9 @@ module XML {
     /** Internal general entity. */
     InternalEntity() or
     /** External general entity, either parsed or unparsed. */
-    ExternalEntity(boolean parsed) { parsed = true or parsed = false } or
+    ExternalEntity(boolean parsed) { parsed = [true, false] } or
     /** Parameter entity, either internal or external. */
-    ParameterEntity(boolean external) { external = true or external = false }
+    ParameterEntity(boolean external) { external = [true, false] }
 
   /**
    * A call to an XML parsing function.
@@ -27,16 +29,19 @@ module XML {
     abstract predicate resolvesEntities(EntityKind kind);
 
     /** Gets a reference to a value resulting from parsing the XML. */
-    js::DataFlow::Node getAResult() { none() }
+    DataFlow::Node getAResult() { none() }
   }
 
   /**
    * An invocation of `libxmljs.parseXml` or `libxmljs.parseXmlString`.
    */
   class LibXmlJsParserInvocation extends ParserInvocation {
+    API::CallNode call;
+
     LibXmlJsParserInvocation() {
       exists(string m |
-        this = js::DataFlow::moduleMember("libxmljs", m).getACall().asExpr() and
+        call = API::moduleImport("libxmljs").getMember(m).getACall() and
+        this = call.asExpr() and
         m.matches("parseXml%")
       )
     }
@@ -53,24 +58,67 @@ module XML {
         noent.mayHaveBooleanValue(true)
       )
     }
-  }
 
-  /**
-   * Gets a call to method `methodName` on an instance of class `className` from module `modName`.
-   */
-  private js::MethodCallExpr moduleMethodCall(string modName, string className, string methodName) {
-    exists(js::DataFlow::ModuleImportNode mod |
-      mod.getPath() = modName and
-      result = mod.getAConstructorInvocation(className).getAMethodCall(methodName).asExpr()
-    )
+    /**
+     * A document from the `libxmljs` library.
+     * The API is based on https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/libxmljs/index.d.ts
+     */
+    private API::Node doc() {
+      result = call.getReturn()
+      or
+      result = doc().getMember("encoding").getReturn()
+      or
+      result = element().getMember("doc").getReturn()
+      or
+      result = element().getMember("parent").getReturn()
+    }
+
+    /**
+     * An `Element` from the `libxmljs` library.
+     */
+    private API::Node element() {
+      result = doc().getMember(["child", "get", "node", "root"]).getReturn()
+      or
+      result = [doc(), element()].getMember(["childNodes", "find"]).getReturn().getAMember()
+      or
+      result =
+        element()
+            .getMember([
+                "parent", "prevSibling", "nextSibling", "remove", "clone", "node", "child",
+                "prevElement", "nextElement"
+              ])
+            .getReturn()
+    }
+
+    /**
+     * An `Attr` from the `libxmljs` library.
+     */
+    private API::Node attr() {
+      result = element().getMember("attr").getReturn()
+      or
+      result = element().getMember("attrs").getReturn().getAMember()
+    }
+
+    override DataFlow::Node getAResult() {
+      result = [doc(), element(), attr()].getAnImmediateUse()
+      or
+      result = element().getMember(["name", "text"]).getACall()
+      or
+      result = attr().getMember(["name", "value"]).getACall()
+      or
+      result = element().getMember("namespace").getReturn().getMember(["href", "prefix"]).getACall()
+    }
   }
 
   /**
    * An invocation of `libxmljs.SaxParser.parseString`.
    */
   class LibXmlJsSaxParserInvocation extends ParserInvocation {
+    API::Node parser;
+
     LibXmlJsSaxParserInvocation() {
-      this = moduleMethodCall("libxmljs", "SaxParser", "parseString")
+      parser = API::moduleImport("libxmljs").getMember("SaxParser").getInstance() and
+      this = parser.getMember("parseString").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -79,14 +127,21 @@ module XML {
       // entities are resolved by default
       any()
     }
+
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
+    }
   }
 
   /**
    * An invocation of `libxmljs.SaxPushParser.push`.
    */
   class LibXmlJsSaxPushParserInvocation extends ParserInvocation {
+    API::Node parser;
+
     LibXmlJsSaxPushParserInvocation() {
-      this = moduleMethodCall("libxmljs", "SaxPushParser", "push")
+      parser = API::moduleImport("libxmljs").getMember("SaxPushParser").getInstance() and
+      this = parser.getMember("push").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -95,17 +150,21 @@ module XML {
       // entities are resolved by default
       any()
     }
+
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
+    }
   }
 
   /**
    * An invocation of `expat.Parser.parse` or `expat.Parser.write`.
    */
   class ExpatParserInvocation extends ParserInvocation {
-    js::DataFlow::NewNode parser;
+    API::Node parser;
 
     ExpatParserInvocation() {
-      parser = js::DataFlow::moduleMember("node-expat", "Parser").getAnInstantiation() and
-      this = parser.getAMemberCall(["parse", "write"]).asExpr()
+      parser = API::moduleImport("node-expat").getMember("Parser").getInstance() and
+      this = parser.getMember(["parse", "write"]).getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -115,8 +174,8 @@ module XML {
       kind = InternalEntity()
     }
 
-    override js::DataFlow::Node getAResult() {
-      result = parser.getAMemberCall("on").getABoundCallbackParameter(1, _)
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
     }
   }
 
@@ -125,17 +184,22 @@ module XML {
    */
   private class DOMParserXmlParserInvocation extends XML::ParserInvocation {
     DOMParserXmlParserInvocation() {
-      exists(js::DataFlow::GlobalVarRefNode domparser |
-        domparser.getName() = "DOMParser" and
-        this = domparser.getAnInstantiation().getAMethodCall("parseFromString").asExpr() and
-        // type contains the string `xml`, that is, it's not `text/html`
-        getArgument(1).mayHaveStringValue(any(string tp | tp.matches("%xml%")))
-      )
+      this =
+        DataFlow::globalVarRef("DOMParser")
+            .getAnInstantiation()
+            .getAMethodCall("parseFromString")
+            .asExpr() and
+      // type contains the string `xml`, that is, it's not `text/html`
+      getArgument(1).mayHaveStringValue(any(string tp | tp.matches("%xml%")))
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
 
     override predicate resolvesEntities(XML::EntityKind kind) { kind = InternalEntity() }
+
+    // The result is an XMLDocument (https://developer.mozilla.org/en-US/docs/Web/API/XMLDocument).
+    // The API of the XMLDocument is not modelled.
+    override DataFlow::Node getAResult() { result.asExpr() = this }
   }
 
   /**
@@ -143,8 +207,8 @@ module XML {
    */
   private class IELegacyXmlParserInvocation extends XML::ParserInvocation {
     IELegacyXmlParserInvocation() {
-      exists(js::DataFlow::NewNode activeXObject, string activeXType |
-        activeXObject = js::DataFlow::globalVarRef("ActiveXObject").getAnInstantiation() and
+      exists(DataFlow::NewNode activeXObject, string activeXType |
+        activeXObject = DataFlow::globalVarRef("ActiveXObject").getAnInstantiation() and
         activeXObject.getArgument(0).asExpr().mayHaveStringValue(activeXType) and
         activeXType.regexpMatch("Microsoft\\.XMLDOM|Msxml.*\\.DOMDocument.*") and
         this = activeXObject.getAMethodCall("loadXML").asExpr()
@@ -173,10 +237,10 @@ module XML {
    * An invocation of `xml2js`.
    */
   private class Xml2JSInvocation extends XML::ParserInvocation {
-    js::DataFlow::CallNode call;
+    API::CallNode call;
 
     Xml2JSInvocation() {
-      exists(js::API::Node imp | imp = js::API::moduleImport("xml2js") |
+      exists(API::Node imp | imp = API::moduleImport("xml2js") |
         call = [imp, imp.getMember("Parser").getInstance()].getMember("parseString").getACall() and
         this = call.asExpr()
       )
@@ -189,7 +253,7 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result = call.getABoundCallbackParameter(call.getNumArgument() - 1, 1)
     }
   }
@@ -198,10 +262,10 @@ module XML {
    * An invocation of `sax`.
    */
   private class SaxInvocation extends XML::ParserInvocation {
-    js::DataFlow::InvokeNode parser;
+    API::InvokeNode parser;
 
     SaxInvocation() {
-      exists(js::API::Node imp | imp = js::API::moduleImport("sax") |
+      exists(API::Node imp | imp = API::moduleImport("sax") |
         parser = imp.getMember("parser").getACall()
         or
         parser = imp.getMember("SAXParser").getAnInstantiation()
@@ -216,13 +280,13 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result =
         parser
-            .getAPropertyWrite(any(string s | s.matches("on%")))
-            .getRhs()
-            .getAFunctionValue()
+            .getReturn()
+            .getMember(any(string s | s.matches("on%")))
             .getAParameter()
+            .getAnImmediateUse()
     }
   }
 
@@ -232,7 +296,8 @@ module XML {
   private class XmlJSInvocation extends XML::ParserInvocation {
     XmlJSInvocation() {
       this =
-        js::DataFlow::moduleMember("xml-js", ["xml2json", "xml2js", "json2xml", "js2xml"])
+        API::moduleImport("xml-js")
+            .getMember(["xml2json", "xml2js", "json2xml", "js2xml"])
             .getACall()
             .asExpr()
     }
@@ -244,18 +309,18 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() { result.asExpr() = this }
+    override DataFlow::Node getAResult() { result.asExpr() = this }
   }
 
   /**
    * An invocation of `htmlparser2`.
    */
   private class HtmlParser2Invocation extends XML::ParserInvocation {
-    js::DataFlow::NewNode parser;
+    API::NewNode parser;
 
     HtmlParser2Invocation() {
-      parser = js::DataFlow::moduleMember("htmlparser2", "Parser").getAnInstantiation() and
-      this = parser.getAMemberCall("write").asExpr()
+      parser = API::moduleImport("htmlparser2").getMember("Parser").getAnInstantiation() and
+      this = parser.getReturn().getMember("write").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -265,7 +330,7 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result =
         parser
             .getArgument(0)
@@ -277,7 +342,7 @@ module XML {
   }
 
   private class XMLParserTaintStep extends js::TaintTracking::SharedTaintStep {
-    override predicate deserializeStep(js::DataFlow::Node pred, js::DataFlow::Node succ) {
+    override predicate deserializeStep(DataFlow::Node pred, DataFlow::Node succ) {
       exists(XML::ParserInvocation parser |
         pred.asExpr() = parser.getSourceArgument() and
         succ = parser.getAResult()
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index fe0663b2adaf..8eae0bb62aa5 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -166,3 +166,7 @@ typeInferenceMismatch
 | xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |
 | xml.js:26:27:26:34 | source() | xml.js:26:10:26:39 | convert ... (), {}) |
 | xml.js:34:18:34:25 | source() | xml.js:31:18:31:21 | name |
+| xml.js:41:15:41:22 | source() | xml.js:44:10:44:22 | gchild.text() |
+| xml.js:41:15:41:22 | source() | xml.js:49:10:49:34 | child.a ... value() |
+| xml.js:41:15:41:22 | source() | xml.js:52:10:52:34 | child2. ... .name() |
+| xml.js:41:15:41:22 | source() | xml.js:58:12:58:14 | str |
diff --git a/javascript/ql/test/library-tests/TaintTracking/xml.js b/javascript/ql/test/library-tests/TaintTracking/xml.js
index 8e3785d4a2b3..b1c6ab37ad33 100644
--- a/javascript/ql/test/library-tests/TaintTracking/xml.js
+++ b/javascript/ql/test/library-tests/TaintTracking/xml.js
@@ -34,4 +34,27 @@
     parser.write(source());
     parser.end();
 
-})();
\ No newline at end of file
+})();
+
+(function () {
+    var libxml = require("libxmljs");
+    var xml = source();
+    var xmlDoc = libxml.parseXmlString(xml);
+    var gchild = xmlDoc.get('//grandchild');
+    sink(gchild.text()); // NOT OK
+
+    var children = xmlDoc.root().childNodes();
+    var child = children[0];
+
+    sink(child.attr('foo').value()); // NOT OK
+
+    var child2 = xmlDoc.root().child()
+    sink(child2.attr('foo').name()); // NOT OK
+
+    const SaxPushParser = libxml.SaxPushParser;
+    var parser = new SaxPushParser();
+    parser.push(xml);
+    parser.on('characters', function (str) {
+      sink(str); // NOT OK
+    })    
+});
\ No newline at end of file

From 2e40d013973f8439bcc9085ff9e651b3c1af2e5c Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 13:01:31 +0200
Subject: [PATCH 259/433] Update
 cpp/ql/src/semmle/code/cpp/security/Overflow.qll

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
---
 cpp/ql/src/semmle/code/cpp/security/Overflow.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
index 3f7a7b17b059..74b61c379257 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -98,7 +98,7 @@ VariableAccess varUse(LocalScopeVariable v) { result = v.getAnAccess() }
  * Holds if `e` potentially overflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
-  convertedExprMightOverflow(e) and
+  convertedExprMightOverflowPositively(e) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // overflow possible if large

From da3650871454fa367245cd852abc552f37fd2b45 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 14:41:22 +0200
Subject: [PATCH 260/433] Revert "C++: As response to the review comments this
 commit adds a reference-to-pointer state to AddressFlow. A call to an
 unwrapper function now adds a pointer -> reference-to-pointer transition, and
 a ReferenceDereference adds a reference-to-pointer -> pointer transition."

This reverts commit 5aeaab7c6d7ff786c970b41f1bebce8c6040d838.
---
 .../cpp/dataflow/internal/AddressFlow.qll     | 105 +++---------------
 .../dataflow/taint-tests/localTaint.expected  |  49 ++++----
 2 files changed, 38 insertions(+), 116 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index e179f7e8717b..7e76c1540e30 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -59,6 +59,8 @@ private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
   pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
   or
   pointerIn = lvalueOut.(PointerDereferenceExpr).getOperand().getFullyConverted()
+  or
+  pointerIn = lvalueOut.(OverloadedPointerDereferenceExpr).getQualifier().getFullyConverted()
 }
 
 private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
@@ -67,19 +69,6 @@ private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
   lvalueIn = pointerOut.(AddressOfExpr).getOperand().getFullyConverted()
 }
 
-/**
- * Since pointer wrappers behave as raw pointers, we treat the conversions from `lvalueToLvalueStepPure`
- * as pointer-to-pointer steps when they involve pointer wrappers.
- */
-private predicate pointerWrapperToPointerWrapperStep(Expr pointerIn, Expr pointerOut) {
-  pointerIn.getUnspecifiedType() instanceof PointerWrapper and
-  pointerIn.getConversion() = pointerOut and
-  pointerOut.(CStyleCast).isImplicit()
-  or
-  pointerOut.getUnspecifiedType() instanceof PointerWrapper and
-  pointerIn.getConversion() = pointerOut.(ReferenceDereferenceExpr)
-}
-
 private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
   (
     pointerOut instanceof PointerAddExpr
@@ -104,60 +93,35 @@ private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
   pointerIn = pointerOut.(CommaExpr).getRightOperand().getFullyConverted()
   or
   pointerIn = pointerOut.(StmtExpr).getResultExpr().getFullyConverted()
-  or
-  pointerWrapperToPointerWrapperStep(pointerIn, pointerOut)
 }
 
 private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
   lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
+  or
+  exists(PointerWrapper wrapper, Call call | call = referenceOut |
+    referenceOut.getUnspecifiedType() instanceof ReferenceType and
+    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
+    lvalueIn = call.getQualifier().getFullyConverted()
+  )
 }
 
 private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
   referenceIn.getConversion() = lvalueOut.(ReferenceDereferenceExpr)
 }
 
-private predicate referenceToPointerToPointerStep(Expr referenceToPointerIn, Expr pointerOut) {
-  exists(CopyConstructor copy, Call call | call = pointerOut |
-    copy.getDeclaringType() instanceof PointerWrapper and
-    call.getTarget() = copy and
-    // The 0'th argument is the value being copied.
-    referenceToPointerIn = call.getArgument(0).getFullyConverted()
-  )
-  or
-  referenceToPointerIn.getConversion() = pointerOut.(ReferenceDereferenceExpr)
-}
-
-/**
- * This predicate exists only to support "fake pointer" objects like
- * smart pointers. We treat these as raw pointers for dataflow purposes.
- */
-private predicate referenceToPointerToUpdate(
-  Expr referenceToPointer, Expr outer, ControlFlowNode node
-) {
-  exists(Call call |
-    node = call and
-    outer = call.getAnArgument().getFullyConverted() and
-    not stdIdentityFunction(call.getTarget()) and
-    not stdAddressOf(call.getTarget()) and
-    exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
-      rt.getBaseType().getUnspecifiedType() =
-        any(PointerWrapper wrapper | not wrapper.pointsToConst())
-    )
-  ) and
-  referenceToPointer = outer
-  or
-  exists(Expr pointerMid |
-    referenceToPointerToPointerStep(referenceToPointer, pointerMid) and
-    pointerToUpdate(pointerMid, outer, node)
-  )
-}
-
 private predicate referenceToPointerStep(Expr referenceIn, Expr pointerOut) {
   pointerOut =
     any(FunctionCall call |
       stdAddressOf(call.getTarget()) and
       referenceIn = call.getArgument(0).getFullyConverted()
     )
+  or
+  exists(CopyConstructor copy, Call call | call = pointerOut |
+    copy.getDeclaringType() instanceof PointerWrapper and
+    call.getTarget() = copy and
+    // The 0'th argument is the value being copied.
+    referenceIn = call.getArgument(0).getFullyConverted()
+  )
 }
 
 private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
@@ -274,16 +238,6 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
     pointerToPointerStep(pointer, pointerMid) and
     pointerToUpdate(pointerMid, outer, node)
   )
-  or
-  exists(Expr referenceMid |
-    pointerToReferenceStep(pointer, referenceMid) and
-    referenceToUpdate(referenceMid, outer, node)
-  )
-  or
-  exists(Expr referenceToPointerMid |
-    pointerToReferenceToPointerStep(pointer, referenceToPointerMid) and
-    referenceToPointerToUpdate(referenceToPointerMid, outer, node)
-  )
 }
 
 private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode node) {
@@ -293,7 +247,9 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
     not stdIdentityFunction(call.getTarget()) and
     not stdAddressOf(call.getTarget()) and
     exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
-      not rt.getBaseType().isConst()
+      not rt.getBaseType().isConst() or
+      rt.getBaseType().getUnspecifiedType() =
+        any(PointerWrapper wrapper | not wrapper.pointsToConst())
     )
   ) and
   reference = outer
@@ -314,14 +270,6 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
   )
 }
 
-private predicate pointerToReferenceStep(Expr pointerIn, Expr referenceOut) {
-  exists(PointerWrapper wrapper, Call call | call = referenceOut |
-    referenceOut.getUnspecifiedType() instanceof ReferenceType and
-    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
-    pointerIn = call.getQualifier().getFullyConverted()
-  )
-}
-
 private predicate lvalueFromVariableAccess(VariableAccess va, Expr lvalue) {
   // Base case for non-reference types.
   lvalue = va and
@@ -383,21 +331,6 @@ private predicate referenceFromVariableAccess(VariableAccess va, Expr reference)
     lvalueFromVariableAccess(va, prev) and
     lvalueToReferenceStep(prev, reference)
   )
-  or
-  exists(Expr prev |
-    pointerFromVariableAccess(va, prev) and
-    pointerToReferenceStep(prev, reference)
-  )
-}
-
-private predicate pointerToReferenceToPointerStep(Expr pointerIn, Expr referenceToPointerOut) {
-  pointerIn.getConversion() = referenceToPointerOut.(ReferenceToExpr)
-  or
-  exists(PointerWrapper wrapper, Call call | call = referenceToPointerOut |
-    referenceToPointerOut.getUnspecifiedType() instanceof ReferenceType and
-    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
-    pointerIn = call.getQualifier().getFullyConverted()
-  )
 }
 
 /**
@@ -418,8 +351,6 @@ predicate valueToUpdate(Expr inner, Expr outer, ControlFlowNode node) {
     pointerToUpdate(inner, outer, node)
     or
     referenceToUpdate(inner, outer, node)
-    or
-    referenceToPointerToUpdate(inner, outer, node)
   ) and
   (
     inner instanceof VariableAccess and
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 90a494de6f83..50d5070a1442 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -948,16 +948,12 @@
 | map.cpp:170:23:170:28 | call to source | map.cpp:170:7:170:30 | ... = ... |  |
 | map.cpp:171:7:171:9 | m10 | map.cpp:171:10:171:10 | call to operator[] | TAINT |
 | map.cpp:171:7:171:9 | ref arg m10 | map.cpp:252:1:252:1 | m10 |  |
-| map.cpp:171:10:171:10 | ref arg call to operator[] | map.cpp:171:7:171:9 | ref arg m10 | TAINT |
 | map.cpp:172:7:172:9 | m11 | map.cpp:172:10:172:10 | call to operator[] | TAINT |
 | map.cpp:172:7:172:9 | ref arg m11 | map.cpp:252:1:252:1 | m11 |  |
-| map.cpp:172:10:172:10 | ref arg call to operator[] | map.cpp:172:7:172:9 | ref arg m11 | TAINT |
 | map.cpp:173:7:173:9 | m12 | map.cpp:173:10:173:10 | call to operator[] | TAINT |
 | map.cpp:173:7:173:9 | ref arg m12 | map.cpp:252:1:252:1 | m12 |  |
-| map.cpp:173:10:173:10 | ref arg call to operator[] | map.cpp:173:7:173:9 | ref arg m12 | TAINT |
 | map.cpp:174:7:174:9 | m13 | map.cpp:174:10:174:10 | call to operator[] | TAINT |
 | map.cpp:174:7:174:9 | ref arg m13 | map.cpp:252:1:252:1 | m13 |  |
-| map.cpp:174:10:174:10 | ref arg call to operator[] | map.cpp:174:7:174:9 | ref arg m13 | TAINT |
 | map.cpp:177:27:177:29 | call to map | map.cpp:178:2:178:4 | m14 |  |
 | map.cpp:177:27:177:29 | call to map | map.cpp:179:2:179:4 | m14 |  |
 | map.cpp:177:27:177:29 | call to map | map.cpp:180:2:180:4 | m14 |  |
@@ -1655,16 +1651,12 @@
 | map.cpp:322:23:322:28 | call to source | map.cpp:322:7:322:30 | ... = ... |  |
 | map.cpp:323:7:323:9 | m10 | map.cpp:323:10:323:10 | call to operator[] | TAINT |
 | map.cpp:323:7:323:9 | ref arg m10 | map.cpp:438:1:438:1 | m10 |  |
-| map.cpp:323:10:323:10 | ref arg call to operator[] | map.cpp:323:7:323:9 | ref arg m10 | TAINT |
 | map.cpp:324:7:324:9 | m11 | map.cpp:324:10:324:10 | call to operator[] | TAINT |
 | map.cpp:324:7:324:9 | ref arg m11 | map.cpp:438:1:438:1 | m11 |  |
-| map.cpp:324:10:324:10 | ref arg call to operator[] | map.cpp:324:7:324:9 | ref arg m11 | TAINT |
 | map.cpp:325:7:325:9 | m12 | map.cpp:325:10:325:10 | call to operator[] | TAINT |
 | map.cpp:325:7:325:9 | ref arg m12 | map.cpp:438:1:438:1 | m12 |  |
-| map.cpp:325:10:325:10 | ref arg call to operator[] | map.cpp:325:7:325:9 | ref arg m12 | TAINT |
 | map.cpp:326:7:326:9 | m13 | map.cpp:326:10:326:10 | call to operator[] | TAINT |
 | map.cpp:326:7:326:9 | ref arg m13 | map.cpp:438:1:438:1 | m13 |  |
-| map.cpp:326:10:326:10 | ref arg call to operator[] | map.cpp:326:7:326:9 | ref arg m13 | TAINT |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:330:2:330:4 | m14 |  |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:331:2:331:4 | m14 |  |
 | map.cpp:329:37:329:39 | call to unordered_map | map.cpp:332:2:332:4 | m14 |  |
@@ -2455,9 +2447,6 @@
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:55:24:55:25 | i1 |  |
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:57:9:57:10 | i1 |  |
-| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:55:30:55:31 | s1 |  |
-| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:57:9:57:10 | ref arg i1 | TAINT |
-| set.cpp:57:8:57:8 | ref arg call to operator* | set.cpp:126:1:126:1 | s1 |  |
 | set.cpp:57:9:57:10 | i1 | set.cpp:57:8:57:8 | call to operator* | TAINT |
 | set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:24:55:25 | i1 |  |
 | set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
@@ -2476,9 +2465,6 @@
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:59:24:59:25 | i2 |  |
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:61:9:61:10 | i2 |  |
-| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:59:30:59:31 | s2 |  |
-| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:61:9:61:10 | ref arg i2 | TAINT |
-| set.cpp:61:8:61:8 | ref arg call to operator* | set.cpp:126:1:126:1 | s2 |  |
 | set.cpp:61:9:61:10 | i2 | set.cpp:61:8:61:8 | call to operator* | TAINT |
 | set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:24:59:25 | i2 |  |
 | set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
@@ -2965,9 +2951,6 @@
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:169:24:169:25 | i1 |  |
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:171:9:171:10 | i1 |  |
-| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:169:30:169:31 | s1 |  |
-| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:171:9:171:10 | ref arg i1 | TAINT |
-| set.cpp:171:8:171:8 | ref arg call to operator* | set.cpp:238:1:238:1 | s1 |  |
 | set.cpp:171:9:171:10 | i1 | set.cpp:171:8:171:8 | call to operator* | TAINT |
 | set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:24:169:25 | i1 |  |
 | set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
@@ -2986,9 +2969,6 @@
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:173:24:173:25 | i2 |  |
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:175:9:175:10 | i2 |  |
-| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:173:30:173:31 | s2 |  |
-| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:175:9:175:10 | ref arg i2 | TAINT |
-| set.cpp:175:8:175:8 | ref arg call to operator* | set.cpp:238:1:238:1 | s2 |  |
 | set.cpp:175:9:175:10 | i2 | set.cpp:175:8:175:8 | call to operator* | TAINT |
 | set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:24:173:25 | i2 |  |
 | set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
@@ -3243,7 +3223,7 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
+| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* |  |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
@@ -3255,7 +3235,7 @@
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
+| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* |  |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
@@ -3271,13 +3251,13 @@
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
+| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:10:37:15 | call to source | smart_pointer.cpp:37:5:37:17 | ... = ... |  |
 | smart_pointer.cpp:38:10:38:10 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
-| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* | TAINT |
+| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:45:6:45:6 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
@@ -3285,13 +3265,13 @@
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
+| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:10:45:15 | call to source | smart_pointer.cpp:45:5:45:17 | ... = ... |  |
 | smart_pointer.cpp:46:10:46:10 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
-| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* | TAINT |
+| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* |  |
 | smart_pointer.cpp:51:30:51:50 | call to make_shared | smart_pointer.cpp:52:10:52:10 | p |  |
 | smart_pointer.cpp:51:52:51:57 | call to source | smart_pointer.cpp:51:30:51:50 | call to make_shared | TAINT |
 | smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get |  |
@@ -3312,7 +3292,7 @@
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
-| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* | TAINT |
+| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* |  |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:71:10:71:15 | call to source | smart_pointer.cpp:71:3:71:17 | ... = ... |  |
@@ -3323,7 +3303,7 @@
 | smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
 | smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:77:9:77:9 | p |  |
-| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* | TAINT |
+| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:86:45:86:45 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:87:3:87:3 | p |  |
 | smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:88:8:88:8 | p |  |
@@ -3392,7 +3372,7 @@
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
-| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* | TAINT |
+| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
 | smart_pointer.cpp:121:10:121:15 | call to source | smart_pointer.cpp:121:3:121:17 | ... = ... |  |
@@ -3429,6 +3409,7 @@
 | smart_pointer.cpp:129:9:129:9 | call to operator* | smart_pointer.cpp:129:8:129:8 | call to operator* | TAINT |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:8:129:8 | call to operator* |  |
 | smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:9:129:9 | call to operator* | TAINT |
 | smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
@@ -3456,6 +3437,7 @@
 | smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:8:137:8 | call to operator* |  |
 | smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:9:137:9 | call to operator* | TAINT |
 | smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
@@ -3494,20 +3476,26 @@
 | standalone_iterators.cpp:85:35:85:36 | c1 | standalone_iterators.cpp:85:38:85:42 | call to begin | TAINT |
 | standalone_iterators.cpp:85:35:85:36 | ref arg c1 | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:85:38:85:42 | call to begin | standalone_iterators.cpp:86:6:86:7 | i1 |  |
+| standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:86:6:86:7 | i1 | standalone_iterators.cpp:86:8:86:8 | call to operator-- |  |
 | standalone_iterators.cpp:86:8:86:8 | call to operator-- | standalone_iterators.cpp:86:5:86:5 | call to operator* | TAINT |
+| standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
 | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
+| standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:13:86:18 | call to source | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | c2 | standalone_iterators.cpp:89:38:89:42 | call to begin | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | ref arg c2 | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:89:38:89:42 | call to begin | standalone_iterators.cpp:90:6:90:7 | i2 |  |
+| standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:90:6:90:7 | i2 | standalone_iterators.cpp:90:8:90:8 | call to operator-- |  |
 | standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
+| standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
 | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
+| standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 |  |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 |  |
@@ -3525,10 +3513,13 @@
 | standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b |  |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
+| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 |  |

From bc7cc2f7ceb9bf07e9ddf634435322396668d821 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 14:50:27 +0200
Subject: [PATCH 261/433] C++: Remove rule that wasn't needed.

---
 .../semmle/code/cpp/dataflow/internal/AddressFlow.qll    | 2 --
 .../dataflow/taint-tests/localTaint.expected             | 9 ---------
 2 files changed, 11 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 7e76c1540e30..f6072763e1a4 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -59,8 +59,6 @@ private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
   pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
   or
   pointerIn = lvalueOut.(PointerDereferenceExpr).getOperand().getFullyConverted()
-  or
-  pointerIn = lvalueOut.(OverloadedPointerDereferenceExpr).getQualifier().getFullyConverted()
 }
 
 private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 50d5070a1442..59ba0948d858 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3476,26 +3476,20 @@
 | standalone_iterators.cpp:85:35:85:36 | c1 | standalone_iterators.cpp:85:38:85:42 | call to begin | TAINT |
 | standalone_iterators.cpp:85:35:85:36 | ref arg c1 | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:85:38:85:42 | call to begin | standalone_iterators.cpp:86:6:86:7 | i1 |  |
-| standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | standalone_iterators.cpp:87:10:87:11 | c1 |  |
 | standalone_iterators.cpp:86:6:86:7 | i1 | standalone_iterators.cpp:86:8:86:8 | call to operator-- |  |
 | standalone_iterators.cpp:86:8:86:8 | call to operator-- | standalone_iterators.cpp:86:5:86:5 | call to operator* | TAINT |
-| standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
 | standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:6:86:7 | ref arg i1 |  |
-| standalone_iterators.cpp:86:8:86:8 | ref arg call to operator-- | standalone_iterators.cpp:86:8:86:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:86:13:86:18 | call to source | standalone_iterators.cpp:86:5:86:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | c2 | standalone_iterators.cpp:89:38:89:42 | call to begin | TAINT |
 | standalone_iterators.cpp:89:35:89:36 | ref arg c2 | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:89:38:89:42 | call to begin | standalone_iterators.cpp:90:6:90:7 | i2 |  |
-| standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | TAINT |
 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | standalone_iterators.cpp:91:10:91:11 | c2 |  |
 | standalone_iterators.cpp:90:6:90:7 | i2 | standalone_iterators.cpp:90:8:90:8 | call to operator-- |  |
 | standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
-| standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
 | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
-| standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:8:90:8 | call to operator-- [inner post update] |  |
 | standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 |  |
 | standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 |  |
@@ -3513,13 +3507,10 @@
 | standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... |  |
 | standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b |  |
-| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
-| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 |  |
 | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 |  |
 | standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
-| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:103:3:103:3 | a [inner post update] |  |
 | standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a |  |
 | standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
 | standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 |  |

From bb447d7174141dc518e6ce90367121280fec1d80 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 16:30:43 +0200
Subject: [PATCH 262/433] C++: Make sure missingGuardAgainstOverflow (and
 underflow) holds when range analysis fails to deduce a bound.

---
 cpp/ql/src/semmle/code/cpp/security/Overflow.qll | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
index 74b61c379257..465e64b9b6ca 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -6,6 +6,7 @@
 import cpp
 import semmle.code.cpp.controlflow.Dominance
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 
 /**
  * Holds if the value of `use` is guarded using `abs`.
@@ -98,7 +99,12 @@ VariableAccess varUse(LocalScopeVariable v) { result = v.getAnAccess() }
  * Holds if `e` potentially overflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
-  convertedExprMightOverflowPositively(e) and
+  (
+    convertedExprMightOverflowPositively(e)
+    or
+    // Ensure that the predicate holds when range analysis cannot determine an upper bound
+    upperBound(e.getFullyConverted()) = exprMaxVal(e.getFullyConverted())
+  ) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // overflow possible if large
@@ -120,7 +126,12 @@ predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
  * Holds if `e` potentially underflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstUnderflow(Operation e, VariableAccess use) {
-  convertedExprMightOverflowNegatively(e) and
+  (
+    convertedExprMightOverflowNegatively(e)
+    or
+    // Ensure that the predicate holds when range analysis cannot determine a lower bound
+    lowerBound(e.getFullyConverted()) = exprMinVal(e.getFullyConverted())
+  ) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // underflow possible if use is left operand and small

From 53a320a810536ae59a37c45042e712b2863a377d Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 16:33:18 +0200
Subject: [PATCH 263/433] C++: Fix duplicate names.

---
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql        | 2 +-
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
index 012109074e9a..e4577968730e 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
@@ -3,7 +3,7 @@
  * @description The expression `buffer [strlen (buffer)] = 0` is potentially dangerous, if the variable `buffer` does not have a terminal zero, then access beyond the bounds of the allocated memory is possible, which will lead to undefined behavior.
  *              If terminal zero is present, then the specified expression is meaningless.
  * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
+ * @id cpp/access-memory-location-after-end-buffer-strlen
  * @problem.severity warning
  * @precision medium
  * @tags correctness
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index 5311ffe2708e..e7021bda1ceb 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -2,7 +2,7 @@
  * @name Access Of Memory Location After The End Of A Buffer Using Strncat
  * @description Calls of the form `strncat(dest, source, sizeof (dest) - strlen (dest))` set the third argument to one more than possible. So when `dest` is full, the expression `sizeof(dest) - strlen (dest)` will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the `dest` buffer.
  * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
+ * @id cpp/access-memory-location-after-end-buffer-strncat
  * @problem.severity warning
  * @precision medium
  * @tags correctness

From ed64ed3d8d64cb27f18488cef355fa23911ba302 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 14 Apr 2021 16:45:27 +0200
Subject: [PATCH 264/433] C++: Make
 exprMightOverflowPositively/exprMightOverFlowNegatively hold for unanalyzable
 expressions. This hopefully means that expressions that do not satisfy these
 predicates will never overflow/underflow.

---
 .../semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll   | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
index f3bbbddd97e4..d22a7f96a45f 100644
--- a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -1630,6 +1630,9 @@ private module SimpleRangeAnalysisCached {
     // bound of `x`, so the standard logic (above) does not work for
     // detecting whether it might overflow.
     getLowerBoundsImpl(expr.(PostfixDecrExpr)) = exprMinVal(expr)
+    or
+    // Expressions we cannot analyze could potentially overflow
+    not analyzableExpr(expr)
   }
 
   /**
@@ -1657,6 +1660,9 @@ private module SimpleRangeAnalysisCached {
     // bound of `x`, so the standard logic (above) does not work for
     // detecting whether it might overflow.
     getUpperBoundsImpl(expr.(PostfixIncrExpr)) = exprMaxVal(expr)
+    or
+    // Expressions we cannot analyze could potentially overflow
+    not analyzableExpr(expr)
   }
 
   /**

From b29f35f564f7f657a6f1fed4e63b5396d3d64220 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Wed, 14 Apr 2021 11:15:16 -0400
Subject: [PATCH 265/433] Fix formatting

---
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 81a07ad9d04a..f5fb7309cff6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -362,7 +362,7 @@ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
 
 /**
  * Not every store instruction generates a chi instruction that we can attach a PostUpdateNode to.
- * For instance, an update to a field of a struct containing only one field. Even if the store does 
+ * For instance, an update to a field of a struct containing only one field. Even if the store does
  * have a chi instruction, a subsequent use of the result of the store may be linked directly to the
  * result of the store as an inexact definition if the store totally overlaps the use. For these
  * cases we attach the PostUpdateNode to the store instruction. There's no obvious pre update node

From 392adf2a2576ac86cb66364625742cc3c562482d Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Wed, 14 Apr 2021 08:25:34 -0700
Subject: [PATCH 266/433] Workflows: Remove dry-run flag for labeller

---
 .github/workflows/close-stale.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/close-stale.yml b/.github/workflows/close-stale.yml
index 6065f79aa7c1..746a13317b22 100644
--- a/.github/workflows/close-stale.yml
+++ b/.github/workflows/close-stale.yml
@@ -25,6 +25,6 @@ jobs:
         days-before-pr-stale: -1
         days-before-pr-close: -1
         
-        # Dry-run only. remove this when we are ready to actually change issues
-        debug-only: true
-        operations-per-run: 1000
+        # Uncomment for dry-run
+        # debug-only: true
+        # operations-per-run: 1000

From a7fcf52267604a257937f2a18ba2be321debea9e Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Wed, 14 Apr 2021 15:36:01 +0000
Subject: [PATCH 267/433] Python: Fix bad join in `total_cost`

The recent change to `appliesTo` lead to a perturbation in the join
order of this predicate, which resulted in a cartesian product between
`call` and `ctx` being created (before being filtered by `appliesTo`).

By splitting the intermediate result into its own helper predicate,
suitably marked to prevent inlining/magic, we prevent this from
happening again.
---
 python/ql/src/semmle/python/pointsto/PointsToContext.qll | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/pointsto/PointsToContext.qll b/python/ql/src/semmle/python/pointsto/PointsToContext.qll
index 15b28d9cdb07..e85761e39169 100644
--- a/python/ql/src/semmle/python/pointsto/PointsToContext.qll
+++ b/python/ql/src/semmle/python/pointsto/PointsToContext.qll
@@ -100,10 +100,14 @@ private int total_call_cost(CallNode call) {
   if call_to_init_or_del(call) then result = 1 else result = call_cost(call) + splay_cost(call)
 }
 
+pragma[nomagic]
+private int relevant_call_cost(PointsToContext ctx, CallNode call) {
+  ctx.appliesTo(call) and result = total_call_cost(call)
+}
+
 pragma[noinline]
 private int total_cost(CallNode call, PointsToContext ctx) {
-  ctx.appliesTo(call) and
-  result = total_call_cost(call) + context_cost(ctx)
+  result = relevant_call_cost(ctx, call) + context_cost(ctx)
 }
 
 cached

From 97186b3d30bcfc095cd4f30cc407330c094687a6 Mon Sep 17 00:00:00 2001
From: Artem Smotrakov <artem.smotrakov@gmail.com>
Date: Wed, 14 Apr 2021 19:30:58 +0300
Subject: [PATCH 268/433] Added comments for tests

---
 .../JakartaExpressionInjection.expected       | 86 +++++++++----------
 .../CWE-094/JakartaExpressionInjection.java   |  9 ++
 2 files changed, 52 insertions(+), 43 deletions(-)

diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
index ef002aefdf5c..390871b54cf1 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -1,46 +1,46 @@
 edges
-| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:24:31:24:40 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:30:24:30:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:37:24:37:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:44:24:44:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:54:24:54:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:61:24:61:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:68:24:68:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:77:24:77:33 | expression : String |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:86:24:86:33 | expression : String |
-| JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
-| JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
-| JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
-| JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
-| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:63:43:63:52 | expression |
-| JakartaExpressionInjection.java:68:24:68:33 | expression : String | JakartaExpressionInjection.java:72:13:72:13 | e |
-| JakartaExpressionInjection.java:77:24:77:33 | expression : String | JakartaExpressionInjection.java:81:13:81:13 | e |
-| JakartaExpressionInjection.java:86:24:86:33 | expression : String | JakartaExpressionInjection.java:90:13:90:13 | e |
+| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:32:24:32:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:40:24:40:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:48:24:48:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:59:24:59:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:67:24:67:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:75:24:75:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:85:24:85:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:95:24:95:33 | expression : String |
+| JakartaExpressionInjection.java:32:24:32:33 | expression : String | JakartaExpressionInjection.java:34:28:34:37 | expression |
+| JakartaExpressionInjection.java:40:24:40:33 | expression : String | JakartaExpressionInjection.java:42:32:42:41 | expression |
+| JakartaExpressionInjection.java:48:24:48:33 | expression : String | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression |
+| JakartaExpressionInjection.java:59:24:59:33 | expression : String | JakartaExpressionInjection.java:61:32:61:41 | expression |
+| JakartaExpressionInjection.java:67:24:67:33 | expression : String | JakartaExpressionInjection.java:69:43:69:52 | expression |
+| JakartaExpressionInjection.java:75:24:75:33 | expression : String | JakartaExpressionInjection.java:79:13:79:13 | e |
+| JakartaExpressionInjection.java:85:24:85:33 | expression : String | JakartaExpressionInjection.java:89:13:89:13 | e |
+| JakartaExpressionInjection.java:95:24:95:33 | expression : String | JakartaExpressionInjection.java:99:13:99:13 | e |
 nodes
-| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
-| JakartaExpressionInjection.java:24:31:24:40 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:30:24:30:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:32:28:32:37 | expression | semmle.label | expression |
-| JakartaExpressionInjection.java:37:24:37:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:39:32:39:41 | expression | semmle.label | expression |
-| JakartaExpressionInjection.java:44:24:44:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | semmle.label | lambdaExpression |
-| JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
-| JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:63:43:63:52 | expression | semmle.label | expression |
-| JakartaExpressionInjection.java:68:24:68:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:72:13:72:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:77:24:77:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:81:13:81:13 | e | semmle.label | e |
-| JakartaExpressionInjection.java:86:24:86:33 | expression : String | semmle.label | expression : String |
-| JakartaExpressionInjection.java:90:13:90:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:32:24:32:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:34:28:34:37 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:40:24:40:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:42:32:42:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:48:24:48:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | semmle.label | lambdaExpression |
+| JakartaExpressionInjection.java:59:24:59:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:61:32:61:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:67:24:67:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:69:43:69:52 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:75:24:75:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:79:13:79:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:85:24:85:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:89:13:89:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:95:24:95:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:99:13:99:13 | e | semmle.label | e |
 #select
-| JakartaExpressionInjection.java:32:28:32:37 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:32:28:32:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:39:32:39:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:39:32:39:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:56:32:56:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:56:32:56:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:63:43:63:52 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:63:43:63:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:72:13:72:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:72:13:72:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:81:13:81:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:81:13:81:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
-| JakartaExpressionInjection.java:90:13:90:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:90:13:90:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:34:28:34:37 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:34:28:34:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:42:32:42:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:42:32:42:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:61:32:61:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:61:32:61:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:69:43:69:52 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:69:43:69:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:79:13:79:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:79:13:79:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:89:13:89:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:89:13:89:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:99:13:99:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:99:13:99:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
index 2e1d1e55b020..ae5b6a8d5e41 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
@@ -15,6 +15,7 @@
 
 public class JakartaExpressionInjection {
     
+    // calls a consumer with a string received from a socket
     private static void testWithSocket(Consumer<String> action) throws IOException {
         try (ServerSocket serverSocket = new ServerSocket(0)) {
             try (Socket socket = serverSocket.accept()) {
@@ -26,6 +27,7 @@ private static void testWithSocket(Consumer<String> action) throws IOException {
         }
     }
 
+    // BAD (untrusted input to ELProcessor.eval)
     private static void testWithELProcessorEval() throws IOException {
         testWithSocket(expression -> {
             ELProcessor processor = new ELProcessor();
@@ -33,6 +35,7 @@ private static void testWithELProcessorEval() throws IOException {
         });
     }
 
+    // BAD (untrusted input to ELProcessor.getValue)
     private static void testWithELProcessorGetValue() throws IOException {
         testWithSocket(expression -> {   
             ELProcessor processor = new ELProcessor();
@@ -40,6 +43,7 @@ private static void testWithELProcessorGetValue() throws IOException {
         });
     }
 
+    // BAD (untrusted input to LambdaExpression.invoke)
     private static void testWithLambdaExpressionInvoke() throws IOException {
         testWithSocket(expression -> {
             ExpressionFactory factory = ELManager.getExpressionFactory();
@@ -50,6 +54,7 @@ private static void testWithLambdaExpressionInvoke() throws IOException {
         });
     }
 
+    // BAD (untrusted input to ELProcessor.setValue)
     private static void testWithELProcessorSetValue() throws IOException {
         testWithSocket(expression -> {
             ELProcessor processor = new ELProcessor();
@@ -57,6 +62,7 @@ private static void testWithELProcessorSetValue() throws IOException {
         });
     }
 
+    // BAD (untrusted input to ELProcessor.setVariable)
     private static void testWithELProcessorSetVariable() throws IOException {
         testWithSocket(expression -> {
             ELProcessor processor = new ELProcessor();
@@ -64,6 +70,7 @@ private static void testWithELProcessorSetVariable() throws IOException {
         });
     }
 
+    // BAD (untrusted input to ValueExpression.getValue when it was created by JUEL)
     private static void testWithJuelValueExpressionGetValue() throws IOException {
         testWithSocket(expression -> {
             ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
@@ -73,6 +80,7 @@ private static void testWithJuelValueExpressionGetValue() throws IOException {
         });
     }
 
+    // BAD (untrusted input to ValueExpression.setValue when it was created by JUEL)
     private static void testWithJuelValueExpressionSetValue() throws IOException {
         testWithSocket(expression -> {
             ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
@@ -82,6 +90,7 @@ private static void testWithJuelValueExpressionSetValue() throws IOException {
         });
     }
 
+    // BAD (untrusted input to MethodExpression.invoke when it was created by JUEL)
     private static void testWithJuelMethodExpressionInvoke() throws IOException {
         testWithSocket(expression -> {
             ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();

From 897d12420b6fa5f22b0716af82af65a5db00bb56 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Wed, 14 Apr 2021 16:49:12 +0000
Subject: [PATCH 269/433] Python: Prevent bad join in `isinstanceEvaluatesTo`

In some cases, we were joining the result of `val.getClass()` against
the first argument of `Types::improperSubclass` before filtering out the
vast majority of tuples by the call to `isinstance_call`.

To fix this, we let `isinstance_call` take care of figuring out the
class of the value being tested. As a bonus, this cleans up the only
other place where `isinstance_call` is used, where we _also_ want to
know the class of the value being tested in the `isinstance` call.
---
 python/ql/src/semmle/python/pointsto/PointsTo.qll | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
index 9706c6846f31..48bbb283d078 100644
--- a/python/ql/src/semmle/python/pointsto/PointsTo.qll
+++ b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -1853,8 +1853,10 @@ module Expressions {
   private boolean isinstanceEvaluatesTo(
     CallNode call, PointsToContext context, ControlFlowNode use, ObjectInternal val
   ) {
-    exists(ObjectInternal cls | isinstance_call(call, use, context, val, cls) |
-      result = Types::improperSubclass(val.getClass(), cls)
+    exists(ObjectInternal cls, ObjectInternal val_cls |
+      isinstance_call(call, use, context, val, val_cls, cls)
+    |
+      result = Types::improperSubclass(val_cls, cls)
       or
       val = ObjectInternal::unknown() and result = maybe()
       or
@@ -1866,12 +1868,13 @@ module Expressions {
 
   private predicate isinstance_call(
     CallNode call, ControlFlowNode use, PointsToContext context, ObjectInternal val,
-    ObjectInternal cls
+    ObjectInternal val_cls, ObjectInternal cls
   ) {
     exists(ControlFlowNode func, ControlFlowNode arg1 |
       call2(call, func, use, arg1) and
       points_to_isinstance(func, context) and
       PointsToInternal::pointsTo(use, context, val, _) and
+      val_cls = val.getClass() and
       PointsToInternal::pointsTo(arg1, context, cls, _)
     )
   }
@@ -1993,10 +1996,7 @@ module Expressions {
     exists(ObjectInternal sup_or_tuple |
       issubclass_call(_, _, _, sub, sup_or_tuple) and sub.isClass() = true
       or
-      exists(ObjectInternal val |
-        isinstance_call(_, _, _, val, sup_or_tuple) and
-        sub = val.getClass()
-      )
+      exists(ObjectInternal val | isinstance_call(_, _, _, val, sub, sup_or_tuple))
     |
       sup = sup_or_tuple
       or

From b30ae3980c0a067d525e5c957497a69498bb6b0b Mon Sep 17 00:00:00 2001
From: ihsinme <ihsinme@gmail.com>
Date: Wed, 14 Apr 2021 20:48:20 +0300
Subject: [PATCH 270/433] Update
 InsufficientControlFlowManagementAfterRefactoringTheCode.ql

---
 .../InsufficientControlFlowManagementAfterRefactoringTheCode.ql  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
index dc5b2225a623..163305dd0399 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
@@ -57,6 +57,7 @@ class UsingArithmeticInComparison extends BinaryArithmeticOperation {
     not this.getAChild*().isConstant() and
     not this.getParent*() instanceof Call and
     not this.getParent*() instanceof AssignExpr and
+    not this.getParent*() instanceof ArrayExpr and
     not this.getParent*() instanceof RemExpr and
     not this.getParent*() instanceof AssignBitwiseOperation and
     not this.getParent*() instanceof AssignArithmeticOperation and

From b3bdf89fc2230f8e280036166a249c6303106d61 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 15 Apr 2021 10:25:40 +0800
Subject: [PATCH 271/433] rm VerificationMethodFlowConfig, use
 springframework-5.2.3 stub

---
 .../Security/CWE/CWE-352/JsonpInjection.java  |  61 +----
 .../Security/CWE/CWE-352/JsonpInjection.qhelp |   5 +-
 .../CWE/CWE-352/JsonpInjectionLib.qll         |  51 ----
 .../JsonpController.java                      |  61 +----
 .../JsonpInjection.expected                   |  25 +-
 .../JsonpInjection.qlref                      |   0
 .../options                                   |   1 -
 .../JsonpController.java                      | 218 ------------------
 .../JsonpInjection.expected                   |  81 -------
 .../JsonpInjection.qlref                      |   1 -
 .../JsonpInjectionServlet1.java               |  64 -----
 .../JsonpInjectionServlet2.java               |  50 ----
 .../options                                   |   1 -
 .../query-tests/security/CWE-352/options      |   1 +
 .../stereotype/Controller.java                |  14 --
 .../core/io/InputStreamSource.java            |   8 -
 .../org/springframework/core/io/Resource.java |  46 ----
 .../org/springframework/lang/Nullable.java    |  13 --
 .../springframework/util/FileCopyUtils.java   |  53 -----
 .../org/springframework/util/StringUtils.java |   8 -
 .../web/bind/annotation/RequestMapping.java   |  32 ---
 .../web/bind/annotation/RequestMethod.java    |  15 --
 .../web/bind/annotation/RequestParam.java     |  23 --
 .../web/multipart/MultipartFile.java          |  38 ---
 java/ql/test/stubs/springframework-5.2.3.zip  | Bin 0 -> 57066 bytes
 .../boot/SpringBootConfiguration.java         |  10 +
 .../autoconfigure/SpringBootApplication.java  |  12 +
 .../context/annotation/Bean.java              |  10 +
 .../context/annotation/Configuration.java     |   7 +
 .../core/annotation/AliasFor.java             |   0
 .../HttpInvokerServiceExporter.java           |   8 +
 .../RemoteInvocationSerializingExporter.java  |   3 +
 .../stereotype/Controller.java                |  14 +-
 .../org/springframework/util/ObjectUtils.java | 202 ++++++++++++++++
 .../org/springframework/util/StringUtils.java |  30 +++
 .../web/bind/annotation/GetMapping.java       |   0
 .../web/bind/annotation/Mapping.java          |   0
 .../web/bind/annotation/RequestMapping.java   |  23 +-
 .../web/bind/annotation/RequestParam.java     |  23 +-
 .../web/bind/annotation/ResponseBody.java     |   0
 40 files changed, 346 insertions(+), 866 deletions(-)
 rename java/ql/test/experimental/query-tests/security/CWE-352/{JsonpInjectionWithSpringController => }/JsonpController.java (76%)
 rename java/ql/test/experimental/query-tests/security/CWE-352/{JsonpInjectionWithSpringController => }/JsonpInjection.expected (76%)
 rename java/ql/test/experimental/query-tests/security/CWE-352/{JsonpInjectionWithSpringController => }/JsonpInjection.qlref (100%)
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java
 delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-352/options
 delete mode 100644 java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
 delete mode 100644 java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
 delete mode 100644 java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3.zip
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java
 rename java/ql/test/stubs/{spring-core-5.3.2 => springframework-5.2.3}/org/springframework/core/annotation/AliasFor.java (100%)
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
 create mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java
 rename java/ql/test/stubs/{spring-web-5.3.2 => springframework-5.2.3}/org/springframework/web/bind/annotation/GetMapping.java (100%)
 rename java/ql/test/stubs/{spring-web-5.3.2 => springframework-5.2.3}/org/springframework/web/bind/annotation/Mapping.java (100%)
 rename java/ql/test/stubs/{spring-web-5.3.2 => springframework-5.2.3}/org/springframework/web/bind/annotation/ResponseBody.java (100%)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
index 8e2a0c9005ff..8f39efbc2b6a 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
@@ -105,52 +105,9 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-    @GetMapping(value = "jsonp8")
-    @ResponseBody
-    public String bad8(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token); //Just check.
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-
-    @GetMapping(value = "jsonp9")
-    @ResponseBody
-    public String good1(HttpServletRequest request) {
-        String resultStr = null;
-        String referer = request.getParameter("referer");
-        if (verifReferer(referer)){
-            String jsonpCallback = request.getParameter("jsonpCallback");
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
-        }
-        return "error";
-    }
-
-
-    @GetMapping(value = "jsonp10")
-    @ResponseBody
-    public String good2(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token);
-        if (result){
-            return "";
-        }
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
     @RequestMapping(value = "jsonp11")
     @ResponseBody
-    public String good3(HttpServletRequest request) {
+    public String good1(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
@@ -161,7 +118,7 @@ public String good3(HttpServletRequest request) {
 
     @RequestMapping(value = "jsonp12")
     @ResponseBody
-    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+    public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
             return "upload file error";
         }
@@ -201,18 +158,4 @@ public static String readPostContent(HttpServletRequest request){
     public static String getJsonStr(Object result) {
         return JSONObject.toJSONString(result);
     }
-
-    public static boolean verifToken(String token){
-        if (token != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-
-    public static boolean verifReferer(String str){
-        if (str != "xxxx"){
-            return false;
-        }
-        return true;
-    }
 }
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
index 2a3f0861cdf9..e8fb89d3989f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -14,10 +14,9 @@ When there is a cross-domain problem, this could lead to information leakage.</p
 </recommendation>
 <example>
 
-<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>, 
+<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad7</code>, 
 will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
-method and the <code>good2</code> method, using the <code>verifToken</code> method to do random <code>token</code> verification
-solves the problem of information leakage even in the presence of cross-domain access issues.</p>
+method and the <code>good2</code> method, When these two methods process the request, there must be a request body in the request, which does not meet the conditions of Jsonp injection.</p>
 
 <sample src="JsonpInjection.java" />
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 6b989c3c0cff..8220745e6672 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -7,62 +7,11 @@ import semmle.code.java.dataflow.DataFlow3
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.spring.SpringController
 
-/** A data flow configuration tracing flow from the result of a method whose name includes token/auth/referer/origin to an if-statement condition. */
-class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
-  VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) {
-    exists(MethodAccess ma | ma instanceof BarrierGuard |
-      (
-        ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-        or
-        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-      ) and
-      ma = src.asExpr()
-    )
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(IfStmt is | is.getCondition() = sink.asExpr())
-  }
-}
-
-/**
- * Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
- *
- * For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
- * the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
- * and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
- */
-class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
-  VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
-
-  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodAccess ma, int i, VerificationMethodToIfFlowConfig vmtifc |
-      ma instanceof BarrierGuard
-    |
-      (
-        ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-        or
-        ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
-      ) and
-      ma.getArgument(i) = sink.asExpr() and
-      vmtifc.hasFlow(exprNode(ma), _)
-    )
-  }
-}
-
 /**
  * A method that is called to handle an HTTP GET request.
  */
 abstract class RequestGetMethod extends Method {
   RequestGetMethod() {
-    not exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
-      vmfc.hasFlow(source, sink) and
-      any(this).polyCalls*(source.getEnclosingCallable())
-    ) and
     not exists(MethodAccess ma |
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
       any(this).polyCalls*(ma.getEnclosingCallable())
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
similarity index 76%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
index 4c60b356cfb4..c7fd850bb093 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
@@ -105,52 +105,9 @@ public String bad7(HttpServletRequest request) {
         return resultStr;
     }
 
-    @GetMapping(value = "jsonp8")
-    @ResponseBody
-    public String bad8(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token); //Just check.
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-
-    @GetMapping(value = "jsonp9")
-    @ResponseBody
-    public String good1(HttpServletRequest request) {
-        String resultStr = null;
-        String referer = request.getParameter("referer");
-        if (verifReferer(referer)){
-            String jsonpCallback = request.getParameter("jsonpCallback");
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
-        }
-        return "error";
-    }
-
-
-    @GetMapping(value = "jsonp10")
-    @ResponseBody
-    public String good2(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token);
-        if (result){
-            return "";
-        }
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
     @RequestMapping(value = "jsonp11")
     @ResponseBody
-    public String good3(HttpServletRequest request) {
+    public String good1(HttpServletRequest request) {
         JSONObject parameterObj = readToJSONObect(request);
         String resultStr = null;
         String jsonpCallback = request.getParameter("jsonpCallback");
@@ -161,7 +118,7 @@ public String good3(HttpServletRequest request) {
 
     @RequestMapping(value = "jsonp12")
     @ResponseBody
-    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+    public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
         if(null == file){
             return "upload file error";
         }
@@ -201,18 +158,4 @@ public static String readPostContent(HttpServletRequest request){
     public static String getJsonStr(Object result) {
         return JSONObject.toJSONString(result);
     }
-
-    public static boolean verifToken(String token){
-        if (token != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-
-    public static boolean verifReferer(String str){
-        if (str != "xxxx"){
-            return false;
-        }
-        return true;
-    }
 }
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
similarity index 76%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
index 83f2b7f206a5..14912328a1e1 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
@@ -13,12 +13,8 @@ edges
 | JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
 | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
 | JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
+| JsonpController.java:115:21:115:54 | ... + ... : String | JsonpController.java:116:16:116:24 | resultStr |
+| JsonpController.java:130:21:130:54 | ... + ... : String | JsonpController.java:131:16:131:24 | resultStr |
 nodes
 | JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
@@ -48,18 +44,10 @@ nodes
 | JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
 | JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
 | JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:115:21:115:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:116:16:116:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:130:21:130:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:131:16:131:24 | resultStr | semmle.label | resultStr |
 #select
 | JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
 | JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
@@ -68,4 +56,3 @@ nodes
 | JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
 | JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
 | JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
-| JsonpController.java:117:16:117:24 | resultStr | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:114:32:114:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
similarity index 100%
rename from java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref
rename to java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
deleted file mode 100644
index c53e31e467fa..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
deleted file mode 100644
index 4c60b356cfb4..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpController.java
+++ /dev/null
@@ -1,218 +0,0 @@
-import com.alibaba.fastjson.JSONObject;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.google.gson.Gson;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.multipart.MultipartFile;
-
-@Controller
-public class JsonpController {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    @GetMapping(value = "jsonp1")
-    @ResponseBody
-    public String bad1(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp2")
-    @ResponseBody
-    public String bad2(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp3")
-    @ResponseBody
-    public String bad3(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp4")
-    @ResponseBody
-    public String bad4(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp5")
-    @ResponseBody
-    public void bad5(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @GetMapping(value = "jsonp6")
-    @ResponseBody
-    public void bad6(HttpServletRequest request,
-            HttpServletResponse response) throws Exception {
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        ObjectMapper mapper = new ObjectMapper();
-        String result = mapper.writeValueAsString(hashMap);
-        String resultStr = null;
-        pw = response.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-    }
-
-    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
-    @ResponseBody
-    public String bad7(HttpServletRequest request) {
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-        resultStr = jsonpCallback + "(" + result + ")";
-        return resultStr;
-    }
-
-    @GetMapping(value = "jsonp8")
-    @ResponseBody
-    public String bad8(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token); //Just check.
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-
-    @GetMapping(value = "jsonp9")
-    @ResponseBody
-    public String good1(HttpServletRequest request) {
-        String resultStr = null;
-        String referer = request.getParameter("referer");
-        if (verifReferer(referer)){
-            String jsonpCallback = request.getParameter("jsonpCallback");
-            String jsonStr = getJsonStr(hashMap);
-            resultStr = jsonpCallback + "(" + jsonStr + ")";
-            return resultStr;
-        }
-        return "error";
-    }
-
-
-    @GetMapping(value = "jsonp10")
-    @ResponseBody
-    public String good2(HttpServletRequest request) {
-        String resultStr = null;
-        String token = request.getParameter("token");
-        boolean result = verifToken(token);
-        if (result){
-            return "";
-        }
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String jsonStr = getJsonStr(hashMap);
-        resultStr = jsonpCallback + "(" + jsonStr + ")";
-        return resultStr;
-    }
-
-    @RequestMapping(value = "jsonp11")
-    @ResponseBody
-    public String good3(HttpServletRequest request) {
-        JSONObject parameterObj = readToJSONObect(request);
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    @RequestMapping(value = "jsonp12")
-    @ResponseBody
-    public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
-        if(null == file){
-            return "upload file error";
-        }
-        String fileName = file.getOriginalFilename();
-        System.out.println("file operations");
-        String resultStr = null;
-        String jsonpCallback = request.getParameter("jsonpCallback");
-        String restr = JSONObject.toJSONString(hashMap);
-        resultStr = jsonpCallback + "(" + restr + ");";
-        return resultStr;
-    }
-
-    public static JSONObject readToJSONObect(HttpServletRequest request){
-        String jsonText = readPostContent(request);
-        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
-        return jsonObj;
-    }
-
-    public static String readPostContent(HttpServletRequest request){
-        BufferedReader in= null;
-        String content = null;
-        String line = null;
-        try {
-            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
-            StringBuilder buf = new StringBuilder();
-            while ((line = in.readLine()) != null) {
-                buf.append(line);
-            }
-            content = buf.toString();
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
-        String uri = request.getRequestURI();
-        return content;
-    }
-
-    public static String getJsonStr(Object result) {
-        return JSONObject.toJSONString(result);
-    }
-
-    public static boolean verifToken(String token){
-        if (token != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-
-    public static boolean verifReferer(String str){
-        if (str != "xxxx"){
-            return false;
-        }
-        return true;
-    }
-}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
deleted file mode 100644
index dfbe0628760b..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.expected
+++ /dev/null
@@ -1,81 +0,0 @@
-edges
-| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
-| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
-| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
-| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
-| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
-| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
-| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
-| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
-| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
-| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
-| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
-| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
-| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
-| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
-| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
-| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | JsonpInjectionServlet1.java:45:24:45:32 | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr |
-nodes
-| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
-| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
-| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet1.java:44:25:44:62 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet1.java:45:24:45:32 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JsonpInjectionServlet2.java:38:21:38:54 | ... + ... : String | semmle.label | ... + ... : String |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | semmle.label | resultStr |
-#select
-| JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
-| JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
-| JsonpController.java:56:16:56:24 | resultStr | JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:53:32:53:68 | getParameter(...) | this user input |
-| JsonpController.java:66:16:66:24 | resultStr | JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:63:32:63:68 | getParameter(...) | this user input |
-| JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
-| JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
-| JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
-| JsonpController.java:117:16:117:24 | resultStr | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:114:32:114:68 | getParameter(...) | this user input |
-| JsonpInjectionServlet2.java:39:20:39:28 | resultStr | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) : String | JsonpInjectionServlet2.java:39:20:39:28 | resultStr | Jsonp response might include code from $@. | JsonpInjectionServlet2.java:31:32:31:64 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
deleted file mode 100644
index 3f5fc4506696..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java
deleted file mode 100644
index 14ef76275b1d..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet1.java
+++ /dev/null
@@ -1,64 +0,0 @@
-import com.google.gson.Gson;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class JsonpInjectionServlet1 extends HttpServlet {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    private static final long serialVersionUID = 1L;
-
-    private String key = "test";
-    @Override
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        doPost(req, resp);
-    }
-
-    @Override
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        resp.setContentType("application/json");
-        String jsonpCallback = req.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String jsonResult = gson.toJson(hashMap);
-
-        String referer = req.getHeader("Referer");
-
-        boolean result = verifReferer(referer);
-
-        // good
-        if (result){
-            String resultStr = null;
-            pw = resp.getWriter();
-            resultStr = jsonpCallback + "(" + jsonResult + ")";
-            pw.println(resultStr);
-            pw.flush();
-        }
-    }
-
-    public static boolean verifReferer(String referer){
-        if (!referer.startsWith("http://test.com/")){
-            return false;
-        }
-        return true;
-    }
-
-    @Override
-    public void init(ServletConfig config) throws ServletException {
-        this.key = config.getInitParameter("key");
-        System.out.println("初始化" + this.key);
-        super.init(config);
-    }
-
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java
deleted file mode 100644
index bbfbc2dc4360..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/JsonpInjectionServlet2.java
+++ /dev/null
@@ -1,50 +0,0 @@
-import com.google.gson.Gson;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.HashMap;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class JsonpInjectionServlet2  extends HttpServlet {
-
-    private static HashMap hashMap = new HashMap();
-
-    static {
-        hashMap.put("username","admin");
-        hashMap.put("password","123456");
-    }
-
-    private static final long serialVersionUID = 1L;
-
-    private String key = "test";
-    @Override
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        doPost(req, resp);
-    }
-
-    @Override
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        resp.setContentType("application/json");
-        String jsonpCallback = req.getParameter("jsonpCallback");
-        PrintWriter pw = null;
-        Gson gson = new Gson();
-        String result = gson.toJson(hashMap);
-
-        String resultStr = null;
-        pw = resp.getWriter();
-        resultStr = jsonpCallback + "(" + result + ")";
-        pw.println(resultStr);
-        pw.flush();
-    }
-
-    @Override
-    public void init(ServletConfig config) throws ServletException {
-        this.key = config.getInitParameter("key");
-        System.out.println("初始化" + this.key);
-        super.init(config);
-    }
-
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
deleted file mode 100644
index c53e31e467fa..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringControllerAndServlet/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../../stubs/gson-2.8.6/:${testdir}/../../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../../stubs/spring-core-5.3.2/:${testdir}/../../../../../stubs/tomcat-embed-core-9.0.41/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/options b/java/ql/test/experimental/query-tests/security/CWE-352/options
new file mode 100644
index 000000000000..5e5f10f69456
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/options
@@ -0,0 +1 @@
+  //semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../stubs/gson-2.8.6/:${testdir}/../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../stubs/springframework-5.2.3/
diff --git a/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java b/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
deleted file mode 100644
index 9b1751fa2ae3..000000000000
--- a/java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java
+++ /dev/null
@@ -1,14 +0,0 @@
-package org.springframework.stereotype;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-@Target({ElementType.TYPE})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface Controller {
-    String value() default "";
-}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
deleted file mode 100644
index 372d06cc7383..000000000000
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/InputStreamSource.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package org.springframework.core.io;
-
-import java.io.IOException;
-import java.io.InputStream;
-
-public interface InputStreamSource {
-    InputStream getInputStream() throws IOException;
-}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
deleted file mode 100644
index 6bd357f2228e..000000000000
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/io/Resource.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package org.springframework.core.io;
-
-import java.io.File;
-import java.io.IOException;
-import java.net.URI;
-import java.net.URL;
-import java.nio.channels.Channels;
-import java.nio.channels.ReadableByteChannel;
-import org.springframework.lang.Nullable;
-
-public interface Resource extends InputStreamSource {
-    boolean exists();
-
-    default boolean isReadable() {
-        return this.exists();
-    }
-
-    default boolean isOpen() {
-        return false;
-    }
-
-    default boolean isFile() {
-        return false;
-    }
-
-    URL getURL() throws IOException;
-
-    URI getURI() throws IOException;
-
-    File getFile() throws IOException;
-
-    default ReadableByteChannel readableChannel() throws IOException {
-        return null;
-    }
-
-    long contentLength() throws IOException;
-
-    long lastModified() throws IOException;
-
-    Resource createRelative(String var1) throws IOException;
-
-    @Nullable
-    String getFilename();
-
-    String getDescription();
-}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
deleted file mode 100644
index 44bdae10fda5..000000000000
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/lang/Nullable.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package org.springframework.lang;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-@Target({ElementType.METHOD, ElementType.PARAMETER, ElementType.FIELD})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface Nullable {
-}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
deleted file mode 100644
index 78d384d72660..000000000000
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/FileCopyUtils.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package org.springframework.util;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.Closeable;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.io.Reader;
-import java.io.StringWriter;
-import java.io.Writer;
-import java.nio.file.Files;
-import org.springframework.lang.Nullable;
-
-public abstract class FileCopyUtils {
-    public static final int BUFFER_SIZE = 4096;
-
-    public FileCopyUtils() {
-    }
-
-    public static int copy(File in, File out) throws IOException {
-        return 1;
-    }
-
-    public static void copy(byte[] in, File out) throws IOException {}
-
-    public static byte[] copyToByteArray(File in) throws IOException {
-        return null;
-    }
-
-    public static int copy(InputStream in, OutputStream out) throws IOException {
-        return 1;
-    }
-
-    public static void copy(byte[] in, OutputStream out) throws IOException {}
-
-    public static byte[] copyToByteArray(@Nullable InputStream in) throws IOException {
-        return null;    
-    }
-
-    public static int copy(Reader in, Writer out) throws IOException {
-        return 1;
-    }
-
-    public static void copy(String in, Writer out) throws IOException {}
-
-    public static String copyToString(@Nullable Reader in) throws IOException {
-        return null;
-    }
-
-    private static void close(Closeable closeable) {}
-}
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java b/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
deleted file mode 100644
index 6ea27bbffa2f..000000000000
--- a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/util/StringUtils.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package org.springframework.util;
-
-public abstract class StringUtils {
-
-    public static boolean isEmpty(Object str) {
-        return str == null || "".equals(str);
-    }
-}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
deleted file mode 100644
index ed692a03063c..000000000000
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package org.springframework.web.bind.annotation;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-import org.springframework.core.annotation.AliasFor;
-
-@Target({ElementType.TYPE, ElementType.METHOD})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-@Mapping
-public @interface RequestMapping {
-    String name() default "";
-
-    @AliasFor("path")
-    String[] value() default {};
-    
-    @AliasFor("value")
-    String[] path() default {};
-
-    RequestMethod[] method() default {};
-
-    String[] params() default {};
-
-    String[] headers() default {};
-
-    String[] consumes() default {};
-
-    String[] produces() default {};
-}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
deleted file mode 100644
index 78c90a6ef75b..000000000000
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMethod.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package org.springframework.web.bind.annotation;
-
-public enum RequestMethod {
-    GET,
-    HEAD,
-    POST,
-    PUT,
-    PATCH,
-    DELETE,
-    OPTIONS,
-    TRACE;
-
-    private RequestMethod() {
-    }
-}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
deleted file mode 100644
index 56094811c376..000000000000
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestParam.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package org.springframework.web.bind.annotation;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-import org.springframework.core.annotation.AliasFor;
-
-@Target({ElementType.PARAMETER})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface RequestParam {
-    @AliasFor("name")
-    String value() default "";
-
-    @AliasFor("value")
-    String name() default "";
-
-    boolean required() default true;
-
-    String defaultValue() default "\n\t\t\n\t\t\n\ue000\ue001\ue002\n\t\t\t\t\n";
-}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java b/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
deleted file mode 100644
index 93ea3439fede..000000000000
--- a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/multipart/MultipartFile.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package org.springframework.web.multipart;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import org.springframework.core.io.InputStreamSource;
-import org.springframework.core.io.Resource;
-import org.springframework.lang.Nullable;
-import org.springframework.util.FileCopyUtils;
-
-public interface MultipartFile extends InputStreamSource {
-    String getName();
-
-    @Nullable
-    String getOriginalFilename();
-
-    @Nullable
-    String getContentType();
-
-    boolean isEmpty();
-
-    long getSize();
-
-    byte[] getBytes() throws IOException;
-
-    InputStream getInputStream() throws IOException;
-
-    default Resource getResource() {
-        return null;
-    }
-
-    void transferTo(File var1) throws IOException, IllegalStateException;
-
-    default void transferTo(Path dest) throws IOException, IllegalStateException {
-    }
-}
diff --git a/java/ql/test/stubs/springframework-5.2.3.zip b/java/ql/test/stubs/springframework-5.2.3.zip
new file mode 100644
index 0000000000000000000000000000000000000000..b54730e4bbcd561f20961940fb62c54dcee1225f
GIT binary patch
literal 57066
zcmcG$1yont);>&kcT0Ckr*wCxbW68%H%NDPr*tFT9nvKrT>>Kb{m>I0zjM$3dhdN5
zW63$g!Q6X2GuE8XoNLQVfr7yRJ^k5H2vhv_AHV&D0r=@)Yj19CYGSW%W$a>O|B8;4
zo{65BK_2isXn=o(0%AzAQ`8*NqvJya0@9-e0wVgCzauRnBqFOMLhtD6xT>iYx7>j4
zbyLO9I&*LWN5^eG%{D&M-)cR}r8!~olKl-5v}Cb>AMoH@ZOWIMOjv%O*m>t7o7Ldn
z*bs+Kk3FA>-o3|4E{&4}*D|R&x9gI<uQ}-p4d}WIx)@tFwfOnCeG3e_UY9#Lp6f1;
zbK#i5@ARocC#G9gVc)fV2{(1Uc>Hiu6xpPy8@|wZcsTd)(YYPj#`?7PeoThw#CmOY
zRj1QCQWx`T_S(Y1yYcfTua^*5hi2F-l|$7V!VKLPuv@f#lCYaM(^ylKOJM}c#|f|6
zqOHgzmsLF^XXit^%LF;*IJMx(yk3GS-dYxTo?bb3od#az3MQ7KEGt+l4+(dGd>%(=
zZNHUW#Cc)nI-V$$_x@3x{!kW-#)_S*efg$`Kyw!?1Ps!N4~Fx~{qU+YR5#n<M7T4l
z9jK6-VpFd*FW3*C33yf($4)3;E&xkYIXYiWFj1IH64=DY6cig45e&HgViX7NJ@+dZ
zqKvR-aL_Na*=~;~Rc*`P$`~&5Q}IwDw5&7Zn>3->l#_6_bUR@XlWREHyIxHZ%WFha
z>uB#wy|6$WM&Eb=sUt|_IP#TV*hYk^``}hPyN53ZJl)KQ#swxL*yBO|#9uFv;|RS3
zagCxQ)@(14(=38K+dk)-taaejDLCHZr9Uh8t|Y1F`SHlQE(-UdGNT76%T)(tSsr4S
zjO?8_vbePhtSDtYi^Ip1^r2n8Wql(0@;vY6KI0RorC1pPM^-{Qii=w)uvrrEGF})E
zd-nJ4Fs@<D7Ywbtq_b>Y70R&ERUbH}xr!`y(@Sp`QfVKNHCP&^vs3fS!w}}J%psV-
zNpsAs7$U4$>>>Hwv~D2b806r(sS>CQS4aeX;rQfxzf@gY+g@=u^%a+UtXO{q&#|R$
zu@rkmSb2^${O0`<gct2iEqIBcAHVWjf~@%G+55PtFXjbd*brlAKEOcWh*=1}cf>&*
zj<ppS!xskG&n|85nX(m_fuvt2IIuloE1g!nGE6Fa=x%vKA+iai8{4ZK%s8zGv(Hxg
zoD3+9zIbjB24={AR@7Q%^lLdiy1LABASrA?2?(Z=7GLa*&62j7f(?BclLXH<?SZst
z1@NTw{J__gY2%bUPz4VH!Tz^9DhpH_U!aDJjy9PzHZ?gPfK)x?LEyJA2atVu#+M1r
zo>A7o=Wb{nOueQnFbL#P7MXfi52F#&%7}^J{_>>G0BHPU4x~7!?@jhl0#=`1YBYtQ
zZ(v1uR(ZJfcpVkeJNhCXVHgcv5aw5uR2#`_2db&eFZe13YGmi?t{8f2?)<J9Q~ggv
zJoa&9Srz5(O1KUv6({NQMf1{`NOlD7W8fO+==vmRaGkI-DszyUH4|q^4fZD@+=$UM
z#g@2UKh#?l5qQsUJGdKBrJbk2VWA*QjPCFoFlWibsR4%yOD0+g6_vXy-V#fN5tMa+
z&yy!w@mc0L2W%nRL5g5X$ZiEH^OtH5$mxk(G1a%qIfvsFU$IpWxUN$(n!p#j;<R~a
zG-8HJ6p3W_J$O-%*otF|^PA>iVeSW3u%L-S2JdN>=Z;N69Kw$Jt?W}{!yM1v$I}{l
z>w46pgDW}^G>jSfg%!gSumMqd#x#~g!`w~Xl%Bta4$kDJv?L<C9y|kUea8JPF9G`1
zt|&t-6H~a~=zBBvuBP3Mk`dH_ppV8rG0%#(3g+_(@{m8Y^t*zocodCvBM`(k#+;BO
zzDSx>2+$rrd?{70+qgrL|M~?=jXK@Do(<K7_DgzMrCTUnIg0_fFSI*D@FCYVoCegN
z2uD=~cz}(Rm4_O)Bjh9ntGuuYz2Iu;=oZtKSwYrlADWOn+tIv5)B`Pb<vxlTk+Ff+
zCt;PD2B*-DU6ht*ONEW{gGdcJ8=;9c0d?g>hn#WE`5PPD3LG%c36RX2S>31eoL+-^
zdLR@J9NXH~=CM57wmHMRFb8r*Z0HsAnjU-iB^Yk|EjR_?09V9zoMh7QYj(@ca_r~w
z+$00Uo}f$)W!G2mG(2g`_Q`y61|TC8coT0OO6iWW`AiVpC~Ec}pSkXVM3qzyfceMd
z?HQ2*^CAi-<r=<ZJ_Xi>G;qJmhT0YJHH&I+isYE+d2JYWrdv!oe|?l(f&i9Xu1(FX
zz{~=CPidd<($se4Z3XtyuzIVXSwT$8`R0;z^YNgt{h_Q=UEtBR4wuZ526yobyIcjX
zPaQnx3}471x*Jq-ND>=>g_&~PxSTx*qoGmhUxjWl52nFls^d+f*DTQWm5P3a<Z8KY
zKY3nAQFP@tKs=byn^iIx*!@7vS`MwnefZ$OgjK5W9{3#98)8CAf2SL<MNB2~{iZ^#
zI@$|;zr51h5|CgGB(NL(Sy{*7o%H9W=nqp!ir`FeeIH`5h?MX|g$jEGNOrM4*anq0
zaqETU-WZgNKLgexyQjJ(KeUi@Fz74TNGoVkx-&78D97b29Cp?Ylw3Xtu_B(C$l<Yv
z?h(~vV*wwCak}#6cG|gHl=jFfH4?!I93-TAi&L;TQqRhWnzOBR?1p}S6xe1Y0~zub
ze>i;WybaiTE}Iym0`Ifz4AEl-C3OiOo*c@09t!G&Reu~NJG5k3*q)2dM-Dh5tY?m8
z?>TrsNAM;#QRT;wN1bpp1sQNTj2rhal@Oqmhct2GZYsFN@2fXQocA(<3;SXxwiqJk
zwszI3Q}xP-K#-rweWF_Rvu2^qh}&z*55u<K{)lbvW7}R#>(x*1Z;{K%xviarlLQ6z
zs6N#^RVr08{N))0pX0TGr+cTHXPwWE`_a%^va>Iw;7NpB=1UD|4inGu+MTKhWjtQ8
zTY1&RXSLZ%rek3u5?h(<B&cCHDiEpx%9I_wmDnkl7%yI_!LViP$6s;C?!I!<dS*-m
zM56bZI*ckWVrYIyu&($bD}M7{{ET$)qAimlJD^f2qdT#ggjjB}v67>{HbR|Y+1_fP
zs9gD(F$^$NGSHF+|D?)<!jRpCO!z&gp(q%JWDk;C=N=W@;X+9Yvp1^ihJu^sg#_wA
ziI4n;En7I-J_CHg3@IxiRrJT@&9*o(BT=$20@^FG6#44w_DYi+p-Z$%_EO3Exk=$g
zuJB}a_2Mw;6P`+Qqm8EC=no!DQw=aC<o&?b98r91qe?dzrZOyZGC>ts?!Z8JbRA4;
zgfZD-^h}jIEV=V=TInKZzN2?EB;;|c=u4j?SVSb#QiJ-=LlsEZ$3>Qzd5!SJN5MIo
zD~8|m2esHGSvrQ~@k2cuAy3GY(EAW=W4;K@4m?OK=IceZ);KA`%PGSPlBc+RD}`1E
z8{36>JuxwnqyY`V*WLmX&_H6xqqD;}yZm8!@2d$5EMs`@C`gcmdXj>A(B-S;?VN*8
zL7zwFFXV&FTl3Ck8wFVS__@zYiPQVdqnk+?4IH~+r*#Tq%=XYAAF-GM$eFH-hs%5O
zIEDyikMl`}WKG`KVxCb@1|s{o(uQM4Rnn@AXA-$MlLQ1IVp_oIf;g<qeukUcn3rmX
zTsa7SL#Py@@5KRO70)3miKCS9*?4mE6BKSsBVE0tJr#@B^2P&;B&aIHih`eCH@Yu|
zjfLE&y60&<?`m+<&4DdT_!#=?Ke2Fa7Ff}}5D#|7E+S19UX9}En%;>dQKbgm5y8=!
z#wbsoebamzSByzXLk|z)I~063)6|j9d4qDJDSv^fhFkNVwii(?ZH^r0=H17~f#sW<
zt#@;)t8<^doa&GpUGD0?9OK&6KWcpOtnYwm%DaQOMQ+S{VV+x3sl1fRVvKYwVO*}1
z$5CBkMrdC|h7s|)v&Gw8$!Bh1LhX><rR-YQ#;ZkR9doNFt#yIVFJ6tWe68}tyAa8(
zu0?m<^7h)djDLG|4xi)bVY!U^{N!P^b$JZlMXQ63#kCIT!lg@jrUG<z^h`OqCy-~>
zSA)9<IWw+@RT%Sy;CT|Ybpyk$Ro;z|P@N?0!h0p-n}*q$<WUjcmAYv*woWr%d=t)3
zkF{tv6meTQjhfc=IU|?o&N{$nMaL2dg}}Pln$CU^jOJnsrtBI>{GJ_5W^?0a{JI4#
zw1vyoOg9qv&tBl3V#1->7TH`S0^vh9zVqyLv_aPRbPM5Ew0wSf*FEPj|H76E^`!~R
za})lq%7n<3F_&9ct`3xF9fY%tp4RK5Pa0}amUq;^z;LII=YsS|k?1%s)`aYpW%%nU
zhM0%}xAV8IlVq<Dlp?WjaaSQsO`KSxH&M<?!b2pem6z2K7BlMS1kyZQZjn=KkGVp%
z1be|iVRWRdAO=>&Q{Bu^n_`ad*aglofc)7TA(>SlYqL3oeZ1O2U|9-{TgnMoUdGmv
z0ZF;zM<D51L+x;ac4&o_p}2!+5~=F!cqHIBC89n11hu+%km~e)g3cfeIxx}w)oWPE
zwDB*6K`xa(%N8QnV3PO}l*@`WDEL(ZLf5!dC(1KhWn@Y=Fea=D&iakymN`(3ZC$ng
zgGp7I{Le;{7<CWS1&V;T#oW6jLd1rK^o%AVY^UF>nVHKt<1*==*wXox_E*(J7cxm+
zpiE0NQkLWv$tYkzz-gJAOtVh!1c=>3EYHSSQLDUb>Y)I_Rx?%In`TuGC2q<rPo92l
zOTU_^a8sBHr_@}!g;LM4ifc0f#1<<^qDi>q2yz)ri^IIgG1LR>QP<Jm;da8x@%iE7
zDz~fA^@Q5K;9E#l<xGOT)00gb(qa7;sh)+yjx&B_oxEflRFIg8z;Zjrpc}g~g?x#Q
z`C(-pet#dMz1+?|ElKd0=G*H=SD8aJD{{d`Tth|$6?i3GHVKBlzIv;#jO`53yJn=1
ztx^IrT#+RN8-XQATXOaR2ZXPdeW6sS2hsTidA-x=1<i|1fwN`11h&up!m<$Dr`7uo
zG@@`%p=%Ubm`0Bbn4{Fnv=VeQa&V_9LkIj}k)kjb)cr9RX+F1edESBd1$52KczRT8
zV^Phxk<)SJ)7-ckj&(=Vqk7|Sp0c0Q3|Sp+Yt66kpCgf~bio&GD(%<=gu!~~x$RwC
zxRWC9A=84bbo6}Y>2X~RdLA#iji!LwJ5=b^T40ruUU6hVIP$nu$KbJdMdx#K{ow=W
zptNZRSS}y<iykS{i3`@<Q9Xqh$EJup;N4%vzTn5OFInZyN(W%=2D~CP<F9vS=kEn3
z_vzqQXBSJ?e;EtZ$~X7w?uhTH`u_Wh9p_(G-!}H9->UZSzt^qs<}Z~#^*{dJPaMDx
za(-qE7=KBQfw8`|!#_yl_z$F+=o>oP*uVaXp?K~Xup|bMCJk8P|AkaRz#EHxe*(RQ
zzOz1!xb(QJw4BNygX97YJ>~GIlpKxZs0`f%!|=S6q|7MIyp)tQ{SZUx+YejRlrqCZ
z(yD`_G!k?mVTIHj!01f^`RJvunt}dGr%>O(#%lsz(h{(g|BIIuH#fG|w>LC1H`KTM
z`Nd_1pCkAX!U1(<s9k}3bd7c2Mk>;<5l8ze7=CFbrLRmH5vOqr%3n(?M|mi3I*)Oz
zk9v;5O){6SW-7h*5(y+Up`Pj;WqI*iDE)mcf({rD)hH$3&eb=sf&aRfw!{1&S->9T
z0ZZn;*o%a<xudzhrMVk`jC$J3H}v60y5Rwv;Gg1Fas<IR`!Mz#hAJOeQi)MCvUTKo
z&$CaR5!G?TtGH&zXmS6ess~~GCTjoE@ml%}vvO1y(~v3|M*xN4uBp|1&zaXZulkeI
zDqIUXQ3t%R*>5lZlMnpHgFSiGPyfR3-Ku}LLuqpdM|}fJ<Nv1uhUCy_1407dVzKsj
zN^NbqHHUfiiOZ8}R>X2ZbVo)JmpKKLvt`?eRCXt~w5IcrT9dwn{*Vv<van|0;1$0q
zi4NMMGv5dBKVw7JPd?7@Yw+9HIR1lcvj4g;fZI6fI~xCkP?7&!sJ@e<jiHUTiMgqh
z{Xae8$rgW7*gvWA354I@`>&61FgA3uH+TFVX#PGJtNzcQ<zQ^@Y-#*mFMpaUaZzK!
z7r?VzL4bfP{?DE%Vr^t=V{YxJXl&<X?BMv#0V88-WP2Img7!X8@eoMqWJ8q*M$j@c
zwszA^?Z$3!xTMQ^x+vBg?<e?^)oy+L`b8_s?9(DD*ojk^rRVx{f_*gCs%0eMyqE|<
zoH{U657Yb6eAJXt)$xLjJd%=x+F&eoFUShIme45;e*=GSIGuedoqcAdSW~o10qu3c
z%;Gr{`vZ21Dh)D)QLDRvaW_Xjyh1R!M_!1-BnexExpGOx6%)GTJfDF6tfaLQ>nj!M
z*d_mo@i`bh`Q1AT%Ny!#F3nfj8gXpdbMnz@v$*%PsKbweY1!s+jHyodOvc9Uv`OIU
zBCy`XHd<0WA0ZzH9!}U#FBoN?&9eV%N8|kubnyQ(-|y<Zit|-e%&rX12Z$601_Dz1
zZ$&G8qw@s;b}e9QYY8|R9L;UM2UE|e=LkKFa3VM9#3Z!M{7E1myMlx<McJE(Cf~={
z2|(Gol=@LhwQ792e`N6O<mVqjSz(pPmxq1pYTDcsrh)G`oLLf;gE|@!YGt6{9)#Nj
zLCHaA03In_2?kxfM61NINNj#5&Vgus5P*XI#_%A2$4kBP-tJNb-|K4V%l6ybGN)aA
zHCmZR8pb=}wfstp+{V|WA|>5<_(Lj^4^|sTm)8(~V*YdD@r$X#lVATE9?bviaQ`9o
z?|n6JHYz?4Aax3`jQ<DHf6$_kjkTk(>+k+4qwi>FW^Dh>O|4|4U_hS3txizc`|0o_
z8_ip{31}M7&9Jdb;ES}if(u~T-aJ<6t23fh3m3^KMq+jg(u{2J)NvL}k}Wv^HJjG1
zvJ_0KAKC0C=?t}6Q?>eGRFa-ZH_BQRG2qiw+^2(NtD(X{5am(hY2i|9ZgDxVx-B*|
zWg#*?GNYFkR<mwiXTJC|FL*L)vIlVU7{LC)07fnK>p1*r#(-Ua3;I78@|zl%9!8{~
z8y*qSmlq%}!=_(Whi|iL3t75hj=xgrb!nU>1GnS3eLUS}x&;Q&Ox&>6AP&^g>*XHV
z;4-O*2sJcOa1X@R27y5cQ5PVIdxa7u{{98Cs&_XAsh<A*+@*9FBAuyN;fo-N`BxeX
zx)YWAEuZWyJ{7KIlgqsfTbs92kVGUneqDi|n8lXw+5SVi{_~N{^h-MjoNrGG{^0=q
zS>CTjp5Nu^TU*;We#7sFtocbvr$_lLMSxel04&k}=v99Z{YTd3DL3+@AD*<T#XP?q
zNH>L=Y)GwcZDHa07WkTD^4@EagHEmU>9|IHol!7a>bGDoG(BObYUoJVuC8jP15I<1
z%#1$yZShb@Hk02{+V(+y#92a6&X}J?3V#hL`G^BADmC3W=4G~mkn0wgs?w3(6P;$N
zVg11*!<3?Ky>L}H@V?m@d{mo{DN!AX77AOlK$QEAfD_O6o@N_bySUe#ZqhmQ<4^Wl
z&3}jB1Aw3vu;l(*DE`J~quQT>Z@`nyssn76I_CsV150K{xG)qSJLwtGS_Vv_tR=;&
zXI7<9YECvL-RAp*CZoV0mnlwC{dd9OdKjQ2o86oiFK54iTO(21F1^(+U5uuC!HwV@
zjQlpcqTxIVz!db(*u8J<NT(s=oBk}oOnL>mDQ!Ge)zi85>`&)>>gVbTbcxOYHn|9J
zPKp0$v;Y6F^jp3lU=0XFA`7Eb9zK+qdUM33^qSC9sIGq4v?fP`<I-9xD;aQ>)ac3>
zI=wZWS)I&<B+g(KFRv_VSJ!N_<?0QksRKKPYt3B;Ep|;5q$mk)lEdD+co;Lib=(Me
zaCms#{2}QLO<N77rMuf(?h*yklr2qiwglh&a>faiuQxTK&n~r58+W)gbKw&O$uH}&
z20vcBwse>6nu9Bg2b1Gm0K-t#cuD7nL&_c8i3DtIiMA1?kfTAnHq@TEv+alKC8s5)
z;=;Ur>r2~(Z*t4YYWi2?LbxqII|2}k1gxi$=ig5?e|N?okP~q>wsw?vGO#pv_&t)d
z4s#>)@WY8rt(DnA%dka5z(g18!A98y5p^4K#=SwSabY4Hc3ETHit^LDkca=EAar;Y
z%lTT(ZkkrA5*T4mfpZ{#R+sHEQN63b@J+-yqASa?kEBbg@MQ(qJ0UzZ{&dB*yoY`F
z)5<X=j=cDqs!jNxY=dl#hwLd9JXO)c|IrR*j2#^GO^uaooa_yaznR59R?*`VG!hk*
zHGkI6U>D)jC~->Y9!lZizVH1mrNVvMK5Ei`E26(A;y;JQU#ol!ZT?b0{49*?7dH(M
z_Cpl>(_Exf>=bDwA~ik(<VgWC_a}PdSIp(Fas@2S^&LcQzMuDjG2OBOfD`c4GYp!d
z=?a{2xW8{-f3Ex%sLt5zV`5@_ZOhV8s}>`Oeb*ZKrRU6J21Fk+nXgl9W2BO(D#EMJ
zZ%+mToqDIR4yR~dDfTO`s_$)r$_=vOa2{Ta!D(+ds5-J@%k6R{z4}<QwKB=oL?QR#
ztGn3IoCVqVp{=iMEMjP#LO3Sq?c+nU>-$~k5wHDQCU>Uw-M;OSPdF_~dh?FK*@A_F
zyVPi4xE0l&)d=)(JwslH9D=7AT#lK!MrQ4IUfi~Vs|xA-66ntFh0qEtOAtnNt<oFh
z^?goQ8;-~DC)GmK8yJr-FbZ{3N>IB*P79BQJHC+*e_xC-|2n+J*3Lg1h);nL)CFBf
z5+LZQihTO{i~4#JC}QnwZf|341#oR4ecLBy;F}A8cYmWYfV%j;Q5oiV`7D7f;>*gt
z!FDdEcqN90)n<1WNLH-2XNFVE8nz}cwIscgl%Rwu#6%1@93_$w=9}{jIkDFm9-b`h
z?;-frYy)6n<~BbeP~FGJhy(@%)B^RZMA|pE0?3oFwsmq;a<n(rxB4LjIH}0kEOQ|7
zigg-9OT~4?tm^rKrxJ#wkr%(Od?|c@!8<)YXd)D&85?GR_IS!IB+;N<^g;vYV$9v<
z1<Q-@4LEC=`Ud;v3)|-@+UdH|Yme|=fqMG|vx2_G55wwiCy&h>ezuq4qw?INIrE(F
zZOt`9EdxD`z`o`>O`A1^P}ufBMzv0!ACL)^%fJ_?`?C>P1P2h|qbU+?NChQ8mJl%;
z7vxW33z9rg?;OY{Lx0(49PNSSqTd%3k?T7ngj$b5=uEgtaAzlAmq88Z=VWu{R6W*b
ze~evO8=G!*$X$JTUx>~HiSf0pfNUt7H6+Z;*g(K2!OV|ODje-H$edl(tt5%Ww(u;n
zdXTZ%acx-S_(uCsLbB1t#{(57s)&m8;CWkCp#+yf^y$#{z+I!*?F&!W<Z*(yR<sX@
zw%l2s;skMb5t%3YT=&3PaZAC-gs(+kpB2=W`<O|7LcP?}32PF|VWcBd(<g^biD79k
z??cfy&z!PQ1VewX$W>WJ;>Y=pQbUr#!__G}95pg8#KX&g(4NaVfh@l#3<cLPYim?J
zqM$i~nAo&DIBQE|GMpo2Jy4WzXT(3b(jv<(JU2glyH371el8~AeIA|gJT+5zR`P4H
z`~XO5@VWd3>=q=_H{Pq1C0TkvO$TXTN?W{k3ghX;HKA^}U2)#F*~!O3T`a|!+(q#2
zgEkDYwY~y9atE<>e7VVa(+NAYx{of(ogRV35WPos3RaG7B_W|9X=1;URGYWh-J$EA
zu1Pb`J&BL-W}WkJ)V+GOM9(_3rQ(_Zb+c#xU^I6i#5UhKv&b1tkZQ(u4=a)fzn2=(
zI!IOF6~dGZ)3^%)zXlCMbF@w(78^nUQ~Vb6%U1FRXZy!oRbSx9Q9nZA4=y3T?zW|9
ziqGTEGJ`UmniQZm!u5<j^{rbnZc0R3NtO6;lwqu(6zZXl4N&CP`rkhPYN1QqF`u}s
ze!B6gZ(~y6D4R>)tJF>4&?MUpD5e3$TVx9PO*b+TZ+2D1qmYBmK-<kAnuonS!g4`W
zUS5L&>I4bDRsaO_rE_ewbUuMRO!0mXiAz^P8~y&pM+@4jRs-wjg5a&_!ylLp$jXy6
zD!|BsoV&n9Qqe!2IS~fQUI-F-%~U}*acP0`lzyT(r+v(cjoNP_rA}?A+J?x>gmZtr
z_^OIcbr5yK4@7mGm&r03t0zKHQ*nSf75cGus4H{!Qx+HoUbOSP<93}eALG{@#~C*h
zp}@sDy~Ruob}L4tB#*{$YuFpfl8yZG48*Ky@K4Q76|*1S_Fd7u!f8C7aZkNWIll?2
zZjiz-Iv4x0l09Q1z6|S`|A{c}4!FzaGCf6emzP~Br#~IJe`=~L6|`srDU0oa{PRyq
zhc&hF)jLQapcBAEBHypaT|m@PG<Nti-xyQZvcYXe_e%5v-{et-iC5Sn?lQm!o9BYg
zwX(pBozZ(%l0p*tJUBfTZ%8ov>zacrcBFL;rj_sKp{?CBk7u0@n{c|$OH$5xWs%6?
z1%^pgy1E@L9uFTdKO}asAi(sIZP#mA_;+r5vmG*ZUWN|}Xi%zGz%Y8v6mQ+3Opp3J
zphlo;){Gpn9!~j%b2v?P5~Je2tc$fto{pNsm<+16q$g!`9nG<qrc6AnjrA+TThweS
z;G@tal3RQ>6_m*tHNt6Ke74Zm9&Lx2@yT0ikNW=5wn?Xo`Q+vJTMam4b<1Gge)eZJ
zMbC6|mhG0+$htL6HgxM5p<XxWw+S}dzYsDd({=a4fUq4mw|BP+K(%<Tr#i8kic82G
zSUn!1ar{YLN*1QI5$N@H*vp7QOP+SU&d9>;1D^;F+;#7cd$);>Nb<O;<A>Yr_*I$3
zvDM??^M~6L3~x_^yk)+{_5Q|Z5OC4VJdgx5LQs=30v>{!LunvK&5R4(WLg6BABe@w
zEEF!ms{?g>6+%K(^d$8Ubm+L$qp_(ZH=8bn#G3ZA^&7)^_@ar7xatxFq#WK!slU36
z-hIzcex=eFK5o9f=+d#p5$!2Rr;U#gb^5~1X~S;7p|o^$7JFm&F&!kyGb2I{-is4U
znE5W227KCt{X8p+HU)@59HP?-uXmT5uxJvcXvvC>?6{}kU6PKW;cnOHYXWQEyv6cL
z_($5V52DKB>+miS6Y``yE?Cr}NtqU3R2(E!R|-KCJ3Aqob6}-{AV%l!V(r=*kc`Y2
zlkij&>>4c-3vRvC+MiL)6UXls4`5rD@e6FWgQ4}A?3E-lZ({M}hS5O)Ym_A7hU*iX
zzvk4VwBo_%EP8j~jLoDfe%8>rFh2zhp>4H=Y(xUNZOENr$n3oC(+@AzfkJ9|SPxHD
zOxUj`(GNZCByG~UpofvYXbP|B$G80+M)G-5r;!akvvi<0yg$}628<0&+N;m*%uu^#
zMjniU99lx_jI5J$a>VH-TcUYj1glfGY9u!Uwh@+@xLMZa{uhfptJi#IrEg5cTSyFV
zKbRGQx3RJxsb0g?JwuH&nW0_l099H1G;W@JH+AeReu&TV2#i;N3~t#DmX+giBFBz*
zs%q_Q@Lo-E{unHDZKeT5X5Wtqbu6X>HW@Y$+ZDVUWOCOacj6g@Be9z?m2F$XDo6zG
zxR>@`%Odc5@<5Bg6FnvtJONPr+AT%2HDMazcNVAX)ypa7biQR!c?+Euc8sdvTXx(q
zXp$Ji!&cQno7lrk@&oUCd$ELpz_p-H;2)Y21$pscotCSwWW-_O1IAKt8i<x`s3#6W
zjSPhv&NJP)i3AzDN<?>MtqrJZB0-^d6E!Gf$YZqnc|#hP(l$mboRQ!L&LZV`iHB8{
zM=D6X_q4^gAP%z~dSTJJ`%T*mdzqos<nP_X2R~?Q29P7L5Q5AlqqYHizt|mvaJ~RJ
zC@>*q!i(aL19w(}c5ZXvNm`h$alGj%M437?L~`UJ>a1s(T6&bmxCde6Pgn`}7pn>E
z5249QNx4RVSQxl$r+MZ&NrwgLsuAi1E1feMigMJoyb;!aY>f=RqqsbIc$R?CH_j{k
zMQ`GOer;T-XJj1ZbuiG4#1%OrmIrn7k-|Prj{E`Np@S(9BUfyaX$;o9h41IaYXji;
zOgH5Pn8+M{OE!tzP9@wo0@Kt`T1L+fG*HFVQyhE@_$r{KTHflZrYqC3L-H74;!sHn
zUL$|TSe_pb{p=7m%lLp+632)h<}$mg{Y)PB!B#47A+a8Z)dKz#XeAj>*)9ysFq#>6
zh^$dG{xPzzPDf8K|E4gvb8YDDV7qeCQVoe(5mDsV;OPFZ$oYlLLu+hM1GLxJ6C&a+
zU!+5h*Kq5uDIzO&vcT{!`r*8{rO12H>y!OW?QO9l_iXq#@8%&X8yxfuUc|7DAt;ID
zZ~+FAP>1kRu4!3;FSV@=^|D+ck6_Lgk)=HX1!Qen<u%TCu@(8FbU4-(+fYyU_CH>%
z%D0)GhfYbtM1wqL&qUHWD22|{?FRZeed$~PSy^|B8*|5zBTaLARHm`RA3sks31Mzt
z<iV5U;Z~neds7^n+>Q3ayWxSas#WO|)oE$xTkeD`;a5ugdE3pE#xd!z3~3I{SLK$|
z8R_ys%yzVoFG@<CKgzHt)mxvOEj})}Er?PI(5+l_rcHjC&x8Uo6Dj`sML%VZEOwvf
z#DDrwbz*HX|Hgbv#sFRB#Or+R1-9e8{JFrkPC`o;I{{jbsa;$7<LUFbb?-OUe9(9O
z6v3Y$fkCI)!DhWO{516M71+x5`}RC-8t(SIPRkP>6^e^e9$=<xlQDQ?F1v#;)<s(0
z6Dua@=so9^-C83E5(xQ<-?2ABj)u`Ug6hOLU$mGyER*-#22{golNST)3#$k4>z(*e
z$fMkq=-pA?mT+=Ixzx99BW}L1`e|~k?x7KiG3)I+Wetrb6dkh9qFOQrh04|57BBE=
zWGe~@VA{dGuX0MQ%x*Ynje34H*66Hq+=Cj?p*>}OoVs~)D!HN~(qmvU>21#Xu86gA
zC;Uvu%!tg=tm@(MicBiGaBd!Wovq_U%ciDv$%QtLVLFT)@f7N=TIh&#$@we%pLO(8
zU1o<;l=VbNJdstu)<pchD)~J>khak``i(XJUXme!b@8cagR|(tb{uW+U<%4d(V{%-
zU&}bKP+{&(+1{t6qxcv&ppnOk9L_*=)tuFr{}xx;A{zc31$@~d@bG=$w^Ziu3$p)!
zN&uuX4o<eVHugU^0WF^AE?5J$UjSIY)_D9Kg5Tx-4u!nFqoc9C_0#`aI{$`=XN15L
zPYHJVI#4$n@eCXx<QbL=u7;K2hy)PyxyyS{Nct6L)w)AkSj=dVp)sLXDgNv{w28DB
zgBH#3F5zC15{)EZ5~|GD1Z~+ek?#8ktW=09@SoTDbo2+_>&$^JaQmGd6)WYfL%Oxk
zK>k(9^aEj(*MQym1IUtJYvX=rbo8I@umE;s?q+PH{My!7(b&Y;-q`v#4k|%$#QGf}
zQrkVvr+sbt)6n-qFS1qQo~fU`C(qfSl`4HZ+=;oOeA0blh)65QT=%Za=R*j-z=mv}
zZ^fx*Kc*YJhcY>1MVW>8dkxUyJVqSgZAMYo9zRrrd(p8+rb*`d-W_<WPd8^e0+qOz
zKBmeDo<+%;Vxr33LSl+;?JYS{&m{~HUvM@OAXd$}km380T=5qL(9g%6<-IU^2{ny6
zv0slZ<KQ<BdxdpxWo81Hi;F3&;id}p4VW17u0#PRYebn>{Pb}zV!6xE3-(-6=W!?a
z7(1{7PR3&SVmvLFXYjMh(lGtOx!5eT^o-WR7lW<O|3H_p0)YPa*$rb?TYCVj2WTb!
zL>KHHuUtO0cb@e1Yi*t%M2a};TLLBr0MY@(`BMkv8)E`L^fO};D~J=#1|Hwr)ar4H
zCe$xXnCPLjotnET@<#m=%Um&QVhd-{HZ7jdD~fO|s3_c#t`6s<z`A$$-zbwm+v)MZ
zoR&|0)~EK|uZ^ty?K_LO8XDXF(Pb4G8hIL70h)XoS;0IT1+kW|LFuV77m$c(Eu*ku
zcpX8XOHsT<VGP}O>X$N3ZI|0ESelc#gmv-?20>d;r5ds@>KLCJ?;J9Fs@M`nih<7P
z^LEQm<q~r_(|sP`?c)Ia{jYJfKkncUoqmHm<4x<g_OR&%Izf2AXHY_{(s9}lUU+LL
zI;Wi`z}TfrnC7q#m?A~z32#F?TVMlJFB?MUOJj$5HOtU&Eba*`zdVbI_^P^TY}*9F
zz4wIqGiWE0bf1>MBYi|TKi2k}LED>Hfac5SzB+I+H=P{uxu5nng1+YF0%q>@&d#4D
zvUFaCc4~SZ@uAt|*;F*Qfa_PL$9`d^d>Sk*2KL7w-ps#-i+wB^K0N>kUV!y$T;1P-
zAg^x^=;;2x>FNqfN=Z8U@zII8KN;(%i7!bhX;~H9z!3;i4D=!lDrE;dDoRSiP#QEJ
zQY4Sa4U}kbm_9wpnbb0jABgOqyWGEaVEnKT2U}yyZ?5_G2ayl}qyNa;zsUs*I9VI%
z+Z+Al`#GHWW3d3ir~oU}{@*-639t>3KkV`cl>|od!n|XI6LrZFG<@HUIk?gujanRq
zBmE`VXh!gCbvs}hO|uw-sN;q=esYupSvd18X@h<Xvzwc6CMz#$Tu5Y&$j)0MIFgG+
z8e`9}^sn{fk<z;#%7M4#!Ga2#+b(Hpk%SyLFVJec)EX$kt#o2_uTQ|FR&(SovI(sg
z?OcS`9>JH?Xh4<d@d(lO+=@#p|1}LO_}^jix2M0vedAd*K&}P=Yn}gzd?j-$TTA1=
z550kZjEeM-FkXRJg3|+m)}^(m%(8^yK~k%<bDIN0LsRo;JbvZ#MwfS4L~*qa$69P^
z&_6mjX{IrQl75bJS}WWTLIpNat2TUfdBN~@WIUSs6^mK;^B%H2+6-$mR7q#NHdGw2
zL<c!pVvq1V#ppfouvigzW2Of3p#IC0>W*4uu3SBH?Tkaq21bxLQs<4>diP|ELB#30
zr8IW>D8vQLT?>Tr_LSMHpT;X?O-w&n0Wc~AEWQ5?R=+vGzd$SEIRc>R33l%;ViD%y
zgK`d{qi0VZHeN%w>>G#V-6^j$S;4|wCeK!!+-u=n-+!$?c}~_~yfQc04lNfD?^zty
z_gX{qYn1ntc`Db*tRywq$pJ<e&7zwp2z<zab^z#&_+@l8NpO+w?IYg5HoISIf|)rw
z+WtepVEZN9z6mq5GzauNeu@#fb(+;>09hUYyZyDZ_D7jQ-$aW8UKx<A+S*t<eDA3g
zMDacyS%Ej{Jx>!&VgX>NiX-4Fvob<bcw{GU0-Ct3u%nS^H-_Hbtlfj8V$cDLl_`ac
zFLP}rh(=Xd3;VHUkT9eu<}h%Z0*#O&NBUd})`$vKYsI{i-irsh7q(S``QSd`@lvBF
zF#8IccIa~1P9%*^9QC!dZ8vbep(oEVg^&Q={n6zhZA1JH$Kyg>EWTSAtVX=9iD~Li
zQorv@@WO4Dd!vt!KUt`#|Ag@s02O3VAfOk&j`R}{BG!(8;lyvpRl8!%Q`3F*l!nJI
zAoqkYNHsxSJ~*@G{zMuDN+Oj*8S4C0#;sUnpVGL5V#MoocbAM{8D0_uGe6{o8I2ln
z<JD%5D5VKs1$7oqo|YMWKU6r6dqeqazOp^rV(P(Ne?yCumbz;*xZtYY^MC`DaUfQf
z%H{O{cuuMENOkgepW$V4$v!XPxKP4rQt34NP}p*&_!A#d_VRJ1b$R1^(s?NG(7BO|
zZz<j5Tb1yq`+=uLq#%ed1l}auI3SkTjU#EwV^t}rnGrwq7u>`X<z<oTq&hv4Y^W<V
ziOFlxi_XR!nhg%ULprzs_IbI!61I5@{nu2WUav-41AwD0VEr0>{LRXq@Dw+GstX;y
zXP$%I@cxW&;FIo!XJ8sW;7u-ma*QS6LbTjyp{1>jr?+s%V#XhJ9Fj*A*u}QX?lZFt
z7vp0y!X<NZL$dF@nGKB*V@-x5-ymQ0;A*&eRl_P<(+*!rtpAk7<t25%+X3D<6|nw8
zE08gEG_x`Ke<m#>lvGsJf21qoV>DwbXFxD_g^5NxMU+pO3XpH>s}O{M-OZ2tAjS~4
zkne;+1vhC2kW3LNm;2@hSbNcj&k>={uWn$2E(HDXGJKipe=_N6WT>7FK;Z@jVDbOM
z%_sq8l$^e6AX0hAewh)j{hsCvF#cD524ivYo@8PydL6gT;*!I{C7!4m0<MP}!7}uM
zio>{TejvnUZe@0tIWKl^t`p3O;O*n>$B`Ph#RpfeHM)*W+2EVHrOn-$hvPAio7)RU
z2CR#sk5?BwUpdpp?kI-9SdiE1v%De&Fw8ED@WEsAJxw=lpx5e3K#hRy&7o!Xfiyp1
zKoa|W><Eb0o5%{1MtP35!x-X2BW}iIPxh69xlMwV0ZWkk42e7$oj!XK^=$-~-US}l
zr_n%@7Zz!F>h`9@>V^9Pkq_lTq_BeYZ-dRjsWtSxg5vhAf=$t6PCsvIUAJqlsJ*!l
ze2*X1n)dPSJ<kP#yuHDu?b#=wP(k3R&Sf_tY6<-yTTaTj%HX;K|Le^|5Ol6+Pa24M
zrFRMPa4*Hqcu{27W8Z)R(=-?#y5lctzz4R{D8r0~d~U)fv&BoWP&bn~?5+_=RY6i~
z(QPb@GQsCSA2xw3#O5xf(t}2G@8`Le-j-LCEqqhby_1tHTBFT}9VindolSsQ8p@3l
z5{p3}9FDq=J(vEDO$I;j9R^9<SC?`=4w3CVD>b$R9)Xyi`JThd>LKVjp&8qWhfD0J
z&#<^7hL|?t{iMUazyj(pm=eUyLrn4N3;~UTf)*cksJLD?>#oYqg5|b;(YAYOra7Iu
zV^4@LLm}uC`0|E(rp(2vK*AUNT^jYhn3K0a(<WTrScZJ`3ZJU6L7C8*g4O-~c^ny?
zx_KAb3!{oJ%VUfNeJePhJ;Wu1#zFc&?hIYUM9+<42k|zc2ZQXHm7}WHO3o!gTR4t$
z!k%cRU-wn0_fAvlnjWmlM3q2wlgoZM3_B!!x8;PWTCUSGOL0tvJs6t6-j#CU$_o-c
zC0|2c%M$`*Ke|xNO5LFlNp^v4Me5^5hE@%&CyErn+Pu3SxV2#O*Wjd9#l>a<IR2hN
z0|5yDT>anA!@mWm-^Q_ji1){;Qx-jpXr8BPD+4fOeA%~zaCkxxm4LErp#f)xwt0zs
ztCPVhfi-Oy&j6biQNm1aobzVQHgsz!%oM6%JXxV7dP(q-wIji;&z^V=5yW^eSDX-e
z1uJ<gTtvtv7Un(N7SRTGj`WxW2%EDKXs{KM53al58)_bRFTeOCs`5iJKQixKY2uot
zD}r(i-o^ReR^~6yM@Jk{yLBf+LChjQS8XsE;$VWH8k~y~MW=Zg>?b2j1?r*F6uW-t
z*$OD@E*eHv*?{Ws!WN9;5wY@cXZ03?et5IpVkexW%l3v?DAgR9AbM_6TvaMsHRLg7
zJBXv%*yeMqIYY4J4iiUhpsm8GVN<@1t2viSPnkOby9n2!GZjqhbmhs&aqn`UVnMV1
zVrK2JWU^AMi|R)-a1>{9U21AcbFYGR9u|+D?ssQqH|Et9Z`I^tAzVw5)j~>9gWp^h
z9NJuWG+L!C;U69OA^uf~agGR5Edb@^0~Gmd`TcK7{GPV_pv8jd3BZ&jTt8rj2M;~p
z-6xd2J1yJY*Rp@9qM<<M!T)IW*pZm{V>cd(c*mCxq+peBR^RJ-xN#aK8{U%xGfx_q
zQF_dtKE*N^>PVulFuywT$(8D@%eTqE8OfvM9;AaJk}jOu0X}FN5E8EZ<crk)I5<4n
zvt|~}w78{MAS46Pe7iTeI;&#3bPMdg{5bD+eLs5f!%`l9;PLg|0BwF&H0^!xVAFtK
zPH^byy0s6VT<qla${D1E=6{ufT38#I|CBDm5o6XrO$^@v7XL5#$~R$>0Ex=RfVu{7
z4dvUR7#ZDd@s1Hmc;b^9E$5Q_6)1gyy!`<YUGHQau?^nRh2%>KXUW0N1?$z`w*^<E
zlZ?zZ0}^w?INkPiZH6+}na08XyQ(b82gEW?d$f>dMhqfw??X%*5ID`Q`V@I!Vpp*U
z*`7^&E}jIpGLNveGkptUoPTr1(Vw`;NdnqKC1YZDm$7ThRn#f9;LQJ#RqJDPPZ6-5
zGtV)OGH^t_mE)3597{F)%xgwL1BA^k=d&|-rydC`AtR6;{ivY}Vj1%Edn?DNse8;J
zmd_pyVfhHfn&ql@;5Q9z{ugELQ*NM$GeB{pw>YeZDjm(<-A2ZbsFcktpH$U0o|jko
zf2p70^!!G${yi)3YZZf~zV-JThJP|?*!~!h)_@%LJp>RC&o8O#n=n}?OUpk7q#~8S
z4G6U#s=?Vyf@(R}?d!Am^;jHbOQKR#r+=Rhl8Vvx>YalC%m?L{_l|=Icrpd&vD*-=
zkM7g@GB+u=uzIxH*}fpiLYx>l{R-A7Adj{a3$3?i6`ynYm?eW6qPup6QqTv}RzBJL
zhG}dV{u4XsZCJlO*(MMEJ9BZ4CEbj+Rw$&3i^*z?eESVL6o^K72Vb8~$ytP^07X_!
zTXLxYI+rwc(>Ex|T{pZznw+8s5icekOA%3hn|TjzmpO`#b@Qg2TV*uz)2ZtSLg|;H
ztS?5E+LGZzKRwn#QcY?y-oDuj($uN%Vws{|3LAuJi2Pg*Kb@iE`)S^GVAl;ub<TPO
z4k9^B%k*}*m1NE>c7=c}+FH6tLX}@9y{o8vFkAq{^o&l|tHWKrr_r)z@WY6QYS$_V
z{pp7pkCgSX14r<sFWeqOdo#d<=Auq#No+ZwxkLV$>LTYby(BR8A1O5=$*NvUR1DRd
zz6z*!6DBDknKZ+(e%Go=tPYOVjeC+Dp7Zq@9VRk1!0{2=NBm&cLP)$`AKp6QE+vQ>
zQ$lbw-tNqww-!q>CBF2XOi}3-yd=tpt+BS0uIL6!){cxO{$Qpr_hWC}MJ84|GTMwx
zBBQvlGenk+y4&G-jgWDJl4dtzVWb552`iEhtExecxT@u+FRPF;$qP!6@-Yn-N^r9)
zERZCv#nBIY9Ip)T6ux@;U#aHT2Ob(c|6=$B7{}4_R&mvtykfAkQpkjczUh^}Lsdzg
z?YaVDv@Df=>%k###exC^6Mymw2eNKFs<!haYbuGh$_<Xu%^mQZL0((2U>b5@z$EQr
zPY(8E6Q>O+57VX{lGGd?m6p6WaiCVdr*ceDiPk#_V%%<!T7gJ>45}p>jubIL5Eom@
zz*Cbnyk(R(@b1Dm?^1F24}{&ju49KxbM<G`%OnW|xU4cqD6y%HQ%`%^+F^79F^-~)
zV5%op-gPOfGc({-2yw={SL)U18+9@5zlU^JjC-)Bx9uz6rqq`_Isdw~xmz!0Ul1?>
z6SzOhT*GrTgLu%yJ%!;)^uRTX?1djG#Crhe{n?Sx>EJlx6RK6_yG752LCP0ec)?W{
zOJj~V^eH@YO9y4Ir7#gMjlH<@(v#q$%{p_Xl5M$CQWa<(W_pxrr5-{5jNw1u6#lh2
zN_%4~8%MyE&2Mr1dzATE;I9>Ae+Ya!H_fe`ZC)AM|8Ph=-CF2Xo2$$LL>olFA@OTm
z*xw3&s{SOtKS&91{m$Ib7{EXR`ftB?#NNmt`0+oH47pOPqu|;&s2VBz(ET}j;3ni5
zVPHM0bbNLaE>%^huXNs4HlPb`4CfE-l*L+wuXok!Tl(+!w+R#9(a#PR(S~Q43L$74
zD*2UZ-dXTQbKAQf80rZ?9D#ere41K`ZJq!z4XYFErU|hW^8f6;m~5O~_izG&9xdOH
z6uf*HDN9&!0k!?sCDWZOQPp9uz@H5}h>Ydo2R8X<<bUlB=O5tMTm5(}KOz30cO|L^
zK->(lo@(rWKZX5^P{k)>F@D1O`?WLx+`nJ>{R`yiBj0YSiEi>1ok80Jn?R^?_`XUR
zv_KK_Uh(5!X*c%#yr!qoOvx#k2|7Q5x^lIv&iwXuI$7QlSwRimT!3o|a3Wy|55?+N
zaT`yUO~zBiK)d>hyO-<lkYPSQPX9w!?AMI{kE>vRdeeVL=>H)Qa9IFw>FEcj`dRL;
zHNk(D`?vGzPkr{R{!#`{fP$Y=-B-V)=zn;GfPsUfJ>Zh<@3&%%jg)@7TPx^fZuxsR
z-Z(<w>DG|Q!Wh*DpjcQ+@Izp2S3h$mc%kilX>w)cQ+n~%j~ADZ?yy1Fr~*?vhq<)o
ziXPLNj-L_)l^PlmMaX3dM8b0HV(J{EaG4>yYElgtp|D>C9<teZ=TY?yU|{3yiMure
zrc>RpCCY7mJWpG!i`<WH{U#Q^`_P|h%`)ywkEh*-1D5{(8il{xyA|M`JD?WepZZ2P
zWkW$@Y)nFHZ;Ps;Qq<xT1uSMry}|3ueB|e<W^|-k3Jy(Ntv)YXj>#}j?d4Wlcqu75
zM}Rf$Bw;>U0RwDJ5QN5$zPjoB!L9O!>UzlewYI?f;uZCGn{T{24t{F6r_rEzJP~Jl
zfc5nA-*@bP(D&c%kZ$;oW-cQzteHoX4<bczeKdrnL?D*o%Ice&4wz)37&WQQ^8VP|
zZh<6C1PXn2YZv~6K`NgRHnVaj4z+t#EM6&+aG#w8?}>~NSvLAOZ=IW;zDD4MauWTd
zIbXo~wU*Ssv7bNe_j{L+7qBIO(tx_W3(tTkVSPSRf}ZJtY;(oT8Hh!Z@Q17-L!EcL
z5~opxxJ-3-n9{_n@?h3=FvX!iA2ia;H&L$dLYncEw9;lHLW2L~*K7NDyv>ei%9rlU
z2)gd?bl{y8Y&im11f5xR_3c{hpXMo7nbz>M!8*V)1g!t5(*E3}fRVoK?}wmO#LK5*
z)hBB~X$NQ;mJ)Oi*aJX~CM8tU)0q#Wou6zWd7R(fQ(<95fNA7aiD+z<H%%uxoj<u|
zFrtP@6oE)>j$LA&LqTLH=my}^hgbmt^*zUF+MjZ%4qo>d<QE+RLu9wcNb^~lr57R|
zxi2`iB?{AoKHMMq6J#>n{KLiIU%S8d4{CNXHuxdYc#4LMtmRb|0Dy%6iN@2nI{qg>
zKRxF6i1-_~^V?NkMPpOIw<PSpllq>K-*0R0eLy47KL_U*FJ_jq*$^cc&X=&m%YgxO
zC-?cWv3NZ0ANFF767Ymjf?uOOTh%bzaF3-iX%K0XHB;ho4@NUoRLmk?YhK6R4t^f`
zc&dsL{@Dk#q`g{ips`0oE=!%x@W8*3-&2*SOb>JyZh)-vJSwB=-h7>4Lmw#78Wyc6
zaK&;R6G)#9g(wlp+3ESho%Nt(I{Tqm$gNacn@n9TTV2W+>c2k!6#tj78GJu3zJF2X
zPk&&a4RA>YsAvUHh5pa{;Ym$@Jntz*{5`6D;}t66R}}$=RbbU}(ID9<$7|r^amtVT
z;OrbP_@SiIh-5yRkQ8sX;(AfTFZykf$$VPo-LotX&<?>%?n`flNf_FrlvLN$wuPL|
z%VnppNGVH)HKc`BoIfLzzMG}t1$FdiQ86}-@q%s6<Psz@f6I9eRadmSn?~n$CU(ZB
zKTrHDq?B)SzORuHQ%C8gcNGh86im+O9h{uxrD8NK&>ff#4+l>8*o5u@&TFv-<<q1k
zqQm0J^H!C>4Q&oLQP1O&>f$wawNB9XVzqXHntkXUY7cK%Ew#H6)!4BF<Wvc|bi=VG
zta7N)(V94SHcP~h)Pg4Fv0wr?l8ifxcgdC`oU|c}M<g<F8HM7Iq7YXGd<e4lzOkfG
zJ5!9*%B~qhrm$*9O#b*&*MjD?y78Nw&;vL)Qs-uVuF&X#@44O{HSKl0^j^(?c`G$=
zqIx*Ye~@^23i`MqfmP;CyIp@`%Q-%9jq}(qaUwR35QanGbUy{bgOj^XmwlJtUsX&0
z3h?#cit8S+fOS8)>6WiRTr10t_tKp|<ibBEOe+6NL;Rke0X{@x|FbPdgT<LV%|ze;
z>@oQN>XE;PkMFTsz|qm(+`!2ZFz@#5!ySJYO)~zBCY%EFK!T-Qb+(`sP2Co0V9N?6
zNG?U$wL}o}MK|jVNDv`r%wiOQRDGHHJ)D;tU_!>zeSzt2VF-%DFp`|j*bkyKBqQTk
zsgfoSMKf*+LD>{-s%X4^L9iFlBo!VSGX<Yx`~t`7^udttQ=CrC%7%B!wr++yxYgUJ
z3hR;!?;dXLPZ2M{o<hc-E{p@XjMWZ+>kt5&?f*4wPu~3JG55`%Gorhn&bOe66ROWZ
z)0nn!>BMW-;I;H=-R~1wjKgkEtg8?DeBB0#hO!vEQM%G|M0T6!o-;N#=r`%@-IbH1
z_L8z&wY@5y+epVmx{!5IkDTirv`a8{gwEVm8`rnA(kXX>7l>B#27xqmk74v35pH<I
zV287*@ij6|U5`0lwUp(r<YUSoj#ZEs(Pzw!2*jFmlMZe_6}rglDa$U~1D8_4@N9E@
z7O`inU=-e$pZuWq;?#XH_vFpdPrXo#FptC`0EF8BC|&=rp_BlO>j5tL+B&M(TmB5`
z_ZbqPy$|TGfrcTAsez@i)nRzL;K_yKNjai`h#qBqOF;?w;Rq}<#xePAy0fp0l;Mmr
zG*FMuHq6V2KME(xNxC;Si26EY`c}An^l@^L2|x=LTzq-f`_)zQ1LJA5UF{f5$+ZA}
z3V+=!d@rTgDwk74{`0fgREcNNa-;;<s~@>JqK&6yCpzyklSGJWkCt3XvSco3YoAHd
zur#!1UX*^l$HpBLvBQmNcjmzn9W^@aRo{G}zk^-9MtB|8*M3Y)zXkJGONH;KhW`YB
z)f~|4^!mSo_s<b10ImW~fF3VksP*>&$!}l7_>G*%cq8z{Z;LF<Q@yn$+6Q?K(TKKU
zC51>hV(1b=8#)z2O4s3zZkWUpz~)#om36ZYX65V#bYL$39H}LTg12XFMplF|H2Tf3
z>%w;STZc^6JQoYZV<s6ev_`=VES__34tNLGm&AzBR*><piRv*TkEYCNBIlkD7YPxD
zJU?xZsX*;??|GAQd0U~#hJpZB8GZrNXjv+W)|XnmJeUv9#|^=R#NjX@-*~NpyQF-f
zgcg2YaLD-u9AY$KVD5P<8hb<Wt6G|>FYVSOYV?k;d6s3jdTzyb;?+C9a*zQ<4%XMZ
z++3;(bcLon4!yVXk}Il|@c1d`R~GbAjt6K$0$}j}Uv1|BPi6bYaU`-Op==Tg8D($T
zdxns`_g>j#BqKs0GnEQiAu=<f%oLGLksTWHf6me2IXZcx{_p!apXYO4@8>+<=XYQC
zb&uz|ugl<Hwg`CC2d`A)uZiFWKt#6>Pfa7P&Q~&e;}wuDH(k$e6JpU$GRK1T7GK`^
z+od1ALV*>c!q-o{VZ?HnN1=Tw{m51HLeR3UuAyQLij#_xjJ4U!t@1l;^c}txlU#ko
z;Rj@vx>{+9B$t&k9<3h{7w6IObN>=6OWAyEgl=gF*l701>~lf03+I=+ZPEYe>7)D1
z>$Y}nqgtB--?lq-V$D;7OjsdH`M;YVi@7*C+t~mS)thUcb4^e`iPY{@MI%|cjDC{l
zP{8WCaHIuBe{5{Y5%O<tie8NuXyn;AZcZviL`;l13`cz-Jf-Sp@m~0j^dgeImvi>X
zI}SdUMv5^cGQMr143a~Yy`~Z0-<%me$|bBLKPV-6Tf%x0*>w%HMY(e<-`l>{)|CI(
z34W;^&pXHtq8ISlTTDINkDfO%HE^+ZhRqNqEUW>qC}wV8v6*<uW_#@m$zpfU0h#`8
zmcEflr|4C-+1bXNxr%Uu#`E^(iyHB=;o(Uy#oX)&%N;AeOHU8!e9E==YdUx^AnlkO
zVS(($D(=Fwoep9w)n%9_r`m?1<{B&E-BUP0t1l!LTNU{1EsY7>6aDT{c1z@NT0x$L
zxrOOo_i07>$6LWB&}@j%*w{lMEfppcNWsY*1RP6*u&juid&WCkcyBM0;Lu&1Eq059
z-CMZyufJ@wnRaQ%N|Etgsv=~Dc@g+PLd*BDQiND1lpS^l_~{&UnnKr7f#U}RCRGcn
z8l#-4#y)GU{~$qsLE4@SvPl$>oA>xZ^5F;*%bw+?X7@&Q>uj_ScYL~nlgg(h_$rw4
zse}3^<>@{S=hp{t56_qj{-71KTia#Mytgv~PJq#y*f|3SFLsEtieJQ;4v5kOe8l!9
z&h}4=+1UVre?WjCR0x5WP(Oq=<aIkk@^d>eetH_;OxjgtJPM<P_;O}OT`uyGihh50
z*+pNW6Mmnn)5oT|NiyhrB}nF*3sjA2Lz8d#c~O7I=RWzx@0c3i7$Lqxz*tf@%VeLh
zb0R0l@)3$~3iK>v#|udp)vbdcu~9$#F8RZ&p|UjMejc%E>IDx&zK1r}K`i%bE>P4u
zzml=M{i@(##A4GI+7`L0aY^tHReUW}<pvvm(F@?o!+{}cj|K=<z}DH(&f5B?D~^mV
zP^c5e4q5fW%vCLahh-e5#?I<@p8!qbI&V%U@wYKvarGXzNfZJ#avJ{i8$#<Vb63}q
z5BQtUH$I4|OXKd$nW~|TjH`c{WH~vKD2^jIA0$YP9@T1SuKY$wN+_~k;+toT)sZ&M
z)lW}QXPZLJJ}X+EW?Y#xc_M~mOeejRdH+QlPnB1HNpG>04|6V`(=)HjvlO@cYQHzQ
zv`MtcutdJ-@)}MHGf6wJf=X(jDji11f-6(`=DR+(!Ogqcb*X5{u{D<J6}jI~;9b}%
z-?5SeKrG05KxDt>B5iAI;%>4T87B|{%@-!T>Mbte(u5b<UV}?c$mn3t-(?kQb7t7{
zA<@Enc@Z+oxk}VW2cmc%a~X{YSDBE^A1mX?q%w-58`itWn$?s+$r|{<|0!|?0~K}b
zTa!zg`caRQ(r?czt#DI?wdEC*%9g2%M+Ov4JR5tJ@CLm!@vCP^j|Fp7hx~M8q)eB9
ztZtCpy8tm=<-jx6%NKpSi6KwD>HT)Tx7pi!`7MXHIsQ+F`m0O?C`_0GwuZ#IS9^p0
z7>lBzrHPTVI^an+!|_<0-0VN~RVdW45~2;Mnx?619m8(r&VCo75Q=f48@ae*w4B<8
zAgAPo_#qOH!+HnM1`nhjyh4PUe&F=-M%Jaq=7LH|9)nCT=h~GoxE|-eE*Hrd7r8ED
zsjPN044+DP%2jnWSV8=Gw!({Vwh>r?&9iMBDfd6{l7u=PUi%p5;_ourj>gI5K=e6M
zswbGUu1$Avtlytgx$MYQ-DK2H_GwwuYuV!sHmFD@vMHY?G%_`99^@6odqNiA`ah7W
zzdL#a&wA@73Z7B0%2oq(8QK8;;`fEt^Zct9=U?<RZ)`-(ZCu#+KC(2mG~_hLvH0QZ
z%(s~@-IpzUK4>AWIRXDS64FF34qHp30fFpE(dnzv*P733zNo@ZEVRntZYy?pKyq%f
z0f|@0r9tg$!8HyOZK3{8?;3cIG+%uk)@1fnpj$e_*uh+4shY&W<QW%1jQG2|J`R?T
z)5YVkcnD(*`_4Z-%eCR78Zo#dtn!kOlWgw+BqS`rQufvvpe-p6OiL^@fYVhb@&@*s
zJ69UIP9vOzmrHybY`%)JKS+1}+HOjZ(`IUxWGqc@{PwM+!KFX~+Ok+|1NQH$gQs8A
zoOs*ndR(viD>v`tJ11sONj9>YBo;1-m&CYe>pzAD(l%bq4G|r>iIz=pFtmlaD1CDN
z#YwiclmvEh6ShDZ6Z7wP3>Z5Pa&qV<W)!HLCOL6=YCa&4)y3Yu6`xeMM#Wm#0zF>5
zHk!y$i)!d{c=myNR6Q>qM~h}3vid;uBiXN3Zs=llI|sdaSsD(V!1$+NDjlj%LRgbB
z-z4)&_41AkGt&39dWl!QSz(bhn;dQa!k0l_a#{JHHWu2(y)5eHLY&Z8^K3&2W2}Oe
zAFVi@$z5_@Hd)s#2M^{tl@g&HJ9+)}F`nFasa81B7OO<jcA_;k_9&Un$luQ;Up=Xd
z_Jz0ni}UAkv?|=Zyep%(I=-MjdNe#^`Q5;oqx^VRmn6xxXEhDx-_x<AQagCuFCEtq
zK1=s4EQ!l5;E5!4?>V}QhNqm8V$Yt-t0yyfbitgEF@T^=Mf*`MUBIzALPy3Fd!MN!
z7Qws3jblsX2V%Oym~p7bC72u@w&|+yXpuFtv2{JKd8mmY6sHqQ-uUW@P=sUYS2}*v
zl&iTJLyPU5gE4s{Un<4M4;&j=u)p~c+kd`9jpNEmVn$LLGR>T3R!xoI>vTQtbm5qk
zg}%qj4b5$pYu=YTx-xzbicjvoblGvJh_D`G@KW;H=&bz#TUA3ZOKn9D_iB`cyE=t;
zi4%IRioPCMN%|t^!4~7=E5huG()5@e%OFUe_RSIZ(9zI%N#}Rx%3BzG)mS23hO6%k
zI+ckwe2?Ysi&^rv8vLB^K~9&2#xdA2{@`HX(f9zem-jl3va6lBrf}<PeFx#hlpwqQ
zWI!neMQI{l;RErQnG~*`A%)STBK8p7(^A|QN?3aEEUYYYuN;`qaH+qlN2wK}HB{Nj
zKI(tdl9<A!x@d6eY9&KBd4@>{pLXgJ>C~I24D}_iF4JU(eYBI_2zzXxe0Ie9#t(0~
zH_Ipd*6AauQN20_1dk3Z_x4M>-&5Dq->}z~azPhzlFl<NO)O{Wet+eGbw9y~o9ZL=
z0{_n_(-NBD1niMF&J+k#tDUZjnK@|7i=$6s<zJ=D>ZXAmaP-(j0GZ$OSY^RvEyu6l
z%Cd<i2$iq9`dF$?`aH;?DQTLsaikFM=k6<MO-}o!S2#Nxyph|VVU=);!uJ93YIBeB
zU5iSJim_%3L7hDDQ%|iM2G<wYCbK_J6v<Of#WSj}uTD1DVxY<&cslt&q^e)Jhs%Dz
ztJ9J7zyi5e4!w`rfp-Rj{cD%Dhfs!af0gtu%szF%YgioFYdk#EYwUFYl?fN^`dA4Y
z-+v(_QhXr#p<H0b|B;nMW=(x|fOFSb^>}IAq1SJcKE-8(&k6DovoI&LpB)Qs5}aHW
zTH$HLMP8wpKZH+AD~lG8-=Q>wAy?*}FDh>SP>trgA6D?}0&NL{DXnaEbU+T%#Y6nL
z58Fr++;wad?>bqMVVIGg?B{;N+J|$M=ML$euPs5}t{*`&WUI6wS8h*<R^d-eBPI+w
zAj2Pou7WYcIHt@*_Yrs2#hU9TQ-{;Npyf=SC{5&8%+sG(Pw?WOPZVua=(6d1SP?Q{
zmzFmrYg6j+?anx7-bMMGoJgVDpYpHu1|_c)f17+Xw{kOuvM*a_aIUk=qF94JQO_3b
zOhs>DWb}YjWUrGcagLJ-*~IvRh_H7wkshuwH@aMTXLa9~m3Wo(pX<NyC`0#$1JTCd
z$@>FyLMi1H_-3r~%z}fjV^1{p<j4MKL0=}5Z|h|uNI{+?WEDIAx^YOrZ;sysU)`dC
z982(=c*qc=Nus15=0PzrIl6B4m@g;V#cnR&y6X@W?-DMCVRc;HIqAl^`?qKWH(U+0
zh!#Z>iZsLICc;mCoNQ4!HF&BXeYGtA<q4&{0$!IlQ{xhoq3**^L{5kVTc5IzPF2v#
zmb+l8>DQQ48zg<D7B#W2T(U<E$FL43Tqelg&rr8FyjHu@VEFun>l!HQD_C9l#^*jM
zoGIWf(R29_MYrrPozX-)#fs0%8to*x8ig_;8z*&%ioTXJNv=kjWWb=|E&1!=Fu_un
zk3`6Ch?_VWKd*DAu=u`pSYaPMT|8exb1^P@WMTTo$_;)(il>#Kky?~^HD8E7qV=~^
zo2f5*&a2)*yX>%>6Wc*V=Xv@R`r}>=qepYjbT~|nF0*2<ZG~RE7;q$-Fs83i$M?RI
zM)H{Jc?QYjSH&(O%6N>82ghUb1FGW+mD!AWfVvJz9Xa&$Q=M0Y{c>&%NYdwY%#ZgN
zn#-b&s__Vrw9XwK8xa-#F+^ghZ1Ul&iex+cQGW(fa!s6O0cr1b8`198@rCM@B`0!S
zmN~O1;d4j452O<O@KVYP#b!vY^sTq>I!`%6zD`+u$o=re%7n_y0;k36f-Fk<tHtrx
zt0q6TNJlBAjI4EtsFJ1TqYO_Bow`;v$9r*PGJ9jY$I1ac_EN7w1~o7<83wi$_ZBb(
z?Xf_*H6RFUd%|{Er3RR+VOOr6_70Nu(NC!1#AvUN=45&IuGLwqi<=wQJZ+ut6PoCC
zl?<tvrPSNEN6!~AbD}auN-OJ_>mB6#s&65$F-fmJUfz_E-{^MsTH7a)4-%+&xewT;
zwS)6->Ew$l7V^cNw=|txie+WEb-gKhkUi30HbLTuDsp1Ms&S9Q8ZlG$wJ(}M?_!2R
zCn|ACWRbPY+dEfqyKHr5e6mXEE-us2D%QrFCy#%ZAp5{2aq>WgFgvE*lk6eEh^vv)
zQ^9q&Q##KqkQ`r1tZejT)oal4GDDuu3ec$Wl*4%0km}Wgdg-X}Gvqr?;i5$GB{^&K
z=PWh`i7ZVONvgBOi9g$)TW3be^?a}Rc(VDk^vu(sv$9C>2GMm51^2J@fRcOf+<IUE
zrh0$Ae248RA>PK|*z<20TG(zLv)%l`+8rtW1^4%Z2;+S+v>a4)gP*Gi0A}Zly4T}*
z(D$PdSkP}vnm7Z~Odx8{3_8^;j(q_bA-?$P56s+L<59}H(E;5`nuJOir|S(r%BiR}
za+Y-64_}<)X1u&`H(I80zSe0nwTzZ@2#X=c@*=z010@rK^xF6mtdiPew=m*4lw`c-
zMRTdCGuZn)zoN<N6R3G8nb5XPW5zdnyQ?I~%oxAz8?qQC6u6JGrubNr`QWA7L}vQ3
z%Y1E$&1EHTO1(>TWRYhj`tgO{7D={=pm9nU_FqvZy>84Uy=-!l^K#Xz*^?ISGo{@h
z-dj2Qpga%4pb@RR*Z#^yA<w+<;R>F0vMF;|*gdnF=#w<uZ&0{9*=%vlyZBD@`*Vd1
zyv@OQ-l+DRj=T5t=ntR80p7cq)1ihpjgX6%ommepL=C*M_w~q@js8rXX0dThzxvgg
zX-c1~-%{)a4X#CJRx$)wjn}$8WvJ6k>HSWcNe4PA7OUo<aySU>Fy#2867Z4vYa0MJ
z612ny>meYDB}X6FoE$~L6*+Aqb@b5dWrKIRbG{1Msz7E+caPAL<IamkQ`|g8L<2Eu
zHtqObbac;_s1Is%)F|I$wI2H+>E3w@lu{WIK2cPU7gPYi+5!f)x4lS2#sy?6G1o8v
z0tR6jH6x>HAlvZg=hnk17CI@1P{PRg^$*<}EY0u6ENas}QNK24C>7^UHE7ClrjUc;
zKG9i6N$q$1$8t#nC?q8xk|<-CSTk2^6H}3x89kSqBR}X9%omFLK(EYj?tZ!?Y5p~?
zvIlisC+Va5^}~=qEv}t;V4rgDj*TXY1@=;`v2w@#NQO@KHjbotz8l^unYX=_Q?D&X
zn{h1Zwti1Dy-sghb=M!$19{jHjXjNb4DWgBj$JWjv(b!UK%FOmI(y4@f>0ehC%C>B
z8Pf(C02=2!Fe&?i!VRJy4dRECG;GF$xSu>Et?fKv{PK=PU&VEHwv)I=1sh(z^7ZwY
zal3m+N6B$6u*4FZyQ3pGg<pl9&jvm0HLt|$mqemd%@x)2{^)UN56i#BpYCl8W9m|3
za*R(uW~G>VqXviVt<|uvK_o}H5OW<fnt1X_#=N|lN2FR8K8<?DM=YL9T0fj{D`9fw
z-Xnq~zS&k^i9V;u!5li%BMTLzL&!cO@2jj|_j3{px=Lfnq^Q(|3W$u_-m@n{iM8>l
zdOl4`)_%Ulk;J^-oaAMKs7}?6W%6iMzB^=tE$W|$`E%!0)XsP_7AG>A%@z<-eDWjV
z@f305rV-T7?bPB_PtentwUuZiFvZTX1`Jl7LMakK&m?W$m~VcCJ&M6^X=uliB(`{@
z?&^h+>t!SQA<@bHaZ<u4*$-6=Ue;&4A3h)#G)AemBxjVwhEe|MRIm8==U?eYdCiqs
z2Z%SY_*Ae*ALFi8Q)HjCm{VV}kK~!1nQi}^GH`dLvG~iV-AupLhU3(!rCXZg>}txT
z>8|`Wp?xD|L*grAM3+@RT2O@_l6Fc#m*}-Fs>6^WWY+n3S`hr6C_cttCH1o1RTe<9
zBfwfg`LEr|)`s==5D*z74|zWsyviFq-{PNvl^B5KU_opl_K`*AgCR{6`MHv;7DrLm
zDle1C92&Me+F?m^k%OcbLl+sMPpRf>lTt^#6Atz=DY1^SDj{MwqRM`(9~^s_I-|2i
z^D7RYK3!Ao^y9J-`QT1NB6&yYFo7EsXB7fZ7coTPZD3uzuQFeEHaUQ?T`#d<Oy}4#
z9bUHISLI{GLV_)I<Z(EIrFsM<Qk^-yUs5i~2;Gq8qFrbhl6Esmd^mWib5eYy>Dkd(
zcVun8OXs<)Bs(;pJZ|=<)g4w0EEYg6qU%oK>d#5*%symxwvOy(XD3x?Q~R}7jJ3jn
z1E?H|%U{INjZz<dvUNG&#5{8)^21At4qLT}CzemH#tbs79{habu}D+99EVPGAG5>p
zP6-p7Xa2m4Sld%Vi2L;Pe)rlNXp~^!1M&NNo0LE&5}>ge);QY-hL1i6;uon1k=hI8
z7SO4fhQf;KZ{Ce2LibyV$YQ1nUe<r7Tlw^<@$<LbL5bx3Dl0VtkF^}4JWTntO)n=V
zVo(#QdSgq9suV|1B8%y!H(qFXs8hf{ifSi{OP|i@98gLaN9J>3RY-@6JXk{~h=?$&
z)69dEVJej?z`JVuNgo1c7-}e}LJF8+7%=($`+?%;lLE;@3~ZqD5TN_o1p-Fswt*Re
zK@{O?LalPIoBC)*k?M^DxMR=XbiWD9VA!Y($%@N3)Ke$D@@;T{&rNAIUF5!V-B$&t
zx829J`A=1vNiu2Hm^28>m{i--(TckFGulkillfspx5=3(-Y;U72~;m?p+iAu5^{Nh
zYih2fhrWR&8$UE|LH<&N%lzcT;6!#Ocd0e%l^<Fbr9R%kD)TKa(}3|Un^^j{bW{t3
z&o9**zWrwP<FP#1(l_O-!r&totpoDCN;GZrFAVKe>^-KEl-x#cqgK)DN}VCO^u87U
z7KO0p@&RoF91W6>9*4EcB_{H0%$;AUGtl9m=wU(Y)odflWR@@<9J}MqL_0I~a;8;{
zImCeb^_2p_!8m1?z%yf{+wIT@%m%$@?(&xbmgWnz#lL8W%`=Z6H@X>Q1DtrIIGS~4
z$fOC)Q>pPTdemDYSr=KEUY_Uk11X1i`LXS!f8bS}zzruQiJOVEOfEHMp|G5J^Iq*r
zSqpPKW+=CCzMK`c^`|%J9>IKfF`ML6jyiR`mO_5<nJGbSt=4(Yo}!hNs<Oe?fbl}f
z)T9B<pgzf&u)!X~#0QznJn|Zjyl?3}y{=Nq9=?1wf-=2D0ll)Ho_6W7zrBrM2>WBB
z$uml6t@#deIJQq_#;GVqpaC|BC-{4NLk1bR5oXCS46<8>L`p*5LGSH-J?JNY+P#>8
zwY8yvkrmYRaay;+t|70UKcLyRa|WNK(Ptb6W_Nae(@pfI{-!+FY_*-(pBkUz8zl(W
zQM+$Py(}$$EINerai9jVY!k|rcd8+CnwaaP{KGpV<%_M{>LAdN_nxxAXKz00rxviB
z9^&rMV*)>O+><wh3)l&dPK-_9$*5u=Td1-ol5E(HJj{_gMjNQPEYIBIPLj%B|Co}D
zKfb<L@#Tl3GBnlg<<u@x#f9Wj*nC{^eeRVThi{c0q*(RYHh74OO&K??tpKq30fXOL
zb`m(<ot!rll)z^KONrvc17ga8faOmVl?ZBv(y4k>Y$>^?u3U-uhoq09hX<|A1zqV5
z4kLY4^{R?s9OJ0}l8pU_Vs)=5v-`<HVd0q6ktazdq*e4VGwGxPTk}ugUSBnKy{?A#
ziK(4AdVsC_rGPZmDV02uL)`kIL6s%u)!ey$%~oeGE|T?fEiqnAPjL;gP!p7^2-LfQ
z_f@Ne<g&<ZVjnU)vW4*4G<CzHdUQjr_c2!8W)?1#A1tmAbiZI=z;NTiy(oHkmAu=(
zX7vEBnTTnxRbqCi1a~y|lV-o|2rK^O$<yDT#7Fz4g<1w{7I$jsD!aaq<e+0Y`Lgf2
zs9TTkrAZWd8NV#7G9(YG0*B{LFOv%z7mnR7V8qYP>0Z-z@1k#;$XD`|AZAV1!JMBj
z?^*~9BTTk$zDiBY${kX6<`~MC{tx(GbO$^~1&>{49OBBRJo&16;RT16ff~D=3?*B#
zKdQECv)3F|(XpzWnza@VR-ez*0#qepjKy~0m*lWGWAq>Ko^VOe?Wvuq5fN)d?-;dj
zu8~aVpWbK*LBlSRd@9^BeRt^-cRTwv$-o1Iv4b4XRy*_)-Ypm2oj(5&x$|~rg(!m+
zhGObv;*Olm`oi=pD3|Ke*~*`!P&Q)wxwaJB3d&5CyDVp2PsctNZ#=JIT)Hwzlz5;I
zzju)NZdMZI^2CR)`t8S`Vf!ApkhvLug?`j8PcD)3{ZX^@_yB@J)$h0u@OTdQ(bcbH
zS|$Ei3DjLLJ7O*$tUY4yFJsd+{;J#FMYfQl8|V6r1_35x@n>-x6#iN6c1y2}&$c~k
z@ltUsY!{d+TJklTEf+F^jBan3r92S*e#N<*<=AYklGxFh3M<yJ*<%{m>UAvCHJ)1L
z7H#-+2?q%9Ws*OfmS0~VjK`Obe|bmoHG1ka`3kMR-Q?R1igxvD14Xn}&s$b<<1Axd
znTg?b#8WY+XK*4b=H?GK&@h!*SzJLme7YJvNwRcywxD^2YrW?<xm)sE<ec%=1gQay
zgEa9KIJmVv;_VG(t%cR`XkP<^ZBUti_#Nrw4WMrya(KeT6?ye#$<*1Z$K1hmACUYl
z<zopmJ>pJUU9YT+Sko$SAkaR3QN<7a;;ZL$?ChgI^q$e4M3-y980E+){1jUf%Y8<f
z<C;uPn64YAa~&V$kBbG_mk&vLX7Z*esWCV|Y&Sj5jZt>(xZaciT4jfuSVbuhfrbJ_
z(#TY0{kJzu?M;@8=T1+zMm{|pJ}6-A6Yu?Pm$TNKd-sl@YEavuUFTM{l8u4i$^kxm
zpA`au%g_o_7l7gf+vVYa$jz;+i#8DjkPs8pZ*s#JkCBcV9<roQY(g=7f$9%Lm=K1d
zg`fE`r^lv{c&I-1QV(}dhkd%P^&;OvN;+a*nNhMcr!;&TBo`lkY(0!6J3DyWHvL+4
zaert`TF(5@^pM5;T0Gt}Zo5Qw?XAii#J$)+-f-F*{E{x!q`~rO5|E2#0FZ9)J0{z|
z3VnkL`F$X&Ycr=nF_2uopOet%n(x65!B$2x9$7Yh-EbPMn`wg$EQWRstTX<x*KAmd
z?#9IF=1uv&=eZI`^Y&#d&P6@Lu(2}lNj_rBwG4W_(9^2654D*px%mVH_;~o%7p;a9
zsIaTlg1bdEd@Ps*8!xeZz!3Zr*pg-+9dW;@W-<MRimB|~3uq%|`3gy*$#gjxilnIx
z*=CKCCk(Al6~tatCOLBook5I;?ZR<X@7A<s(W5jRxhki%jHx(V&S)vdiQWjkl!1NS
zGpwJEf?>g8aF8J@N@D4K=eN$w9Avhfx6VIq4l9UA$GtT$f2E`6v%BZz0MkYzp`*u>
zj}ZO18z-L7^)Q<5W_&YYWRGLr8WYpdO)le==cn?*8-%$zR!J@V>&IF=aywhxlyW20
z9u*=xTn~14<vE)9fn(v*xbs=^=xDsmw-wEb91FvXD=Uutq`Ha?V;Va0&+Q}&JB+U?
za*a5Ck680L>%)idmzYkmrm4M%)TS0hKZZR>m}XS_4)wYYM$*k(Y~9mD@j8B*iRa#+
z2oTV{iFYKta0PARghX!qV&_t>z%!|i{9du-IVpUalqa1TS!MC3-;j7ESX0Ss#IM|s
zdwqM=(>$X<?>kE`yYk605sBovDl+*;NwjyJeIGKM7WzyycE3Vnh-M)|yd3@YpzO1!
zTqDtyNd@_tW|pUJ)qGJ^7zpt4=0LuE_4LCq1M{}|gGUw!c%)*2Xolp^OWsh+=48LZ
ze<CUvyZiWUZp!2ONmWDMDb;x|xC-flXp<QETk1o#@A8a3Ef8tK)Oc<i#!t~?Y!N?5
zAQF@3CYPnGe7og@iC_aIM<2nxj&}q}=_=%hBrs&oe?0ZPDCR^nveWeWy5nc>G2IL0
z?jvL(i1ncF))^aOAU`7F(|yOrgH$Cl%O>tMjrh6aCwOQDZlQ@QG>HqJw~&{xj1Z4(
z6KC>zudYw56zYangcc#&*4bKne4|o6KjbE#o<n#`_uJgDW%YpZWfOM{MXJk-M(fk$
zL^+IaiqU*YTfcFsgc^Caq2YO%#2enL752<`3M1m|w-tRTZtq0D@`g$9v!~?wr?f>w
zMBXM?5_!VoF2UlAYh#R^1_f*(hLtjFGr^Z<?4MQJUtIV=!@)BvGU$8fjgi#)N}@5g
zm!$de4pU^Gt2tjAC$BuT;w4^)C>DRg&g2!mLE}tPDlQ|w#C<q!lvC6@OHjq|aCP9A
zm{bv&%=s{ERuLV`wh)qQXJ4T+p--16N#)ywMT$(@=u@8Kn$>w+ojgpoAlv#DgW%%q
zXrb8;;rfhL{m@X9$In=)gKs3_Gg3(xX4lkK6X2l*(z#HXGE!W=l^dXaZCtYKM)<VC
z++F#~H>V1y^H@{LG(yVjdYpso1?>#G_&j+nto$zw`(8<YMZUJGHaBzJmWC<@m)OO{
zn!|{oBX?D>DOS^sK@*3(Idk2w$W1VWigK3po02td<M`Sfe>vtyv;M_=j$3r+6>1bn
zl~|NQ?z6oX7{6(eW<nm}*<E`xz(MhHBC5E1?39@0RW##L$KI?8HV<OooF6ko3Z7jL
z(Mu`)1|E_Hsfwl!M1&V(xXbt4j*=KCZV2`Xh<qiJN=lhOlAifAMLt$sPTBM5cyS~l
zv5)jQu_6iLRQqhB4Pyy;DZgTFlZYxz&vF}_&xW?;H`%g2^uBNUWY>K4N5Pv54oH|<
zMG*qUdf#sg%}l(z>3Z+`t=ErmT$BZm<%_ZNzFu@bU-yG0Yj|J-XR-nHR<t_LNqthv
zpwiE4#?j&eQ{;(n*Y0%Pb3R)?RDrFlaBN6P4j)gvoKecymr0PJ?^XLzW&!V$S=v^V
zRFxwdt4X-SV^KUW9)FYx$#$q&XP7jSza5t>*2bJWzGOS^8cEEakd2o>$=m0yaOz>J
z_uQ0^;MY@M*hdDeFZ$*Ax;eR-nhZ}AJU!>ctfiByJw*EP<;z@}YT4XxkpefWjt&~}
zis$?wM+-n!%&8#N)bu)nGCOvBMBn={YKq%QE#7Blu_SGz1{D#Z0@*`Eb-{%!uaAs-
zcv7*9`4v)m*`(N!k%|k-CM&Kh6jIYKiM@0f!^WY=;)xa|>aJE<bg`K=m(ZIR_nfU6
zX*lP`uXnNf`}0oOKzaPY!2Zs$kyT7|^FW7(lek7-P|Q(_zkX|`#~pWPs{0^W_AOwM
z_cBLn>!W8L0&?#|ODl|s-qWAEL}D*@$;h#<#$W5Uv2vp7T}keIdIQtCG^$kbJGoCE
z$ustZlFi{J<wW4bvtT94T2>NMT(}f+_*j6*GPTx;nmq2Dh=gW~T!Rd+G70&{nmW?^
zMvT`+-E-#-QOq2SCQCzq@g)&YjO^Z58cNaJs#Tp^OgD~LPvv)<t+-)M=jzdN=z-hg
z;#(F2bXszj6t!>j1B;HXfAc7D9bIGmoS^1FX0y(A;`PX^!BY+9tW-mbpc{$8vmrgj
z!>co<)Lz(l#A3ZEhG9OZAANqOJaUKv>xB@7Lo@MImyuOdHr^r1Bg9kD?W@^i0xHzD
zxOF-M#;+yDBflmYC|~`WUd7Ih-R`SHBfX(R<Nsw8|G`a#@hKjH7w0q^uXTTzPU)l&
z_NeOTx+u%{gL1Xrz<%mts}TC6)7*~z^>&5GSB$`GEqAQ_tnCm?0Di8oq3h}%4SA=2
zPJDq|&kP&s`7)KR@qS8w>HMJYrRGCgHzv9yGHOT0nvg?;NX%C3U*`r6iu9dTUma~v
z`ig%G)pfP9^xKVNRnkK^$ySBMKus%FUY=u><S9?TA%Djd>5|pLJeaX~+U5h#kMT}a
z(XryzeCI?l^$Bya_BWx{!EMb*f|)KV39K@TL!oELo@dsLswx!p9DUG0B=afVQHm!k
zQ1lcq{<phF(;0i(#1Wc=<j43N{aDX*6}9R)ndk69U1CE0seA4|hl8Th>Rz>Yjrx$`
za@~?Yg)*krKd#i1Ffi}w=);quTSfPVZASH8J5T<a7ag;*p0x-`Kz!Iie|5tn%Uar5
z9C^o9p39thF^-hX@?Ao6>@2jZ)i~e%b5z;WI#dJaF|LdrlQX?CzvRxDgu~sO(ER=5
zL>F1rRXe-Jt}kPbXk4ZCJ{*;at@K=~o?nqhKU`RIVXq`XiZxY3r;Ic~Lsfm8nuxw&
z8cKdB_z^WvU=owDM0bk`-Hk)C>wYCCB=p-KWsg?zq9i&Ur|a#+qSX8B?vQQ}8~t)M
zIW$for6BHJzF{P(&0H4_OQ%cr)3dc-yG~Gt_IW-zf=Bc4soID7%%gh!T|YX`NtaB1
zmNZBu_>|k++G&wZSUSI4e9J{JWK|1zhu2!iWxzVYU-0;ZdvF>?TR}8kx$rYO!sloy
z=rJbg=x8>CFY-_;OZev`t|xHQtqL1g5!}CBo6Wkw&#*RC&^j&s-Sv*K2Oj0E7Z=VB
zaunfVuG^58Sn+!i4Sbgkb`7J`u~5VOw3Jy;nHl)rd3-=S=m7m&@66?I&V<?)_Ycbd
z;CO8_u8CVk*NlwiEIeE~b(&OyXJp3BrO`FTLnFo7`%04A*huVpYo1hVbn_uwj0R!p
zXS$;c^fB&EMKOtmICT<XBiY@|&MqvklLN8BPR&iwuJ_t!ja}B^rW3&WtTsT7S6geT
zUwkX}Men^%dwWx>kI6+B{T&wL4IJCe=c^_*jxcrjrY$j|lab$Ei66smJuDmBd^fxV
zt-MvHj<$hL>SGH7vpfHjZdr1)!<^?%bnzI_9+?p)q7oQ8uB(3~YAm;jRtb+#`0VBT
zT=kqQlj3$OrFZCMBG^0c`9H^HjTtmAWUt_+Rjw|4Ue_!#sZBekjN1C-M|?6l^T6$J
z>HDL7Ys}1IlN*Yb?1N)N%~S8Q>6Nwh9?tQV_Afa5(&bL|rw~of+9j13_2DXt-1b~D
z<XT<{u(yx8$TgIwI^EfOk}-&X-qub>S}BtnJ^vC?xx@0QxtHjp&nB5a@^m){nY^bA
z#JzsO7{hMG(y4}__xw^>f3=-FU;ly-Sz;-rtiphU+}i4M&KCu`x$>B}Q%R!SIUJ1q
z6Df}aFHc8BYWr3%J;I;+ntMkh-K4Gf)%15KnfHmK2aR7FCwvEvDj}m#A|c*9Btkj?
zEaD*l;BQ`jvwen%L<RjjG7<?=-f1nhJmy~Hr}PE~QrLQtVc$3Jv%O5zZq{cO!UMuz
zfjt}Qt@}WJ=Pd9+yiF%3Ehes@D$e5U?hL*q5(bYd8EG%_eFa3fMEq#Sw{8h}w8sDl
z;#=A|nw<gP>*m#q(8nuQC_10~%j0d{YiG3dDY$!m-1S~NDB$khv_ggqk+hzi9D0SZ
z?AC;=aQ9{h9(Knan9s4Wvv8b&Jm-$ToG~;puyukXfZY-H^sw){5pcs1`0azh6iCft
z=jgEql5I0%a}Ihd3AC^r@R8agp#r|W{tFUFC25IGD(Gknwh)*#>Rd8}b^v&dw#iPd
zV#R3#9FSvhYH(zMhxgt}FpZ=vOdJgyjm#~K46Ofzl1$oYSIVc;Ss{>@|4P6|9*$Cx
zVE>fTwieE?#7bLLxe<wY1lxF5ygP#-vzh=JB=3_F9Nr-yvUG<*|EH<LM3e)vTtK2Y
z{zSm8&xi;&9l_4Ry=S%v0oy}*xi>;PJ7>5a5PDn#3E~ZIi)>!u?F_Nk<AMVq1&nbI
z5<vg}n+NKkn81O+Zk+A1=@MbzcXJBja3J>k2QhGQwgdJIH;)|uHI@P#R@cA6+B&2M
zHgT9tdy!28j!)?5zS|F8wk<xOzKE-}3A~-bIBzE-YTj*sMw3$-{~a)Eci=^g<rXIu
z@Lvl5Z=B+`#`bm=w$9*{4_ITEFZOt1g20U+?xX@+?2t~%MZ9;7e`}JqLE6wRi_WG4
zy~4UMcy0vAW~Y+&=t>rFb1C4h--Rt4h?KE^i=%1}iNh5I`Z8#H{g*L}H|ZnC$jM%0
z7%=R*TbG6(=W|K+tlO3qf?IHR>qG42gtsJvv>@`a{gdq0AByUB?+?M<*Ww_NF&)6i
zWQ&Lj_;%?Z5P@3n=gX0wec)$um0y|^))f@IOc8X2&29{_J-YRS7BK)MB+0QX9Jbl<
zJqx*QZ2%<HM?-T&`~nBFw}2d3XvYZA+Ps48ZRcRhz6A$qWdqW^zyTu$^eq$E(m3R8
zq4$PeVV1WW1H7*&*cSsR1PY8pD&+>nfn8x(JAK96Ox9V*tF}epBe5k374Qw4Y(J8K
za1hSSU`-{i>ICIeW!}8*<jNQRg6juRK%y5E;kby&|B~y^Y)RD)UO+G)B(&m^NVP;4
z0QUwkbZIz1REqro{@NpdF>_cSJY{0`+dc?E3+1!^>I|So0w4HUtsv!JqKUf#C)AZ(
z46QAk%zvKK23sABkU-IVS3<f$emV(&4pQ>+Je+t`RQn;62Ws~jn3<?<SI9<0_3V-b
z0xHDAIQ(3@X^&Kn@KfBF1aGLZV^(fn|HL=&Zpi}iPe-ZuCJO)n>WN@6YHs;MSzuQf
z8`!>O)g4rrq$9Py0(X`L=3|muEPxJ3Hh;w;Vr^mIB=Iu_3Jiwy?LB?(@m^#Y80@+U
zhIpvv*aCxy)Jn5wkxXn|5zhMmYji%~c2rLWxFuw5E3*Yb1$-l?-4}$ot*eEjovjVf
zy~GUcx6S~-3G{QHikQRdw`RQaun+tw_iFEKK)F^h!>d_c=>FAz>670e#EK8RoG3rE
zbKis#*c1HoRU@pltF*1Xi!*Qt%*4RvKRS7*m^A`*w$~Z9r%aaXfVhcSBFI5B*ajt}
z<>DFkLk0x*?e29rO>B1sf-n6G1}bL#8z4|2U~mh<T=a&E9TW@JqPul7cweN?wjV55
zab7SB?A|bIf_(@3BFKOSUm6%J(UZSofwdi?Lcw58m}YsG>=9_TZCmgKe!-kK+4rm&
zG`{=y<$e+IrPEj<Fg3)k^W2v0LtN)K;3VIl_eztk3YNP%hu<|Pd`(@jObTcBiGjFq
zAtH@j?HzV)L-^vkU^o;Y7<ykCZNtF_&?3TP)ppz!556)k7_WZccw4Rc+ZpE<GN)as
z;7iqlshWYf!2OA~MFn&OU?Kfmwgxn31Z;?n9^R3~aP5-~S~M2idN4~z?8p$ah{1Kh
z4}Zl1>^E-~u>EtWZLbAi<`&#|GC;WEz8Vj{s_t)#-hydiKGt{s&zn;ePC^ZyzoPwF
zmKMykd$VpU2w%JwtYFDMVcM;fEtnUkp+uhxf-bSm3tvDM%saySFEmu$wVW&>V&r;P
z1jL9t4*b%rjc+f+=0Iv(gkx6J$Ib0HSd;HI9pZ#DyW{+O2Kad{1S|yXzKA)tn-0F-
zEV$`x_sy|+xC4?66n0YOx6amN`Z9uc+Qx$~{0hbk64<j$5F$`PIj~$XOMe;Swkr>O
z;Z!hBH;`)J&wU%zZXi71GOCDx!V=tf1%j`M3I+-X(qilb2vi{z5s!+t$F4l^Wlh06
z7lil41N41ZkyAuGSXQ39^1v691oJqE?V0E2p7wv(P_LTTu1N5u5y42DK$V(3HW{pk
z{RdOTRc{1Lf8r07fPJ+;XM$E01h><l`XTs2hG0=r_73n%Swk=ptg8=o`|MMa4IqN!
z&n1CY?gInBBym4n42{`=ec!oCg)bHemP8KN=iDOzT<JhC4NQ)^RldKKV`l^r{5BaO
z5X|!DG+PC(zz}>zC!rxkuq!OI2s~=;gxKC}fh;&p_6Gs+!?2=hV4$!CIw;VcM-0%b
z8w&;W3T`9F>nZrsYT!1i{d*wD_^?Z%H83yiHHaz6rjRiH-2{Y>zIYFu=iEmtLTaCZ
zL8@4ophCf}uom4Z9DIc|uyALAJ<xrE{As;3FfdHHQgwK6uyQ+hLE-KHu;N~T5x!PN
zQ`U!WgCcebh}|^&+S71<5Wt&9;5{f@3&PydURdDcXUhMI<u~scc9&>-#t2`L4QyEC
zO8aW3pAvzv;LC{sRZS4qX9F7<%*h@Z@<-rgx8dOnse$2XmH#okDuR-7h>+jS2keRr
zUl9$Aj02p||MQN#)h~Y4`%h70`T}=Fg)epnMjiOqsIYg!yX-Tm)dxXoVTKL%kdRGk
z_^M@K+FI3rEbKNdxP}=bYdHKU7y&e52ethc8!|xGtNkNr$RSoR8caW!zk+?=sV97K
zGO(Vf)&C(H%sIfvzo>vqm4WGDp5b*u$R7)<0=Hja2;`IaC*2Gp>{bOYFe6OS|56yf
zt{7P1&i@M|WPSwm4Zq!C(2EWIV`0_dgq;Q=dH<QPn_g|R0u~}|9l19b12C<3S}%N^
zEU>nETK^|Zm?dv|hd-&B1%5D?VIT1hL!kfmkOyDM3jAR4KsfsUMSs|XLF{MS_5Id@
zl=ZLf`ULO=q`*%wbn*ZE1iO@zLev(74w1V)34E<4@RJDX{-2)Yk1IDJdY%{B*LHm#
z_)16M=jqV<htC7{L*Tkch>(;0uk4BpUx^5eJa*}CkayH2LWHKU;s-^8EdX{~0l}{w
zOZE4K_Pde%zkDHl6(X=k*arIs`Hz}Jhy-(wjoP&>;cE+lIS2R82^;Ws7EM9~$n71C
z01)wPjUR68OETQIkkI_fU>ewvhPYV~(`*OvLFSH2e@O$Y5QK<ID5DIz3kRdzIq<?)
zDgrm6y3yZh1fznVDgJgC3Kfd^<Hm#!#-KFb6X<pY9YlIvyS6|8Ip^~`z2J)%f%S6S
zF9v)mBQO+fk}<##i$I&rNye}BguqbFCi~O|m^gr|3xTOZ>X7hsnR<~ud9MGK3bMk3
zFWdvBN;lmn6}XHK7zrkn5N#X+q|H9KbAuKBy=a2jUXXrq0!2rjK=%b<S0Q63=#Ce-
zyZu^;2dv51-T@HS<pIm$M|{ENHE^)xh}C^49X9gj6-)(bDfp@~V5&zJdzJ;7AqlR=
z3>XR4Qa?E2p)G|-s9#G~fRV;*_KdW%fCU)HPtN#NFQ8GrbrDn}*cGhNuNnElKsOxr
z474*pKOB(6%qj#3W=gQ@CJ^HBgavMNBXrse(9UVfSiK9>bk8(zjvVkUg!umOJI4BZ
zzCScOEm#EDO?QL%H5opvRUm_E!TumX`=DT+19zsO)&aZ1_`p{3YXW^34;8?J<Gj~K
z*_pC;M>>5l9@0>YLq8A<-mKXG#Wca(yn^w5%^MHKD|Y!?Ja86yIJVd<t=9nC`qLMi
z65iOng4rNW2tGYLn9b7lZ`poH77qvbGf@1=`5V7=Nf1Ez4DDdRP`AGZ+>x&x5ub^7
z!mfPqNzcK2J??+Y_j3}rmAe-apOjGIZ~1=BE)M3y_WVbDzq3KV+r5$R0iQbIn)F*l
zNE5^7*ajos^ZHka+ZneJi5UIp=5Gmq&5aEvyzc#v2%(YGzs%G9E+4)Nkx)MI)^7oS
zO&SdbB=z}wz#S>1!3z4NkR?NWV0;_AtKMzggkMOA`0f=DL1fzQ!{_$KAbgHzuugIN
z#rWAt;W9ph6@tyZ-dUymwh1A<06vQ|7){=9p9*co@xbMDMg*7Zow_R=e2!)?9Jc@d
z;SgqQMuaC4d3#qp_~gi7JobRUz=KPbjED;}H4VxIGr!%e9zGz`3OF|X=ljr**&?vn
z|I2w^*nMFWHrV%_qda`RTChIP_RVqOx7lkEDV6y>{g0J`KV=^ivR9?H)5d{GVA}kb
zR`5A%!CFoJ1<9`&Y{6_WA7MO^fk35g_XVF$56m`oZT~85vHf&qzl=gKykhU{9e4-P
UfJruz5Ad%hka^zwI^^5`0C;tDe*gdg

literal 0
HcmV?d00001

diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
new file mode 100644
index 000000000000..483c5cc56065
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
@@ -0,0 +1,10 @@
+package org.springframework.boot;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+import org.springframework.context.annotation.Configuration;
+
+@Target(ElementType.TYPE)
+@Configuration
+public @interface SpringBootConfiguration {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
new file mode 100644
index 000000000000..38bbc35733e9
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
@@ -0,0 +1,12 @@
+package org.springframework.boot.autoconfigure;
+
+import java.lang.annotation.Target;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+
+import org.springframework.boot.SpringBootConfiguration;
+
+@Target(ElementType.TYPE)
+@Inherited
+@SpringBootConfiguration
+public @interface SpringBootApplication {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
new file mode 100644
index 000000000000..24d7be0f8174
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
@@ -0,0 +1,10 @@
+package org.springframework.context.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE})
+public @interface Bean {
+
+	String[] name() default {};
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java
new file mode 100644
index 000000000000..0024b3ba8338
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java
@@ -0,0 +1,7 @@
+package org.springframework.context.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+@Target(ElementType.TYPE)
+public @interface Configuration {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/core/annotation/AliasFor.java
similarity index 100%
rename from java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java
rename to java/ql/test/stubs/springframework-5.2.3/org/springframework/core/annotation/AliasFor.java
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
new file mode 100644
index 000000000000..5eb56c0897b2
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
@@ -0,0 +1,8 @@
+package org.springframework.remoting.httpinvoker;
+
+public class HttpInvokerServiceExporter extends org.springframework.remoting.rmi.RemoteInvocationSerializingExporter {
+
+    public void setService(Object service) {}
+
+    public void setServiceInterface(Class clazz) {}
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
new file mode 100644
index 000000000000..5449b83ba865
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
@@ -0,0 +1,3 @@
+package org.springframework.remoting.rmi;
+
+public abstract class RemoteInvocationSerializingExporter {}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
index 0bfb67d99c18..a4a49fffb90a 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
@@ -1,9 +1,15 @@
 package org.springframework.stereotype;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
 
-@Target(value=ElementType.TYPE)
-@Retention(value=RetentionPolicy.RUNTIME)
+@Target({ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
 @Documented
 @Component
-public @interface Controller { }
+public @interface Controller {
+    String value() default "";
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
new file mode 100644
index 000000000000..a5a51786d209
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
@@ -0,0 +1,202 @@
+package org.springframework.util;
+
+import java.lang.reflect.Array;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Map;
+import java.util.Optional;
+import java.util.StringJoiner;
+import org.springframework.lang.Nullable;
+
+public abstract class ObjectUtils {
+
+    private static final int INITIAL_HASH = 7;
+    private static final int MULTIPLIER = 31;
+    private static final String EMPTY_STRING = "";
+    private static final String NULL_STRING = "null";
+    private static final String ARRAY_START = "{";
+    private static final String ARRAY_END = "}";
+    private static final String EMPTY_ARRAY = "{}";
+    private static final String ARRAY_ELEMENT_SEPARATOR = ", ";
+    private static final Object[] EMPTY_OBJECT_ARRAY = new Object[0];
+
+    public ObjectUtils() {
+    }
+
+    public static boolean isCheckedException(Throwable ex) {
+        return false;
+    }
+
+    public static boolean isCompatibleWithThrowsClause(Throwable ex, @Nullable Class<?>... declaredExceptions) {
+        return false;
+    }
+
+    public static boolean isArray(@Nullable Object obj) {
+        return false;
+    }
+
+    public static boolean isEmpty(@Nullable Object[] array) {
+        return false;
+    }
+
+    public static boolean isEmpty(@Nullable Object obj) {
+        return false;
+    }
+
+    @Nullable
+    public static Object unwrapOptional(@Nullable Object obj) {
+        return null;
+    }
+
+    public static boolean containsElement(@Nullable Object[] array, Object element) {
+        return true;
+    }
+
+    public static boolean containsConstant(Enum<?>[] enumValues, String constant) {
+        return true;
+    }
+
+    public static boolean containsConstant(Enum<?>[] enumValues, String constant, boolean caseSensitive) {  
+        return true;
+    }
+
+    public static <E extends Enum<?>> E caseInsensitiveValueOf(E[] enumValues, String constant) {
+        return null;
+    }
+
+    public static <A, O extends A> A[] addObjectToArray(@Nullable A[] array, @Nullable O obj) {
+        return null;
+    }
+
+    public static Object[] toObjectArray(@Nullable Object source) {
+        return null;
+    }
+
+    public static boolean nullSafeEquals(@Nullable Object o1, @Nullable Object o2) {
+        return false;
+    }
+
+    private static boolean arrayEquals(Object o1, Object o2) {
+        return false;
+    }
+
+    public static int nullSafeHashCode(@Nullable Object obj) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable Object[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable boolean[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable byte[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable char[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable double[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable float[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable int[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable long[] array) {
+        return 1;
+    }
+
+    public static int nullSafeHashCode(@Nullable short[] array) {
+        return 1;
+    }
+
+    /** @deprecated */
+    @Deprecated
+    public static int hashCode(boolean bool) {
+        return 1;
+    }
+
+    /** @deprecated */
+    @Deprecated
+    public static int hashCode(double dbl) {
+        return 1;
+    }
+
+    /** @deprecated */
+    @Deprecated
+    public static int hashCode(float flt) {
+        return 1;
+    }
+
+    /** @deprecated */
+    @Deprecated
+    public static int hashCode(long lng) {
+        return 1;
+    }
+
+    public static String identityToString(@Nullable Object obj) {
+        return "";
+    }
+
+    public static String getIdentityHexString(Object obj) {
+        return "";
+    }
+
+    public static String getDisplayString(@Nullable Object obj) {
+        return "";
+    }
+
+    public static String nullSafeClassName(@Nullable Object obj) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable Object obj) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable Object[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable boolean[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable byte[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable char[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable double[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable float[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable int[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable long[] array) {
+        return "";
+    }
+
+    public static String nullSafeToString(@Nullable short[] array) {
+        return "";
+    }
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java
new file mode 100644
index 000000000000..a78d47e44c6a
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java
@@ -0,0 +1,30 @@
+package org.springframework.util;
+
+import java.io.ByteArrayOutputStream;
+import java.nio.charset.Charset;
+import java.util.ArrayDeque;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Deque;
+import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Properties;
+import java.util.Set;
+import java.util.StringJoiner;
+import java.util.StringTokenizer;
+import java.util.TimeZone;
+import org.springframework.lang.Nullable;
+
+public abstract class StringUtils {
+  
+    @Deprecated
+    public static boolean isEmpty(@Nullable Object str) {
+        return true;
+    }
+
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/GetMapping.java
similarity index 100%
rename from java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java
rename to java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/GetMapping.java
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/Mapping.java
similarity index 100%
rename from java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/Mapping.java
rename to java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/Mapping.java
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
index 73ff8d1b03af..093065ca5f16 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
@@ -1,11 +1,32 @@
 package org.springframework.web.bind.annotation;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
 
 @Target(value={ElementType.METHOD,ElementType.TYPE})
 @Retention(value=RetentionPolicy.RUNTIME)
 @Documented
+@Mapping
 public @interface RequestMapping {
+    String name() default "";
+
+    @AliasFor("path")
+    String[] value() default {};
+
+    @AliasFor("value")
+    String[] path() default {};
 
     RequestMethod[] method() default {};
+
+    String[] params() default {};
+
+    String[] headers() default {};
+
+    String[] consumes() default {};
+
+    String[] produces() default {};
 }
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
index 5ae52ad123fa..56094811c376 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
@@ -1,8 +1,23 @@
 package org.springframework.web.bind.annotation;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
 
-@Target(value=ElementType.PARAMETER)
-@Retention(value=RetentionPolicy.RUNTIME)
+@Target({ElementType.PARAMETER})
+@Retention(RetentionPolicy.RUNTIME)
 @Documented
-public @interface RequestParam { }
+public @interface RequestParam {
+    @AliasFor("name")
+    String value() default "";
+
+    @AliasFor("value")
+    String name() default "";
+
+    boolean required() default true;
+
+    String defaultValue() default "\n\t\t\n\t\t\n\ue000\ue001\ue002\n\t\t\t\t\n";
+}
diff --git a/java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/ResponseBody.java
similarity index 100%
rename from java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java
rename to java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/ResponseBody.java

From bd3b3178ba2a914567d831518490967676bfb0b0 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Thu, 15 Apr 2021 09:16:51 +0100
Subject: [PATCH 272/433] Fix documentation of Modifier.qll

---
 java/ql/src/semmle/code/java/Modifier.qll | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/Modifier.qll b/java/ql/src/semmle/code/java/Modifier.qll
index 7fb9f9826163..39cbe5a3c294 100755
--- a/java/ql/src/semmle/code/java/Modifier.qll
+++ b/java/ql/src/semmle/code/java/Modifier.qll
@@ -18,7 +18,9 @@ abstract class Modifiable extends Element {
    * Holds if this element has modifier `m`.
    *
    * For most purposes, the more specialized predicates `isAbstract`, `isPublic`, etc.
-   * should be used, which also take implicit modifiers into account.
+   * should be used.
+   *
+   * Both this method and those specialized predicates take implicit modifiers into account.
    * For instance, non-default instance methods in interfaces are implicitly
    * abstract, so `isAbstract()` will hold for them even if `hasModifier("abstract")`
    * does not.

From b4a2a9db255d64b1aa1da203e78326768b1153d5 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 15 Apr 2021 09:23:45 +0100
Subject: [PATCH 273/433] JS: Fix extraction of non-substitution template
 literal types

---
 .../ts/extractor/TypeScriptASTConverter.java      | 15 +++++++++------
 .../TemplateTypes/TemplateTypes.expected          |  6 ++++++
 .../TemplateTypes/TemplateTypes.ql                |  3 +++
 .../RegressionTests/TemplateTypes/tsconfig.json   |  3 +++
 .../RegressionTests/TemplateTypes/tst.ts          |  7 +++++++
 5 files changed, 28 insertions(+), 6 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected
 create mode 100644 javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql
 create mode 100644 javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json
 create mode 100644 javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts

diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
index 36d4f8886187..f8ad99915c90 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
@@ -5,7 +5,6 @@
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
@@ -1001,10 +1000,10 @@ private Node convertConditionalExpression(JsonObject node, SourceLocation loc) t
   private Node convertConditionalType(JsonObject node, SourceLocation loc) throws ParseError {
     return new ConditionalTypeExpr(
         loc,
-        convertChild(node, "checkType"),
-        convertChild(node, "extendsType"),
-        convertChild(node, "trueType"),
-        convertChild(node, "falseType"));
+        convertChildAsType(node, "checkType"),
+        convertChildAsType(node, "extendsType"),
+        convertChildAsType(node, "trueType"),
+        convertChildAsType(node, "falseType"));
   }
 
   private SourceLocation getSourceRange(Position from, Position to) {
@@ -1613,6 +1612,10 @@ private Node convertLiteralType(JsonObject node, SourceLocation loc) throws Pars
         literal = new Literal(loc, arg.getTokenType(), "-" + arg.getValue());
       }
     }
+    if (literal instanceof TemplateLiteral) {
+      // A LiteralType containing a NoSubstitutionTemplateLiteral must produce a TemplateLiteralTypeExpr
+      return new TemplateLiteralTypeExpr(literal.getLoc(), new ArrayList<>(), ((TemplateLiteral)literal).getQuasis());
+    }
     return literal;
   }
 
@@ -1842,7 +1845,7 @@ private Node convertOmittedExpression() {
   }
 
   private Node convertOptionalType(JsonObject node, SourceLocation loc) throws ParseError {
-    return new OptionalTypeExpr(loc, convertChild(node, "type"));
+    return new OptionalTypeExpr(loc, convertChildAsType(node, "type"));
   }
 
   private ITypeExpression asType(Node node) {
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected
new file mode 100644
index 000000000000..e713b3e48049
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected
@@ -0,0 +1,6 @@
+| tst.ts:2:11:2:21 | `foo ${T1}` |
+| tst.ts:4:45:4:49 | `foo` |
+| tst.ts:4:53:4:57 | `bar` |
+| tst.ts:5:46:5:50 | `foo` |
+| tst.ts:5:54:5:63 | `bar ${K}` |
+| tst.ts:7:15:7:19 | `foo` |
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql
new file mode 100644
index 000000000000..f08f5a201dda
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql
@@ -0,0 +1,3 @@
+import javascript
+
+query TemplateLiteralTypeExpr literalType() { any() }
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json
new file mode 100644
index 000000000000..82194fc7ab06
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json
@@ -0,0 +1,3 @@
+{
+    "include": ["."]
+}
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts
new file mode 100644
index 000000000000..21718ea3b340
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts
@@ -0,0 +1,7 @@
+type T1 = 'foo' | 'bar';
+type T2 = `foo ${T1}`;
+
+type FooToBar<K extends string> = K extends `foo` ? `bar` : K;
+type FooToBar2<K extends string> = K extends `foo` ? `bar ${K}` : K;
+
+type Tuple = [`foo`?];

From cb736c8c82b0a8f91e18e9dfd2b3a16f3b5194a2 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 15 Apr 2021 09:37:57 +0100
Subject: [PATCH 274/433] JS: Change note

---
 .../2021-04-15-typescript-template-literal-type-crash.md       | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md

diff --git a/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md b/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md
new file mode 100644
index 000000000000..e08dbd54dd69
--- /dev/null
+++ b/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Fixed a bug that could cause extraction to fail when extracting a TypeScript
+  code base containing a template literal type without substitutions.

From f8570bb293b257444413398aa073ee263203afd3 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 15 Apr 2021 10:16:46 +0100
Subject: [PATCH 275/433] JS: Update TRAP

---
 .../ts/output/trap/importNonStrings.ts.trap   | 269 ++++++++++++++++--
 1 file changed, 242 insertions(+), 27 deletions(-)

diff --git a/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap b/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
index c5fc95ddcb86..af044be98c89 100644
--- a/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
+++ b/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
@@ -9,34 +9,249 @@ hasLocation(#10000,#10002)
 #20000=@"global_scope"
 scopes(#20000,0)
 #20001=@"script;{#10000},1,1"
-toplevels(#20001,0)
-#20002=@"loc,{#10000},1,1,1,1"
-locations_default(#20002,#10000,1,1,1,1)
-hasLocation(#20001,#20002)
-#20003=*
-js_parse_errors(#20003,#20001,"Error: Unsupported syntax in import","type Y = import(`Foo`);
-")
-#20004=@"loc,{#10000},2,10,2,10"
-locations_default(#20004,#10000,2,10,2,10)
-hasLocation(#20003,#20004)
-#20005=*
-lines(#20005,#20001,"type X = import(3);","
+#20002=*
+lines(#20002,#20001,"type X = import(3);","
 ")
-#20006=@"loc,{#10000},1,1,1,19"
-locations_default(#20006,#10000,1,1,1,19)
-hasLocation(#20005,#20006)
-#20007=*
-lines(#20007,#20001,"type Y = import(`Foo`);","
+#20003=@"loc,{#10000},1,1,1,19"
+locations_default(#20003,#10000,1,1,1,19)
+hasLocation(#20002,#20003)
+#20004=*
+lines(#20004,#20001,"type Y = import(`Foo`);","
 ")
-#20008=@"loc,{#10000},2,1,2,23"
-locations_default(#20008,#10000,2,1,2,23)
-hasLocation(#20007,#20008)
-#20009=*
-lines(#20009,#20001,"type Z = import(Y);","
+#20005=@"loc,{#10000},2,1,2,23"
+locations_default(#20005,#10000,2,1,2,23)
+hasLocation(#20004,#20005)
+#20006=*
+lines(#20006,#20001,"type Z = import(Y);","
 ")
-#20010=@"loc,{#10000},3,1,3,19"
-locations_default(#20010,#10000,3,1,3,19)
-hasLocation(#20009,#20010)
-numlines(#20001,3,0,0)
-numlines(#10000,3,0,0)
+#20007=@"loc,{#10000},3,1,3,19"
+locations_default(#20007,#10000,3,1,3,19)
+hasLocation(#20006,#20007)
+numlines(#20001,3,3,0)
+#20008=*
+tokeninfo(#20008,7,#20001,0,"type")
+#20009=@"loc,{#10000},1,1,1,4"
+locations_default(#20009,#10000,1,1,1,4)
+hasLocation(#20008,#20009)
+#20010=*
+tokeninfo(#20010,6,#20001,1,"X")
+#20011=@"loc,{#10000},1,6,1,6"
+locations_default(#20011,#10000,1,6,1,6)
+hasLocation(#20010,#20011)
+#20012=*
+tokeninfo(#20012,8,#20001,2,"=")
+#20013=@"loc,{#10000},1,8,1,8"
+locations_default(#20013,#10000,1,8,1,8)
+hasLocation(#20012,#20013)
+#20014=*
+tokeninfo(#20014,7,#20001,3,"import")
+#20015=@"loc,{#10000},1,10,1,15"
+locations_default(#20015,#10000,1,10,1,15)
+hasLocation(#20014,#20015)
+#20016=*
+tokeninfo(#20016,8,#20001,4,"(")
+#20017=@"loc,{#10000},1,16,1,16"
+locations_default(#20017,#10000,1,16,1,16)
+hasLocation(#20016,#20017)
+#20018=*
+tokeninfo(#20018,3,#20001,5,"3")
+#20019=@"loc,{#10000},1,17,1,17"
+locations_default(#20019,#10000,1,17,1,17)
+hasLocation(#20018,#20019)
+#20020=*
+tokeninfo(#20020,8,#20001,6,")")
+#20021=@"loc,{#10000},1,18,1,18"
+locations_default(#20021,#10000,1,18,1,18)
+hasLocation(#20020,#20021)
+#20022=*
+tokeninfo(#20022,8,#20001,7,";")
+#20023=@"loc,{#10000},1,19,1,19"
+locations_default(#20023,#10000,1,19,1,19)
+hasLocation(#20022,#20023)
+#20024=*
+tokeninfo(#20024,7,#20001,8,"type")
+#20025=@"loc,{#10000},2,1,2,4"
+locations_default(#20025,#10000,2,1,2,4)
+hasLocation(#20024,#20025)
+#20026=*
+tokeninfo(#20026,6,#20001,9,"Y")
+#20027=@"loc,{#10000},2,6,2,6"
+locations_default(#20027,#10000,2,6,2,6)
+hasLocation(#20026,#20027)
+#20028=*
+tokeninfo(#20028,8,#20001,10,"=")
+#20029=@"loc,{#10000},2,8,2,8"
+locations_default(#20029,#10000,2,8,2,8)
+hasLocation(#20028,#20029)
+#20030=*
+tokeninfo(#20030,7,#20001,11,"import")
+#20031=@"loc,{#10000},2,10,2,15"
+locations_default(#20031,#10000,2,10,2,15)
+hasLocation(#20030,#20031)
+#20032=*
+tokeninfo(#20032,8,#20001,12,"(")
+#20033=@"loc,{#10000},2,16,2,16"
+locations_default(#20033,#10000,2,16,2,16)
+hasLocation(#20032,#20033)
+#20034=*
+tokeninfo(#20034,4,#20001,13,"`Foo`")
+#20035=@"loc,{#10000},2,17,2,21"
+locations_default(#20035,#10000,2,17,2,21)
+hasLocation(#20034,#20035)
+#20036=*
+tokeninfo(#20036,8,#20001,14,")")
+#20037=@"loc,{#10000},2,22,2,22"
+locations_default(#20037,#10000,2,22,2,22)
+hasLocation(#20036,#20037)
+#20038=*
+tokeninfo(#20038,8,#20001,15,";")
+#20039=@"loc,{#10000},2,23,2,23"
+locations_default(#20039,#10000,2,23,2,23)
+hasLocation(#20038,#20039)
+#20040=*
+tokeninfo(#20040,7,#20001,16,"type")
+#20041=@"loc,{#10000},3,1,3,4"
+locations_default(#20041,#10000,3,1,3,4)
+hasLocation(#20040,#20041)
+#20042=*
+tokeninfo(#20042,6,#20001,17,"Z")
+#20043=@"loc,{#10000},3,6,3,6"
+locations_default(#20043,#10000,3,6,3,6)
+hasLocation(#20042,#20043)
+#20044=*
+tokeninfo(#20044,8,#20001,18,"=")
+#20045=@"loc,{#10000},3,8,3,8"
+locations_default(#20045,#10000,3,8,3,8)
+hasLocation(#20044,#20045)
+#20046=*
+tokeninfo(#20046,7,#20001,19,"import")
+#20047=@"loc,{#10000},3,10,3,15"
+locations_default(#20047,#10000,3,10,3,15)
+hasLocation(#20046,#20047)
+#20048=*
+tokeninfo(#20048,8,#20001,20,"(")
+#20049=@"loc,{#10000},3,16,3,16"
+locations_default(#20049,#10000,3,16,3,16)
+hasLocation(#20048,#20049)
+#20050=*
+tokeninfo(#20050,6,#20001,21,"Y")
+#20051=@"loc,{#10000},3,17,3,17"
+locations_default(#20051,#10000,3,17,3,17)
+hasLocation(#20050,#20051)
+#20052=*
+tokeninfo(#20052,8,#20001,22,")")
+#20053=@"loc,{#10000},3,18,3,18"
+locations_default(#20053,#10000,3,18,3,18)
+hasLocation(#20052,#20053)
+#20054=*
+tokeninfo(#20054,8,#20001,23,";")
+#20055=@"loc,{#10000},3,19,3,19"
+locations_default(#20055,#10000,3,19,3,19)
+hasLocation(#20054,#20055)
+#20056=*
+tokeninfo(#20056,0,#20001,24,"")
+#20057=@"loc,{#10000},4,1,4,0"
+locations_default(#20057,#10000,4,1,4,0)
+hasLocation(#20056,#20057)
+toplevels(#20001,0)
+#20058=@"loc,{#10000},1,1,4,0"
+locations_default(#20058,#10000,1,1,4,0)
+hasLocation(#20001,#20058)
+#20059=@"local_type_name;{X};{#20000}"
+local_type_names(#20059,"X",#20000)
+#20060=@"local_type_name;{Y};{#20000}"
+local_type_names(#20060,"Y",#20000)
+#20061=@"local_type_name;{Z};{#20000}"
+local_type_names(#20061,"Z",#20000)
+#20062=*
+stmts(#20062,35,#20001,0,"type X = import(3);")
+hasLocation(#20062,#20003)
+stmt_containers(#20062,#20001)
+#20063=*
+typeexprs(#20063,1,#20062,0,"X")
+hasLocation(#20063,#20011)
+enclosing_stmt(#20063,#20062)
+expr_containers(#20063,#20001)
+literals("X","X",#20063)
+typedecl(#20063,#20059)
+#20064=*
+typeexprs(#20064,30,#20062,1,"import(3)")
+#20065=@"loc,{#10000},1,10,1,18"
+locations_default(#20065,#10000,1,10,1,18)
+hasLocation(#20064,#20065)
+enclosing_stmt(#20064,#20062)
+expr_containers(#20064,#20001)
+#20066=*
+typeexprs(#20066,4,#20064,0,"3")
+hasLocation(#20066,#20019)
+enclosing_stmt(#20066,#20062)
+expr_containers(#20066,#20001)
+literals("3","3",#20066)
+#20067=*
+stmts(#20067,35,#20001,1,"type Y  ... `Foo`);")
+hasLocation(#20067,#20005)
+stmt_containers(#20067,#20001)
+#20068=*
+typeexprs(#20068,1,#20067,0,"Y")
+hasLocation(#20068,#20027)
+enclosing_stmt(#20068,#20067)
+expr_containers(#20068,#20001)
+literals("Y","Y",#20068)
+typedecl(#20068,#20060)
+#20069=*
+typeexprs(#20069,30,#20067,1,"import(`Foo`)")
+#20070=@"loc,{#10000},2,10,2,22"
+locations_default(#20070,#10000,2,10,2,22)
+hasLocation(#20069,#20070)
+enclosing_stmt(#20069,#20067)
+expr_containers(#20069,#20001)
+#20071=*
+typeexprs(#20071,37,#20069,0,"`Foo`")
+hasLocation(#20071,#20035)
+enclosing_stmt(#20071,#20067)
+expr_containers(#20071,#20001)
+#20072=*
+typeexprs(#20072,3,#20071,0,"`Foo`")
+hasLocation(#20072,#20035)
+enclosing_stmt(#20072,#20067)
+expr_containers(#20072,#20001)
+literals("Foo","Foo",#20072)
+#20073=*
+stmts(#20073,35,#20001,2,"type Z = import(Y);")
+hasLocation(#20073,#20007)
+stmt_containers(#20073,#20001)
+#20074=*
+typeexprs(#20074,1,#20073,0,"Z")
+hasLocation(#20074,#20043)
+enclosing_stmt(#20074,#20073)
+expr_containers(#20074,#20001)
+literals("Z","Z",#20074)
+typedecl(#20074,#20061)
+#20075=*
+typeexprs(#20075,30,#20073,1,"import(Y)")
+#20076=@"loc,{#10000},3,10,3,18"
+locations_default(#20076,#10000,3,10,3,18)
+hasLocation(#20075,#20076)
+enclosing_stmt(#20075,#20073)
+expr_containers(#20075,#20001)
+#20077=*
+typeexprs(#20077,0,#20075,0,"Y")
+hasLocation(#20077,#20051)
+enclosing_stmt(#20077,#20073)
+expr_containers(#20077,#20001)
+literals("Y","Y",#20077)
+typebind(#20077,#20060)
+#20078=*
+entry_cfg_node(#20078,#20001)
+#20079=@"loc,{#10000},1,1,1,0"
+locations_default(#20079,#10000,1,1,1,0)
+hasLocation(#20078,#20079)
+#20080=*
+exit_cfg_node(#20080,#20001)
+hasLocation(#20080,#20057)
+successor(#20073,#20080)
+successor(#20067,#20073)
+successor(#20062,#20067)
+successor(#20078,#20062)
+numlines(#10000,3,3,0)
 filetype(#10000,"typescript")

From 0f24db8759b822f8db969bf71f95e4c184e72c40 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 12 Apr 2021 14:41:28 +0200
Subject: [PATCH 276/433] C#: Improve performance of
 `SsaImpl::CallGraph::SimpleDelegateAnalysis`

---
 .../code/csharp/dataflow/internal/SsaImpl.qll | 152 ++++++++++++++----
 1 file changed, 121 insertions(+), 31 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 41da2b8f0b5d..63d6c902fed2 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -268,56 +268,146 @@ private module CallGraph {
         )
     }
 
+    /**
+     * A simple flow step that does not take flow through fields or flow out
+     * of callables into account.
+     */
+    pragma[nomagic]
     private predicate delegateFlowStep(Expr pred, Expr succ) {
       Steps::stepClosed(pred, succ)
       or
-      exists(Call call, Callable callable |
-        callable.getUnboundDeclaration().canReturn(pred) and
-        call = succ
-      |
-        callable = call.getTarget() or
-        callable = call.getTarget().(Method).getAnOverrider+() or
-        callable = call.getTarget().(Method).getAnUltimateImplementor() or
-        callable = getARuntimeDelegateTarget(call, false)
-      )
-      or
       pred = succ.(DelegateCreation).getArgument()
       or
-      exists(AssignableDefinition def, Assignable a |
-        a instanceof Field or
-        a instanceof Property
-      |
-        a = def.getTarget() and
-        succ.(AssignableRead) = a.getAnAccess() and
-        pred = def.getSource()
-      )
-      or
       exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
         pred = ae.getRValue()
       )
     }
 
-    private predicate reachesDelegateCall(Expr e) {
-      delegateCall(_, e, _)
+    private predicate delegateCreationReaches(Callable c, Expr e) {
+      delegateCreation(e, c, _)
       or
-      exists(Expr mid | reachesDelegateCall(mid) | delegateFlowStep(e, mid))
+      exists(Expr mid |
+        delegateCreationReaches(c, mid) and
+        delegateFlowStep(mid, e)
+      )
     }
 
-    pragma[nomagic]
-    private predicate delegateFlowStepReaches(Expr pred, Expr succ) {
-      delegateFlowStep(pred, succ) and
-      reachesDelegateCall(succ)
+    private predicate reachesDelegateCall(Expr e, Call c, boolean libraryDelegateCall) {
+      delegateCall(c, e, libraryDelegateCall)
+      or
+      exists(Expr mid |
+        reachesDelegateCall(mid, c, libraryDelegateCall) and
+        delegateFlowStep(e, mid)
+      )
     }
 
-    private Expr delegateCallSource(Callable c) {
-      delegateCreation(result, c, _)
-      or
-      delegateFlowStepReaches(delegateCallSource(c), result)
+    /**
+     * A "busy" flow element, that is, a node in the data-flow graph that typically
+     * has a large fan-in or a large fan-out (or both).
+     *
+     * For such busy elements, we do not track flow directly from all delegate
+     * creations, but instead we first perform a flow analysis between busy elements,
+     * and then only in the end join up with delegate creations and delegate calls.
+     */
+    abstract private class BusyFlowElement extends Element {
+      pragma[nomagic]
+      abstract Expr getAnInput();
+
+      pragma[nomagic]
+      abstract Expr getAnOutput();
+
+      /** Holds if this element can be reached from expression `e`. */
+      pragma[nomagic]
+      private predicate exprReaches(Expr e) {
+        this.reachesCall(_) and
+        e = this.getAnInput()
+        or
+        exists(Expr mid |
+          this.exprReaches(mid) and
+          delegateFlowStep(e, mid)
+        )
+      }
+
+      /**
+       * Holds if this element can reach a delegate call `c` directly without
+       * passing through another busy element.
+       */
+      pragma[nomagic]
+      predicate delegateCall(Call c, boolean libraryDelegateCall) {
+        reachesDelegateCall(this.getAnOutput(), c, libraryDelegateCall)
+      }
+
+      pragma[nomagic]
+      private BusyFlowElement getASuccessor() { result.exprReaches(this.getAnOutput()) }
+
+      /**
+       * Holds if this element reaches another busy element `other`,
+       * which can reach a delegate call directly without passing
+       * through another busy element.
+       */
+      pragma[nomagic]
+      private predicate reachesCall(BusyFlowElement other) {
+        this = other and
+        other.delegateCall(_, _)
+        or
+        this.getASuccessor().reachesCall(other)
+      }
+
+      /** Holds if this element is reached by a delegate creation for `c`. */
+      pragma[nomagic]
+      predicate isReachedBy(Callable c) {
+        exists(BusyFlowElement pred |
+          pred.reachesCall(this) and
+          delegateCreationReaches(c, pred.getAnInput())
+        )
+      }
+    }
+
+    private class TFieldOrProperty = @field or @property;
+
+    private class FieldOrPropertyFlow extends BusyFlowElement, Assignable, TFieldOrProperty {
+      final override Expr getAnInput() {
+        exists(Assignable target |
+          target = this.getUnboundDeclaration() and
+          result = target.getAnAssignedValue()
+        )
+      }
+
+      final override AssignableRead getAnOutput() {
+        exists(Assignable target |
+          target = this.getUnboundDeclaration() and
+          result = target.getAnAccess()
+        )
+      }
+    }
+
+    private class CallOutputFlow extends BusyFlowElement, Callable {
+      final override Expr getAnInput() { this.canReturn(result) }
+
+      final override Call getAnOutput() {
+        exists(Callable target | this = target.getUnboundDeclaration() |
+          target = result.getTarget() or
+          target = result.getTarget().(Method).getAnOverrider+() or
+          target = result.getTarget().(Method).getAnUltimateImplementor() or
+          target = getARuntimeDelegateTarget(result, false)
+        )
+      }
     }
 
     /** Gets a run-time target for the delegate call `c`. */
+    pragma[nomagic]
     Callable getARuntimeDelegateTarget(Call c, boolean libraryDelegateCall) {
-      delegateCall(c, delegateCallSource(result), libraryDelegateCall)
+      // directly resolvable without going through a "busy" element
+      exists(Expr e |
+        delegateCreationReaches(result, e) and
+        delegateCall(c, e, libraryDelegateCall)
+      )
+      or
+      // resolvable by going through one or more "busy" elements
+      exists(BusyFlowElement busy |
+        busy.isReachedBy(result) and
+        busy.delegateCall(c, libraryDelegateCall)
+      )
     }
   }
 

From 5d05e4d22413e5e78b0e1834fddf73deaa3c8016 Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Thu, 15 Apr 2021 17:28:53 +0800
Subject: [PATCH 277/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 8220745e6672..07ed446dcdf9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -21,7 +21,7 @@ abstract class RequestGetMethod extends Method {
 
 /** Override method of `doGet` of `Servlet` subclass. */
 private class ServletGetMethod extends RequestGetMethod {
-  ServletGetMethod() { this instanceof DoGetServletMethod }
+  ServletGetMethod() { isServletRequestMethod(this) and m.getName() = "doGet" }
 }
 
 /** The method of SpringController class processing `get` request. */

From 583d0889e257be00ee2d60b15d0a3ac401fbb644 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 15 Apr 2021 17:40:51 +0800
Subject: [PATCH 278/433] delete tomcat-embed-core stub, update the
 ServletGetMethod class

---
 .../CWE/CWE-352/JsonpInjectionLib.qll         |   2 +-
 .../semmle/code/java/frameworks/Servlets.qll  |  10 --
 .../javax/servlet/Filter.java                 |  13 --
 .../javax/servlet/FilterChain.java            |   8 --
 .../javax/servlet/FilterConfig.java           |   3 -
 .../javax/servlet/ServletException.java       |   8 --
 .../javax/servlet/ServletRequest.java         |  87 -------------
 .../javax/servlet/ServletResponse.java        |  39 ------
 .../javax/servlet/annotation/WebServlet.java  |  30 -----
 .../servlet/http/HttpServletRequest.java      | 116 ------------------
 .../servlet/http/HttpServletResponse.java     | 106 ----------------
 11 files changed, 1 insertion(+), 421 deletions(-)
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
 delete mode 100644 java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 07ed446dcdf9..8c7433fd1b69 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -21,7 +21,7 @@ abstract class RequestGetMethod extends Method {
 
 /** Override method of `doGet` of `Servlet` subclass. */
 private class ServletGetMethod extends RequestGetMethod {
-  ServletGetMethod() { isServletRequestMethod(this) and m.getName() = "doGet" }
+  ServletGetMethod() { isServletRequestMethod(this) and this.getName() = "doGet" }
 }
 
 /** The method of SpringController class processing `get` request. */
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index c733023bbdce..08d5a80dd81b 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -361,13 +361,3 @@ predicate isDoFilterMethod(Method m) {
   m.getParameter(1).getType() instanceof ServletResponse and
   m.getParameter(2).getType() instanceof FilterChain
 }
-
-/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
-predicate isGetServletMethod(Method m) {
-  isServletRequestMethod(m) and m.getName() = "doGet"
-}
-
-/** The `doGet` method of `HttpServlet`. */
-class DoGetServletMethod extends Method {
-  DoGetServletMethod() { isGetServletMethod(this) }
-}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
deleted file mode 100644
index 5833e3c909da..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/Filter.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package javax.servlet;
-
-import java.io.IOException;
-
-public interface Filter {
-    default void init(FilterConfig filterConfig) throws ServletException {
-    }
-
-    void doFilter(ServletRequest var1, ServletResponse var2, FilterChain var3) throws IOException, ServletException;
-
-    default void destroy() {
-    }
-}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
deleted file mode 100644
index 6a1dfc588b6a..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterChain.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package javax.servlet;
-
-import java.io.IOException;
-
-public interface FilterChain {
-    void doFilter(ServletRequest var1, ServletResponse var2) throws IOException, ServletException;
-}
-
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
deleted file mode 100644
index 66c13eb54f0b..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/FilterConfig.java
+++ /dev/null
@@ -1,3 +0,0 @@
-package javax.servlet;
-
-public interface FilterConfig {}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
deleted file mode 100644
index ce5f7c4465ae..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletException.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package javax.servlet;
-
-public class ServletException extends Exception {
-    private static final long serialVersionUID = 1L;
-
-    public ServletException() {
-    }
-}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
deleted file mode 100644
index 4ee0026d0668..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletRequest.java
+++ /dev/null
@@ -1,87 +0,0 @@
-package javax.servlet;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.util.Enumeration;
-import java.util.Locale;
-import java.util.Map;
-
-public interface ServletRequest {
-    Object getAttribute(String var1);
-
-    Enumeration<String> getAttributeNames();
-
-    String getCharacterEncoding();
-
-    void setCharacterEncoding(String var1) throws UnsupportedEncodingException;
-
-    int getContentLength();
-
-    long getContentLengthLong();
-
-    String getContentType();
-
-    ServletInputStream getInputStream() throws IOException;
-
-    String getParameter(String var1);
-
-    Enumeration<String> getParameterNames();
-
-    String[] getParameterValues(String var1);
-
-    Map<String, String[]> getParameterMap();
-
-    String getProtocol();
-
-    String getScheme();
-
-    String getServerName();
-
-    int getServerPort();
-
-    BufferedReader getReader() throws IOException;
-
-    String getRemoteAddr();
-
-    String getRemoteHost();
-
-    void setAttribute(String var1, Object var2);
-
-    void removeAttribute(String var1);
-
-    Locale getLocale();
-
-    Enumeration<Locale> getLocales();
-
-    boolean isSecure();
-
-    RequestDispatcher getRequestDispatcher(String var1);
-
-    /** @deprecated */
-    @Deprecated
-    String getRealPath(String var1);
-
-    int getRemotePort();
-
-    String getLocalName();
-
-    String getLocalAddr();
-
-    int getLocalPort();
-
-    ServletContext getServletContext();
-
-    AsyncContext startAsync() throws IllegalStateException;
-
-    AsyncContext startAsync(ServletRequest var1, ServletResponse var2) throws IllegalStateException;
-
-    boolean isAsyncStarted();
-
-    boolean isAsyncSupported();
-
-    AsyncContext getAsyncContext();
-
-    DispatcherType getDispatcherType();
-}
-
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
deleted file mode 100644
index 0aa6121e686d..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/ServletResponse.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package javax.servlet;
-
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.Locale;
-
-public interface ServletResponse {
-    String getCharacterEncoding();
-
-    String getContentType();
-
-    ServletOutputStream getOutputStream() throws IOException;
-
-    PrintWriter getWriter() throws IOException;
-
-    void setCharacterEncoding(String var1);
-
-    void setContentLength(int var1);
-
-    void setContentLengthLong(long var1);
-
-    void setContentType(String var1);
-
-    void setBufferSize(int var1);
-
-    int getBufferSize();
-
-    void flushBuffer() throws IOException;
-
-    void resetBuffer();
-
-    boolean isCommitted();
-
-    void reset();
-
-    void setLocale(Locale var1);
-
-    Locale getLocale();
-}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java
deleted file mode 100644
index cc255efc00ff..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/annotation/WebServlet.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package javax.servlet.annotation;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-@Target({ElementType.TYPE})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface WebServlet {
-    String name() default "";
-
-    String[] value() default {};
-
-    String[] urlPatterns() default {};
-
-    int loadOnStartup() default -1;
-
-    boolean asyncSupported() default false;
-
-    String smallIcon() default "";
-
-    String largeIcon() default "";
-
-    String description() default "";
-
-    String displayName() default "";
-}
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
deleted file mode 100644
index 02d53a96a333..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletRequest.java
+++ /dev/null
@@ -1,116 +0,0 @@
-package javax.servlet.http;
-
-import java.io.IOException;
-import java.security.Principal;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.Map;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-
-public interface HttpServletRequest extends ServletRequest {
-    String BASIC_AUTH = "BASIC";
-    String FORM_AUTH = "FORM";
-    String CLIENT_CERT_AUTH = "CLIENT_CERT";
-    String DIGEST_AUTH = "DIGEST";
-
-    String getAuthType();
-
-    Cookie[] getCookies();
-
-    long getDateHeader(String var1);
-
-    String getHeader(String var1);
-
-    Enumeration<String> getHeaders(String var1);
-
-    Enumeration<String> getHeaderNames();
-
-    int getIntHeader(String var1);
-
-    default HttpServletMapping getHttpServletMapping() {
-        return new HttpServletMapping() {
-            public String getMatchValue() {
-                return "";
-            }
-
-            public String getPattern() {
-                return "";
-            }
-
-            public String getServletName() {
-                return "";
-            }
-
-            public MappingMatch getMappingMatch() {
-                return null;
-            }
-        };
-    }
-
-    String getMethod();
-
-    String getPathInfo();
-
-    String getPathTranslated();
-
-    default PushBuilder newPushBuilder() {
-        return null;
-    }
-
-    String getContextPath();
-
-    String getQueryString();
-
-    String getRemoteUser();
-
-    boolean isUserInRole(String var1);
-
-    Principal getUserPrincipal();
-
-    String getRequestedSessionId();
-
-    String getRequestURI();
-
-    StringBuffer getRequestURL();
-
-    String getServletPath();
-
-    HttpSession getSession(boolean var1);
-
-    HttpSession getSession();
-
-    String changeSessionId();
-
-    boolean isRequestedSessionIdValid();
-
-    boolean isRequestedSessionIdFromCookie();
-
-    boolean isRequestedSessionIdFromURL();
-
-    /** @deprecated */
-    @Deprecated
-    boolean isRequestedSessionIdFromUrl();
-
-    boolean authenticate(HttpServletResponse var1) throws IOException, ServletException;
-
-    void login(String var1, String var2) throws ServletException;
-
-    void logout() throws ServletException;
-
-    Collection<Part> getParts() throws IOException, ServletException;
-
-    Part getPart(String var1) throws IOException, ServletException;
-
-    <T extends HttpUpgradeHandler> T upgrade(Class<T> var1) throws IOException, ServletException;
-
-    default Map<String, String> getTrailerFields() {
-        return Collections.emptyMap();
-    }
-
-    default boolean isTrailerFieldsReady() {
-        return false;
-    }
-}
-
diff --git a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java b/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java
deleted file mode 100644
index 0a2c6af0913c..000000000000
--- a/java/ql/test/stubs/tomcat-embed-core-9.0.41/javax/servlet/http/HttpServletResponse.java
+++ /dev/null
@@ -1,106 +0,0 @@
-package javax.servlet.http;
-
-import java.io.IOException;
-import java.util.Collection;
-import java.util.Map;
-import java.util.function.Supplier;
-import javax.servlet.ServletResponse;
-
-public interface HttpServletResponse extends ServletResponse {
-    int SC_CONTINUE = 100;
-    int SC_SWITCHING_PROTOCOLS = 101;
-    int SC_OK = 200;
-    int SC_CREATED = 201;
-    int SC_ACCEPTED = 202;
-    int SC_NON_AUTHORITATIVE_INFORMATION = 203;
-    int SC_NO_CONTENT = 204;
-    int SC_RESET_CONTENT = 205;
-    int SC_PARTIAL_CONTENT = 206;
-    int SC_MULTIPLE_CHOICES = 300;
-    int SC_MOVED_PERMANENTLY = 301;
-    int SC_MOVED_TEMPORARILY = 302;
-    int SC_FOUND = 302;
-    int SC_SEE_OTHER = 303;
-    int SC_NOT_MODIFIED = 304;
-    int SC_USE_PROXY = 305;
-    int SC_TEMPORARY_REDIRECT = 307;
-    int SC_BAD_REQUEST = 400;
-    int SC_UNAUTHORIZED = 401;
-    int SC_PAYMENT_REQUIRED = 402;
-    int SC_FORBIDDEN = 403;
-    int SC_NOT_FOUND = 404;
-    int SC_METHOD_NOT_ALLOWED = 405;
-    int SC_NOT_ACCEPTABLE = 406;
-    int SC_PROXY_AUTHENTICATION_REQUIRED = 407;
-    int SC_REQUEST_TIMEOUT = 408;
-    int SC_CONFLICT = 409;
-    int SC_GONE = 410;
-    int SC_LENGTH_REQUIRED = 411;
-    int SC_PRECONDITION_FAILED = 412;
-    int SC_REQUEST_ENTITY_TOO_LARGE = 413;
-    int SC_REQUEST_URI_TOO_LONG = 414;
-    int SC_UNSUPPORTED_MEDIA_TYPE = 415;
-    int SC_REQUESTED_RANGE_NOT_SATISFIABLE = 416;
-    int SC_EXPECTATION_FAILED = 417;
-    int SC_INTERNAL_SERVER_ERROR = 500;
-    int SC_NOT_IMPLEMENTED = 501;
-    int SC_BAD_GATEWAY = 502;
-    int SC_SERVICE_UNAVAILABLE = 503;
-    int SC_GATEWAY_TIMEOUT = 504;
-    int SC_HTTP_VERSION_NOT_SUPPORTED = 505;
-
-    void addCookie(Cookie var1);
-
-    boolean containsHeader(String var1);
-
-    String encodeURL(String var1);
-
-    String encodeRedirectURL(String var1);
-
-    /** @deprecated */
-    @Deprecated
-    String encodeUrl(String var1);
-
-    /** @deprecated */
-    @Deprecated
-    String encodeRedirectUrl(String var1);
-
-    void sendError(int var1, String var2) throws IOException;
-
-    void sendError(int var1) throws IOException;
-
-    void sendRedirect(String var1) throws IOException;
-
-    void setDateHeader(String var1, long var2);
-
-    void addDateHeader(String var1, long var2);
-
-    void setHeader(String var1, String var2);
-
-    void addHeader(String var1, String var2);
-
-    void setIntHeader(String var1, int var2);
-
-    void addIntHeader(String var1, int var2);
-
-    void setStatus(int var1);
-
-    /** @deprecated */
-    @Deprecated
-    void setStatus(int var1, String var2);
-
-    int getStatus();
-
-    String getHeader(String var1);
-
-    Collection<String> getHeaders(String var1);
-
-    Collection<String> getHeaderNames();
-
-    default void setTrailerFields(Supplier<Map<String, String>> supplier) {
-    }
-
-    default Supplier<Map<String, String>> getTrailerFields() {
-        return null;
-    }
-}

From 216f204438bdd65961609081c00f71ce3b2b67c0 Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 15 Apr 2021 19:28:25 +0800
Subject: [PATCH 279/433] delete FilterClass

---
 .../semmle/code/java/frameworks/Servlets.qll  |  24 ------------------
 java/ql/test/stubs/springframework-5.2.3.zip  | Bin 57066 -> 0 bytes
 2 files changed, 24 deletions(-)
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3.zip

diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index 08d5a80dd81b..1dd4373fb548 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -337,27 +337,3 @@ predicate isRequestGetParamMethod(MethodAccess ma) {
   ma.getMethod() instanceof ServletRequestGetParameterMapMethod or
   ma.getMethod() instanceof HttpServletRequestGetQueryStringMethod
 }
-
-/**
- * A class that has `javax.servlet.Filter` as an ancestor.
- */
-class FilterClass extends Class {
-  FilterClass() { getAnAncestor().hasQualifiedName("javax.servlet", "Filter") }
-}
-
-/**
- * The interface `javax.servlet.FilterChain`
- */
-class FilterChain extends Interface {
-  FilterChain() { hasQualifiedName("javax.servlet", "FilterChain") }
-}
-
-/** Holds if `m` is an implementation of `javax.servlet.Filter.doFilter`. */
-predicate isDoFilterMethod(Method m) {
-  m.getName() = "doFilter" and
-  m.getDeclaringType() instanceof FilterClass and
-  m.getNumberOfParameters() = 3 and
-  m.getParameter(0).getType() instanceof ServletRequest and
-  m.getParameter(1).getType() instanceof ServletResponse and
-  m.getParameter(2).getType() instanceof FilterChain
-}
diff --git a/java/ql/test/stubs/springframework-5.2.3.zip b/java/ql/test/stubs/springframework-5.2.3.zip
deleted file mode 100644
index b54730e4bbcd561f20961940fb62c54dcee1225f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 57066
zcmcG$1yont);>&kcT0Ckr*wCxbW68%H%NDPr*tFT9nvKrT>>Kb{m>I0zjM$3dhdN5
zW63$g!Q6X2GuE8XoNLQVfr7yRJ^k5H2vhv_AHV&D0r=@)Yj19CYGSW%W$a>O|B8;4
zo{65BK_2isXn=o(0%AzAQ`8*NqvJya0@9-e0wVgCzauRnBqFOMLhtD6xT>iYx7>j4
zbyLO9I&*LWN5^eG%{D&M-)cR}r8!~olKl-5v}Cb>AMoH@ZOWIMOjv%O*m>t7o7Ldn
z*bs+Kk3FA>-o3|4E{&4}*D|R&x9gI<uQ}-p4d}WIx)@tFwfOnCeG3e_UY9#Lp6f1;
zbK#i5@ARocC#G9gVc)fV2{(1Uc>Hiu6xpPy8@|wZcsTd)(YYPj#`?7PeoThw#CmOY
zRj1QCQWx`T_S(Y1yYcfTua^*5hi2F-l|$7V!VKLPuv@f#lCYaM(^ylKOJM}c#|f|6
zqOHgzmsLF^XXit^%LF;*IJMx(yk3GS-dYxTo?bb3od#az3MQ7KEGt+l4+(dGd>%(=
zZNHUW#Cc)nI-V$$_x@3x{!kW-#)_S*efg$`Kyw!?1Ps!N4~Fx~{qU+YR5#n<M7T4l
z9jK6-VpFd*FW3*C33yf($4)3;E&xkYIXYiWFj1IH64=DY6cig45e&HgViX7NJ@+dZ
zqKvR-aL_Na*=~;~Rc*`P$`~&5Q}IwDw5&7Zn>3->l#_6_bUR@XlWREHyIxHZ%WFha
z>uB#wy|6$WM&Eb=sUt|_IP#TV*hYk^``}hPyN53ZJl)KQ#swxL*yBO|#9uFv;|RS3
zagCxQ)@(14(=38K+dk)-taaejDLCHZr9Uh8t|Y1F`SHlQE(-UdGNT76%T)(tSsr4S
zjO?8_vbePhtSDtYi^Ip1^r2n8Wql(0@;vY6KI0RorC1pPM^-{Qii=w)uvrrEGF})E
zd-nJ4Fs@<D7Ywbtq_b>Y70R&ERUbH}xr!`y(@Sp`QfVKNHCP&^vs3fS!w}}J%psV-
zNpsAs7$U4$>>>Hwv~D2b806r(sS>CQS4aeX;rQfxzf@gY+g@=u^%a+UtXO{q&#|R$
zu@rkmSb2^${O0`<gct2iEqIBcAHVWjf~@%G+55PtFXjbd*brlAKEOcWh*=1}cf>&*
zj<ppS!xskG&n|85nX(m_fuvt2IIuloE1g!nGE6Fa=x%vKA+iai8{4ZK%s8zGv(Hxg
zoD3+9zIbjB24={AR@7Q%^lLdiy1LABASrA?2?(Z=7GLa*&62j7f(?BclLXH<?SZst
z1@NTw{J__gY2%bUPz4VH!Tz^9DhpH_U!aDJjy9PzHZ?gPfK)x?LEyJA2atVu#+M1r
zo>A7o=Wb{nOueQnFbL#P7MXfi52F#&%7}^J{_>>G0BHPU4x~7!?@jhl0#=`1YBYtQ
zZ(v1uR(ZJfcpVkeJNhCXVHgcv5aw5uR2#`_2db&eFZe13YGmi?t{8f2?)<J9Q~ggv
zJoa&9Srz5(O1KUv6({NQMf1{`NOlD7W8fO+==vmRaGkI-DszyUH4|q^4fZD@+=$UM
z#g@2UKh#?l5qQsUJGdKBrJbk2VWA*QjPCFoFlWibsR4%yOD0+g6_vXy-V#fN5tMa+
z&yy!w@mc0L2W%nRL5g5X$ZiEH^OtH5$mxk(G1a%qIfvsFU$IpWxUN$(n!p#j;<R~a
zG-8HJ6p3W_J$O-%*otF|^PA>iVeSW3u%L-S2JdN>=Z;N69Kw$Jt?W}{!yM1v$I}{l
z>w46pgDW}^G>jSfg%!gSumMqd#x#~g!`w~Xl%Bta4$kDJv?L<C9y|kUea8JPF9G`1
zt|&t-6H~a~=zBBvuBP3Mk`dH_ppV8rG0%#(3g+_(@{m8Y^t*zocodCvBM`(k#+;BO
zzDSx>2+$rrd?{70+qgrL|M~?=jXK@Do(<K7_DgzMrCTUnIg0_fFSI*D@FCYVoCegN
z2uD=~cz}(Rm4_O)Bjh9ntGuuYz2Iu;=oZtKSwYrlADWOn+tIv5)B`Pb<vxlTk+Ff+
zCt;PD2B*-DU6ht*ONEW{gGdcJ8=;9c0d?g>hn#WE`5PPD3LG%c36RX2S>31eoL+-^
zdLR@J9NXH~=CM57wmHMRFb8r*Z0HsAnjU-iB^Yk|EjR_?09V9zoMh7QYj(@ca_r~w
z+$00Uo}f$)W!G2mG(2g`_Q`y61|TC8coT0OO6iWW`AiVpC~Ec}pSkXVM3qzyfceMd
z?HQ2*^CAi-<r=<ZJ_Xi>G;qJmhT0YJHH&I+isYE+d2JYWrdv!oe|?l(f&i9Xu1(FX
zz{~=CPidd<($se4Z3XtyuzIVXSwT$8`R0;z^YNgt{h_Q=UEtBR4wuZ526yobyIcjX
zPaQnx3}471x*Jq-ND>=>g_&~PxSTx*qoGmhUxjWl52nFls^d+f*DTQWm5P3a<Z8KY
zKY3nAQFP@tKs=byn^iIx*!@7vS`MwnefZ$OgjK5W9{3#98)8CAf2SL<MNB2~{iZ^#
zI@$|;zr51h5|CgGB(NL(Sy{*7o%H9W=nqp!ir`FeeIH`5h?MX|g$jEGNOrM4*anq0
zaqETU-WZgNKLgexyQjJ(KeUi@Fz74TNGoVkx-&78D97b29Cp?Ylw3Xtu_B(C$l<Yv
z?h(~vV*wwCak}#6cG|gHl=jFfH4?!I93-TAi&L;TQqRhWnzOBR?1p}S6xe1Y0~zub
ze>i;WybaiTE}Iym0`Ifz4AEl-C3OiOo*c@09t!G&Reu~NJG5k3*q)2dM-Dh5tY?m8
z?>TrsNAM;#QRT;wN1bpp1sQNTj2rhal@Oqmhct2GZYsFN@2fXQocA(<3;SXxwiqJk
zwszI3Q}xP-K#-rweWF_Rvu2^qh}&z*55u<K{)lbvW7}R#>(x*1Z;{K%xviarlLQ6z
zs6N#^RVr08{N))0pX0TGr+cTHXPwWE`_a%^va>Iw;7NpB=1UD|4inGu+MTKhWjtQ8
zTY1&RXSLZ%rek3u5?h(<B&cCHDiEpx%9I_wmDnkl7%yI_!LViP$6s;C?!I!<dS*-m
zM56bZI*ckWVrYIyu&($bD}M7{{ET$)qAimlJD^f2qdT#ggjjB}v67>{HbR|Y+1_fP
zs9gD(F$^$NGSHF+|D?)<!jRpCO!z&gp(q%JWDk;C=N=W@;X+9Yvp1^ihJu^sg#_wA
ziI4n;En7I-J_CHg3@IxiRrJT@&9*o(BT=$20@^FG6#44w_DYi+p-Z$%_EO3Exk=$g
zuJB}a_2Mw;6P`+Qqm8EC=no!DQw=aC<o&?b98r91qe?dzrZOyZGC>ts?!Z8JbRA4;
zgfZD-^h}jIEV=V=TInKZzN2?EB;;|c=u4j?SVSb#QiJ-=LlsEZ$3>Qzd5!SJN5MIo
zD~8|m2esHGSvrQ~@k2cuAy3GY(EAW=W4;K@4m?OK=IceZ);KA`%PGSPlBc+RD}`1E
z8{36>JuxwnqyY`V*WLmX&_H6xqqD;}yZm8!@2d$5EMs`@C`gcmdXj>A(B-S;?VN*8
zL7zwFFXV&FTl3Ck8wFVS__@zYiPQVdqnk+?4IH~+r*#Tq%=XYAAF-GM$eFH-hs%5O
zIEDyikMl`}WKG`KVxCb@1|s{o(uQM4Rnn@AXA-$MlLQ1IVp_oIf;g<qeukUcn3rmX
zTsa7SL#Py@@5KRO70)3miKCS9*?4mE6BKSsBVE0tJr#@B^2P&;B&aIHih`eCH@Yu|
zjfLE&y60&<?`m+<&4DdT_!#=?Ke2Fa7Ff}}5D#|7E+S19UX9}En%;>dQKbgm5y8=!
z#wbsoebamzSByzXLk|z)I~063)6|j9d4qDJDSv^fhFkNVwii(?ZH^r0=H17~f#sW<
zt#@;)t8<^doa&GpUGD0?9OK&6KWcpOtnYwm%DaQOMQ+S{VV+x3sl1fRVvKYwVO*}1
z$5CBkMrdC|h7s|)v&Gw8$!Bh1LhX><rR-YQ#;ZkR9doNFt#yIVFJ6tWe68}tyAa8(
zu0?m<^7h)djDLG|4xi)bVY!U^{N!P^b$JZlMXQ63#kCIT!lg@jrUG<z^h`OqCy-~>
zSA)9<IWw+@RT%Sy;CT|Ybpyk$Ro;z|P@N?0!h0p-n}*q$<WUjcmAYv*woWr%d=t)3
zkF{tv6meTQjhfc=IU|?o&N{$nMaL2dg}}Pln$CU^jOJnsrtBI>{GJ_5W^?0a{JI4#
zw1vyoOg9qv&tBl3V#1->7TH`S0^vh9zVqyLv_aPRbPM5Ew0wSf*FEPj|H76E^`!~R
za})lq%7n<3F_&9ct`3xF9fY%tp4RK5Pa0}amUq;^z;LII=YsS|k?1%s)`aYpW%%nU
zhM0%}xAV8IlVq<Dlp?WjaaSQsO`KSxH&M<?!b2pem6z2K7BlMS1kyZQZjn=KkGVp%
z1be|iVRWRdAO=>&Q{Bu^n_`ad*aglofc)7TA(>SlYqL3oeZ1O2U|9-{TgnMoUdGmv
z0ZF;zM<D51L+x;ac4&o_p}2!+5~=F!cqHIBC89n11hu+%km~e)g3cfeIxx}w)oWPE
zwDB*6K`xa(%N8QnV3PO}l*@`WDEL(ZLf5!dC(1KhWn@Y=Fea=D&iakymN`(3ZC$ng
zgGp7I{Le;{7<CWS1&V;T#oW6jLd1rK^o%AVY^UF>nVHKt<1*==*wXox_E*(J7cxm+
zpiE0NQkLWv$tYkzz-gJAOtVh!1c=>3EYHSSQLDUb>Y)I_Rx?%In`TuGC2q<rPo92l
zOTU_^a8sBHr_@}!g;LM4ifc0f#1<<^qDi>q2yz)ri^IIgG1LR>QP<Jm;da8x@%iE7
zDz~fA^@Q5K;9E#l<xGOT)00gb(qa7;sh)+yjx&B_oxEflRFIg8z;Zjrpc}g~g?x#Q
z`C(-pet#dMz1+?|ElKd0=G*H=SD8aJD{{d`Tth|$6?i3GHVKBlzIv;#jO`53yJn=1
ztx^IrT#+RN8-XQATXOaR2ZXPdeW6sS2hsTidA-x=1<i|1fwN`11h&up!m<$Dr`7uo
zG@@`%p=%Ubm`0Bbn4{Fnv=VeQa&V_9LkIj}k)kjb)cr9RX+F1edESBd1$52KczRT8
zV^Phxk<)SJ)7-ckj&(=Vqk7|Sp0c0Q3|Sp+Yt66kpCgf~bio&GD(%<=gu!~~x$RwC
zxRWC9A=84bbo6}Y>2X~RdLA#iji!LwJ5=b^T40ruUU6hVIP$nu$KbJdMdx#K{ow=W
zptNZRSS}y<iykS{i3`@<Q9Xqh$EJup;N4%vzTn5OFInZyN(W%=2D~CP<F9vS=kEn3
z_vzqQXBSJ?e;EtZ$~X7w?uhTH`u_Wh9p_(G-!}H9->UZSzt^qs<}Z~#^*{dJPaMDx
za(-qE7=KBQfw8`|!#_yl_z$F+=o>oP*uVaXp?K~Xup|bMCJk8P|AkaRz#EHxe*(RQ
zzOz1!xb(QJw4BNygX97YJ>~GIlpKxZs0`f%!|=S6q|7MIyp)tQ{SZUx+YejRlrqCZ
z(yD`_G!k?mVTIHj!01f^`RJvunt}dGr%>O(#%lsz(h{(g|BIIuH#fG|w>LC1H`KTM
z`Nd_1pCkAX!U1(<s9k}3bd7c2Mk>;<5l8ze7=CFbrLRmH5vOqr%3n(?M|mi3I*)Oz
zk9v;5O){6SW-7h*5(y+Up`Pj;WqI*iDE)mcf({rD)hH$3&eb=sf&aRfw!{1&S->9T
z0ZZn;*o%a<xudzhrMVk`jC$J3H}v60y5Rwv;Gg1Fas<IR`!Mz#hAJOeQi)MCvUTKo
z&$CaR5!G?TtGH&zXmS6ess~~GCTjoE@ml%}vvO1y(~v3|M*xN4uBp|1&zaXZulkeI
zDqIUXQ3t%R*>5lZlMnpHgFSiGPyfR3-Ku}LLuqpdM|}fJ<Nv1uhUCy_1407dVzKsj
zN^NbqHHUfiiOZ8}R>X2ZbVo)JmpKKLvt`?eRCXt~w5IcrT9dwn{*Vv<van|0;1$0q
zi4NMMGv5dBKVw7JPd?7@Yw+9HIR1lcvj4g;fZI6fI~xCkP?7&!sJ@e<jiHUTiMgqh
z{Xae8$rgW7*gvWA354I@`>&61FgA3uH+TFVX#PGJtNzcQ<zQ^@Y-#*mFMpaUaZzK!
z7r?VzL4bfP{?DE%Vr^t=V{YxJXl&<X?BMv#0V88-WP2Img7!X8@eoMqWJ8q*M$j@c
zwszA^?Z$3!xTMQ^x+vBg?<e?^)oy+L`b8_s?9(DD*ojk^rRVx{f_*gCs%0eMyqE|<
zoH{U657Yb6eAJXt)$xLjJd%=x+F&eoFUShIme45;e*=GSIGuedoqcAdSW~o10qu3c
z%;Gr{`vZ21Dh)D)QLDRvaW_Xjyh1R!M_!1-BnexExpGOx6%)GTJfDF6tfaLQ>nj!M
z*d_mo@i`bh`Q1AT%Ny!#F3nfj8gXpdbMnz@v$*%PsKbweY1!s+jHyodOvc9Uv`OIU
zBCy`XHd<0WA0ZzH9!}U#FBoN?&9eV%N8|kubnyQ(-|y<Zit|-e%&rX12Z$601_Dz1
zZ$&G8qw@s;b}e9QYY8|R9L;UM2UE|e=LkKFa3VM9#3Z!M{7E1myMlx<McJE(Cf~={
z2|(Gol=@LhwQ792e`N6O<mVqjSz(pPmxq1pYTDcsrh)G`oLLf;gE|@!YGt6{9)#Nj
zLCHaA03In_2?kxfM61NINNj#5&Vgus5P*XI#_%A2$4kBP-tJNb-|K4V%l6ybGN)aA
zHCmZR8pb=}wfstp+{V|WA|>5<_(Lj^4^|sTm)8(~V*YdD@r$X#lVATE9?bviaQ`9o
z?|n6JHYz?4Aax3`jQ<DHf6$_kjkTk(>+k+4qwi>FW^Dh>O|4|4U_hS3txizc`|0o_
z8_ip{31}M7&9Jdb;ES}if(u~T-aJ<6t23fh3m3^KMq+jg(u{2J)NvL}k}Wv^HJjG1
zvJ_0KAKC0C=?t}6Q?>eGRFa-ZH_BQRG2qiw+^2(NtD(X{5am(hY2i|9ZgDxVx-B*|
zWg#*?GNYFkR<mwiXTJC|FL*L)vIlVU7{LC)07fnK>p1*r#(-Ua3;I78@|zl%9!8{~
z8y*qSmlq%}!=_(Whi|iL3t75hj=xgrb!nU>1GnS3eLUS}x&;Q&Ox&>6AP&^g>*XHV
z;4-O*2sJcOa1X@R27y5cQ5PVIdxa7u{{98Cs&_XAsh<A*+@*9FBAuyN;fo-N`BxeX
zx)YWAEuZWyJ{7KIlgqsfTbs92kVGUneqDi|n8lXw+5SVi{_~N{^h-MjoNrGG{^0=q
zS>CTjp5Nu^TU*;We#7sFtocbvr$_lLMSxel04&k}=v99Z{YTd3DL3+@AD*<T#XP?q
zNH>L=Y)GwcZDHa07WkTD^4@EagHEmU>9|IHol!7a>bGDoG(BObYUoJVuC8jP15I<1
z%#1$yZShb@Hk02{+V(+y#92a6&X}J?3V#hL`G^BADmC3W=4G~mkn0wgs?w3(6P;$N
zVg11*!<3?Ky>L}H@V?m@d{mo{DN!AX77AOlK$QEAfD_O6o@N_bySUe#ZqhmQ<4^Wl
z&3}jB1Aw3vu;l(*DE`J~quQT>Z@`nyssn76I_CsV150K{xG)qSJLwtGS_Vv_tR=;&
zXI7<9YECvL-RAp*CZoV0mnlwC{dd9OdKjQ2o86oiFK54iTO(21F1^(+U5uuC!HwV@
zjQlpcqTxIVz!db(*u8J<NT(s=oBk}oOnL>mDQ!Ge)zi85>`&)>>gVbTbcxOYHn|9J
zPKp0$v;Y6F^jp3lU=0XFA`7Eb9zK+qdUM33^qSC9sIGq4v?fP`<I-9xD;aQ>)ac3>
zI=wZWS)I&<B+g(KFRv_VSJ!N_<?0QksRKKPYt3B;Ep|;5q$mk)lEdD+co;Lib=(Me
zaCms#{2}QLO<N77rMuf(?h*yklr2qiwglh&a>faiuQxTK&n~r58+W)gbKw&O$uH}&
z20vcBwse>6nu9Bg2b1Gm0K-t#cuD7nL&_c8i3DtIiMA1?kfTAnHq@TEv+alKC8s5)
z;=;Ur>r2~(Z*t4YYWi2?LbxqII|2}k1gxi$=ig5?e|N?okP~q>wsw?vGO#pv_&t)d
z4s#>)@WY8rt(DnA%dka5z(g18!A98y5p^4K#=SwSabY4Hc3ETHit^LDkca=EAar;Y
z%lTT(ZkkrA5*T4mfpZ{#R+sHEQN63b@J+-yqASa?kEBbg@MQ(qJ0UzZ{&dB*yoY`F
z)5<X=j=cDqs!jNxY=dl#hwLd9JXO)c|IrR*j2#^GO^uaooa_yaznR59R?*`VG!hk*
zHGkI6U>D)jC~->Y9!lZizVH1mrNVvMK5Ei`E26(A;y;JQU#ol!ZT?b0{49*?7dH(M
z_Cpl>(_Exf>=bDwA~ik(<VgWC_a}PdSIp(Fas@2S^&LcQzMuDjG2OBOfD`c4GYp!d
z=?a{2xW8{-f3Ex%sLt5zV`5@_ZOhV8s}>`Oeb*ZKrRU6J21Fk+nXgl9W2BO(D#EMJ
zZ%+mToqDIR4yR~dDfTO`s_$)r$_=vOa2{Ta!D(+ds5-J@%k6R{z4}<QwKB=oL?QR#
ztGn3IoCVqVp{=iMEMjP#LO3Sq?c+nU>-$~k5wHDQCU>Uw-M;OSPdF_~dh?FK*@A_F
zyVPi4xE0l&)d=)(JwslH9D=7AT#lK!MrQ4IUfi~Vs|xA-66ntFh0qEtOAtnNt<oFh
z^?goQ8;-~DC)GmK8yJr-FbZ{3N>IB*P79BQJHC+*e_xC-|2n+J*3Lg1h);nL)CFBf
z5+LZQihTO{i~4#JC}QnwZf|341#oR4ecLBy;F}A8cYmWYfV%j;Q5oiV`7D7f;>*gt
z!FDdEcqN90)n<1WNLH-2XNFVE8nz}cwIscgl%Rwu#6%1@93_$w=9}{jIkDFm9-b`h
z?;-frYy)6n<~BbeP~FGJhy(@%)B^RZMA|pE0?3oFwsmq;a<n(rxB4LjIH}0kEOQ|7
zigg-9OT~4?tm^rKrxJ#wkr%(Od?|c@!8<)YXd)D&85?GR_IS!IB+;N<^g;vYV$9v<
z1<Q-@4LEC=`Ud;v3)|-@+UdH|Yme|=fqMG|vx2_G55wwiCy&h>ezuq4qw?INIrE(F
zZOt`9EdxD`z`o`>O`A1^P}ufBMzv0!ACL)^%fJ_?`?C>P1P2h|qbU+?NChQ8mJl%;
z7vxW33z9rg?;OY{Lx0(49PNSSqTd%3k?T7ngj$b5=uEgtaAzlAmq88Z=VWu{R6W*b
ze~evO8=G!*$X$JTUx>~HiSf0pfNUt7H6+Z;*g(K2!OV|ODje-H$edl(tt5%Ww(u;n
zdXTZ%acx-S_(uCsLbB1t#{(57s)&m8;CWkCp#+yf^y$#{z+I!*?F&!W<Z*(yR<sX@
zw%l2s;skMb5t%3YT=&3PaZAC-gs(+kpB2=W`<O|7LcP?}32PF|VWcBd(<g^biD79k
z??cfy&z!PQ1VewX$W>WJ;>Y=pQbUr#!__G}95pg8#KX&g(4NaVfh@l#3<cLPYim?J
zqM$i~nAo&DIBQE|GMpo2Jy4WzXT(3b(jv<(JU2glyH371el8~AeIA|gJT+5zR`P4H
z`~XO5@VWd3>=q=_H{Pq1C0TkvO$TXTN?W{k3ghX;HKA^}U2)#F*~!O3T`a|!+(q#2
zgEkDYwY~y9atE<>e7VVa(+NAYx{of(ogRV35WPos3RaG7B_W|9X=1;URGYWh-J$EA
zu1Pb`J&BL-W}WkJ)V+GOM9(_3rQ(_Zb+c#xU^I6i#5UhKv&b1tkZQ(u4=a)fzn2=(
zI!IOF6~dGZ)3^%)zXlCMbF@w(78^nUQ~Vb6%U1FRXZy!oRbSx9Q9nZA4=y3T?zW|9
ziqGTEGJ`UmniQZm!u5<j^{rbnZc0R3NtO6;lwqu(6zZXl4N&CP`rkhPYN1QqF`u}s
ze!B6gZ(~y6D4R>)tJF>4&?MUpD5e3$TVx9PO*b+TZ+2D1qmYBmK-<kAnuonS!g4`W
zUS5L&>I4bDRsaO_rE_ewbUuMRO!0mXiAz^P8~y&pM+@4jRs-wjg5a&_!ylLp$jXy6
zD!|BsoV&n9Qqe!2IS~fQUI-F-%~U}*acP0`lzyT(r+v(cjoNP_rA}?A+J?x>gmZtr
z_^OIcbr5yK4@7mGm&r03t0zKHQ*nSf75cGus4H{!Qx+HoUbOSP<93}eALG{@#~C*h
zp}@sDy~Ruob}L4tB#*{$YuFpfl8yZG48*Ky@K4Q76|*1S_Fd7u!f8C7aZkNWIll?2
zZjiz-Iv4x0l09Q1z6|S`|A{c}4!FzaGCf6emzP~Br#~IJe`=~L6|`srDU0oa{PRyq
zhc&hF)jLQapcBAEBHypaT|m@PG<Nti-xyQZvcYXe_e%5v-{et-iC5Sn?lQm!o9BYg
zwX(pBozZ(%l0p*tJUBfTZ%8ov>zacrcBFL;rj_sKp{?CBk7u0@n{c|$OH$5xWs%6?
z1%^pgy1E@L9uFTdKO}asAi(sIZP#mA_;+r5vmG*ZUWN|}Xi%zGz%Y8v6mQ+3Opp3J
zphlo;){Gpn9!~j%b2v?P5~Je2tc$fto{pNsm<+16q$g!`9nG<qrc6AnjrA+TThweS
z;G@tal3RQ>6_m*tHNt6Ke74Zm9&Lx2@yT0ikNW=5wn?Xo`Q+vJTMam4b<1Gge)eZJ
zMbC6|mhG0+$htL6HgxM5p<XxWw+S}dzYsDd({=a4fUq4mw|BP+K(%<Tr#i8kic82G
zSUn!1ar{YLN*1QI5$N@H*vp7QOP+SU&d9>;1D^;F+;#7cd$);>Nb<O;<A>Yr_*I$3
zvDM??^M~6L3~x_^yk)+{_5Q|Z5OC4VJdgx5LQs=30v>{!LunvK&5R4(WLg6BABe@w
zEEF!ms{?g>6+%K(^d$8Ubm+L$qp_(ZH=8bn#G3ZA^&7)^_@ar7xatxFq#WK!slU36
z-hIzcex=eFK5o9f=+d#p5$!2Rr;U#gb^5~1X~S;7p|o^$7JFm&F&!kyGb2I{-is4U
znE5W227KCt{X8p+HU)@59HP?-uXmT5uxJvcXvvC>?6{}kU6PKW;cnOHYXWQEyv6cL
z_($5V52DKB>+miS6Y``yE?Cr}NtqU3R2(E!R|-KCJ3Aqob6}-{AV%l!V(r=*kc`Y2
zlkij&>>4c-3vRvC+MiL)6UXls4`5rD@e6FWgQ4}A?3E-lZ({M}hS5O)Ym_A7hU*iX
zzvk4VwBo_%EP8j~jLoDfe%8>rFh2zhp>4H=Y(xUNZOENr$n3oC(+@AzfkJ9|SPxHD
zOxUj`(GNZCByG~UpofvYXbP|B$G80+M)G-5r;!akvvi<0yg$}628<0&+N;m*%uu^#
zMjniU99lx_jI5J$a>VH-TcUYj1glfGY9u!Uwh@+@xLMZa{uhfptJi#IrEg5cTSyFV
zKbRGQx3RJxsb0g?JwuH&nW0_l099H1G;W@JH+AeReu&TV2#i;N3~t#DmX+giBFBz*
zs%q_Q@Lo-E{unHDZKeT5X5Wtqbu6X>HW@Y$+ZDVUWOCOacj6g@Be9z?m2F$XDo6zG
zxR>@`%Odc5@<5Bg6FnvtJONPr+AT%2HDMazcNVAX)ypa7biQR!c?+Euc8sdvTXx(q
zXp$Ji!&cQno7lrk@&oUCd$ELpz_p-H;2)Y21$pscotCSwWW-_O1IAKt8i<x`s3#6W
zjSPhv&NJP)i3AzDN<?>MtqrJZB0-^d6E!Gf$YZqnc|#hP(l$mboRQ!L&LZV`iHB8{
zM=D6X_q4^gAP%z~dSTJJ`%T*mdzqos<nP_X2R~?Q29P7L5Q5AlqqYHizt|mvaJ~RJ
zC@>*q!i(aL19w(}c5ZXvNm`h$alGj%M437?L~`UJ>a1s(T6&bmxCde6Pgn`}7pn>E
z5249QNx4RVSQxl$r+MZ&NrwgLsuAi1E1feMigMJoyb;!aY>f=RqqsbIc$R?CH_j{k
zMQ`GOer;T-XJj1ZbuiG4#1%OrmIrn7k-|Prj{E`Np@S(9BUfyaX$;o9h41IaYXji;
zOgH5Pn8+M{OE!tzP9@wo0@Kt`T1L+fG*HFVQyhE@_$r{KTHflZrYqC3L-H74;!sHn
zUL$|TSe_pb{p=7m%lLp+632)h<}$mg{Y)PB!B#47A+a8Z)dKz#XeAj>*)9ysFq#>6
zh^$dG{xPzzPDf8K|E4gvb8YDDV7qeCQVoe(5mDsV;OPFZ$oYlLLu+hM1GLxJ6C&a+
zU!+5h*Kq5uDIzO&vcT{!`r*8{rO12H>y!OW?QO9l_iXq#@8%&X8yxfuUc|7DAt;ID
zZ~+FAP>1kRu4!3;FSV@=^|D+ck6_Lgk)=HX1!Qen<u%TCu@(8FbU4-(+fYyU_CH>%
z%D0)GhfYbtM1wqL&qUHWD22|{?FRZeed$~PSy^|B8*|5zBTaLARHm`RA3sks31Mzt
z<iV5U;Z~neds7^n+>Q3ayWxSas#WO|)oE$xTkeD`;a5ugdE3pE#xd!z3~3I{SLK$|
z8R_ys%yzVoFG@<CKgzHt)mxvOEj})}Er?PI(5+l_rcHjC&x8Uo6Dj`sML%VZEOwvf
z#DDrwbz*HX|Hgbv#sFRB#Or+R1-9e8{JFrkPC`o;I{{jbsa;$7<LUFbb?-OUe9(9O
z6v3Y$fkCI)!DhWO{516M71+x5`}RC-8t(SIPRkP>6^e^e9$=<xlQDQ?F1v#;)<s(0
z6Dua@=so9^-C83E5(xQ<-?2ABj)u`Ug6hOLU$mGyER*-#22{golNST)3#$k4>z(*e
z$fMkq=-pA?mT+=Ixzx99BW}L1`e|~k?x7KiG3)I+Wetrb6dkh9qFOQrh04|57BBE=
zWGe~@VA{dGuX0MQ%x*Ynje34H*66Hq+=Cj?p*>}OoVs~)D!HN~(qmvU>21#Xu86gA
zC;Uvu%!tg=tm@(MicBiGaBd!Wovq_U%ciDv$%QtLVLFT)@f7N=TIh&#$@we%pLO(8
zU1o<;l=VbNJdstu)<pchD)~J>khak``i(XJUXme!b@8cagR|(tb{uW+U<%4d(V{%-
zU&}bKP+{&(+1{t6qxcv&ppnOk9L_*=)tuFr{}xx;A{zc31$@~d@bG=$w^Ziu3$p)!
zN&uuX4o<eVHugU^0WF^AE?5J$UjSIY)_D9Kg5Tx-4u!nFqoc9C_0#`aI{$`=XN15L
zPYHJVI#4$n@eCXx<QbL=u7;K2hy)PyxyyS{Nct6L)w)AkSj=dVp)sLXDgNv{w28DB
zgBH#3F5zC15{)EZ5~|GD1Z~+ek?#8ktW=09@SoTDbo2+_>&$^JaQmGd6)WYfL%Oxk
zK>k(9^aEj(*MQym1IUtJYvX=rbo8I@umE;s?q+PH{My!7(b&Y;-q`v#4k|%$#QGf}
zQrkVvr+sbt)6n-qFS1qQo~fU`C(qfSl`4HZ+=;oOeA0blh)65QT=%Za=R*j-z=mv}
zZ^fx*Kc*YJhcY>1MVW>8dkxUyJVqSgZAMYo9zRrrd(p8+rb*`d-W_<WPd8^e0+qOz
zKBmeDo<+%;Vxr33LSl+;?JYS{&m{~HUvM@OAXd$}km380T=5qL(9g%6<-IU^2{ny6
zv0slZ<KQ<BdxdpxWo81Hi;F3&;id}p4VW17u0#PRYebn>{Pb}zV!6xE3-(-6=W!?a
z7(1{7PR3&SVmvLFXYjMh(lGtOx!5eT^o-WR7lW<O|3H_p0)YPa*$rb?TYCVj2WTb!
zL>KHHuUtO0cb@e1Yi*t%M2a};TLLBr0MY@(`BMkv8)E`L^fO};D~J=#1|Hwr)ar4H
zCe$xXnCPLjotnET@<#m=%Um&QVhd-{HZ7jdD~fO|s3_c#t`6s<z`A$$-zbwm+v)MZ
zoR&|0)~EK|uZ^ty?K_LO8XDXF(Pb4G8hIL70h)XoS;0IT1+kW|LFuV77m$c(Eu*ku
zcpX8XOHsT<VGP}O>X$N3ZI|0ESelc#gmv-?20>d;r5ds@>KLCJ?;J9Fs@M`nih<7P
z^LEQm<q~r_(|sP`?c)Ia{jYJfKkncUoqmHm<4x<g_OR&%Izf2AXHY_{(s9}lUU+LL
zI;Wi`z}TfrnC7q#m?A~z32#F?TVMlJFB?MUOJj$5HOtU&Eba*`zdVbI_^P^TY}*9F
zz4wIqGiWE0bf1>MBYi|TKi2k}LED>Hfac5SzB+I+H=P{uxu5nng1+YF0%q>@&d#4D
zvUFaCc4~SZ@uAt|*;F*Qfa_PL$9`d^d>Sk*2KL7w-ps#-i+wB^K0N>kUV!y$T;1P-
zAg^x^=;;2x>FNqfN=Z8U@zII8KN;(%i7!bhX;~H9z!3;i4D=!lDrE;dDoRSiP#QEJ
zQY4Sa4U}kbm_9wpnbb0jABgOqyWGEaVEnKT2U}yyZ?5_G2ayl}qyNa;zsUs*I9VI%
z+Z+Al`#GHWW3d3ir~oU}{@*-639t>3KkV`cl>|od!n|XI6LrZFG<@HUIk?gujanRq
zBmE`VXh!gCbvs}hO|uw-sN;q=esYupSvd18X@h<Xvzwc6CMz#$Tu5Y&$j)0MIFgG+
z8e`9}^sn{fk<z;#%7M4#!Ga2#+b(Hpk%SyLFVJec)EX$kt#o2_uTQ|FR&(SovI(sg
z?OcS`9>JH?Xh4<d@d(lO+=@#p|1}LO_}^jix2M0vedAd*K&}P=Yn}gzd?j-$TTA1=
z550kZjEeM-FkXRJg3|+m)}^(m%(8^yK~k%<bDIN0LsRo;JbvZ#MwfS4L~*qa$69P^
z&_6mjX{IrQl75bJS}WWTLIpNat2TUfdBN~@WIUSs6^mK;^B%H2+6-$mR7q#NHdGw2
zL<c!pVvq1V#ppfouvigzW2Of3p#IC0>W*4uu3SBH?Tkaq21bxLQs<4>diP|ELB#30
zr8IW>D8vQLT?>Tr_LSMHpT;X?O-w&n0Wc~AEWQ5?R=+vGzd$SEIRc>R33l%;ViD%y
zgK`d{qi0VZHeN%w>>G#V-6^j$S;4|wCeK!!+-u=n-+!$?c}~_~yfQc04lNfD?^zty
z_gX{qYn1ntc`Db*tRywq$pJ<e&7zwp2z<zab^z#&_+@l8NpO+w?IYg5HoISIf|)rw
z+WtepVEZN9z6mq5GzauNeu@#fb(+;>09hUYyZyDZ_D7jQ-$aW8UKx<A+S*t<eDA3g
zMDacyS%Ej{Jx>!&VgX>NiX-4Fvob<bcw{GU0-Ct3u%nS^H-_Hbtlfj8V$cDLl_`ac
zFLP}rh(=Xd3;VHUkT9eu<}h%Z0*#O&NBUd})`$vKYsI{i-irsh7q(S``QSd`@lvBF
zF#8IccIa~1P9%*^9QC!dZ8vbep(oEVg^&Q={n6zhZA1JH$Kyg>EWTSAtVX=9iD~Li
zQorv@@WO4Dd!vt!KUt`#|Ag@s02O3VAfOk&j`R}{BG!(8;lyvpRl8!%Q`3F*l!nJI
zAoqkYNHsxSJ~*@G{zMuDN+Oj*8S4C0#;sUnpVGL5V#MoocbAM{8D0_uGe6{o8I2ln
z<JD%5D5VKs1$7oqo|YMWKU6r6dqeqazOp^rV(P(Ne?yCumbz;*xZtYY^MC`DaUfQf
z%H{O{cuuMENOkgepW$V4$v!XPxKP4rQt34NP}p*&_!A#d_VRJ1b$R1^(s?NG(7BO|
zZz<j5Tb1yq`+=uLq#%ed1l}auI3SkTjU#EwV^t}rnGrwq7u>`X<z<oTq&hv4Y^W<V
ziOFlxi_XR!nhg%ULprzs_IbI!61I5@{nu2WUav-41AwD0VEr0>{LRXq@Dw+GstX;y
zXP$%I@cxW&;FIo!XJ8sW;7u-ma*QS6LbTjyp{1>jr?+s%V#XhJ9Fj*A*u}QX?lZFt
z7vp0y!X<NZL$dF@nGKB*V@-x5-ymQ0;A*&eRl_P<(+*!rtpAk7<t25%+X3D<6|nw8
zE08gEG_x`Ke<m#>lvGsJf21qoV>DwbXFxD_g^5NxMU+pO3XpH>s}O{M-OZ2tAjS~4
zkne;+1vhC2kW3LNm;2@hSbNcj&k>={uWn$2E(HDXGJKipe=_N6WT>7FK;Z@jVDbOM
z%_sq8l$^e6AX0hAewh)j{hsCvF#cD524ivYo@8PydL6gT;*!I{C7!4m0<MP}!7}uM
zio>{TejvnUZe@0tIWKl^t`p3O;O*n>$B`Ph#RpfeHM)*W+2EVHrOn-$hvPAio7)RU
z2CR#sk5?BwUpdpp?kI-9SdiE1v%De&Fw8ED@WEsAJxw=lpx5e3K#hRy&7o!Xfiyp1
zKoa|W><Eb0o5%{1MtP35!x-X2BW}iIPxh69xlMwV0ZWkk42e7$oj!XK^=$-~-US}l
zr_n%@7Zz!F>h`9@>V^9Pkq_lTq_BeYZ-dRjsWtSxg5vhAf=$t6PCsvIUAJqlsJ*!l
ze2*X1n)dPSJ<kP#yuHDu?b#=wP(k3R&Sf_tY6<-yTTaTj%HX;K|Le^|5Ol6+Pa24M
zrFRMPa4*Hqcu{27W8Z)R(=-?#y5lctzz4R{D8r0~d~U)fv&BoWP&bn~?5+_=RY6i~
z(QPb@GQsCSA2xw3#O5xf(t}2G@8`Le-j-LCEqqhby_1tHTBFT}9VindolSsQ8p@3l
z5{p3}9FDq=J(vEDO$I;j9R^9<SC?`=4w3CVD>b$R9)Xyi`JThd>LKVjp&8qWhfD0J
z&#<^7hL|?t{iMUazyj(pm=eUyLrn4N3;~UTf)*cksJLD?>#oYqg5|b;(YAYOra7Iu
zV^4@LLm}uC`0|E(rp(2vK*AUNT^jYhn3K0a(<WTrScZJ`3ZJU6L7C8*g4O-~c^ny?
zx_KAb3!{oJ%VUfNeJePhJ;Wu1#zFc&?hIYUM9+<42k|zc2ZQXHm7}WHO3o!gTR4t$
z!k%cRU-wn0_fAvlnjWmlM3q2wlgoZM3_B!!x8;PWTCUSGOL0tvJs6t6-j#CU$_o-c
zC0|2c%M$`*Ke|xNO5LFlNp^v4Me5^5hE@%&CyErn+Pu3SxV2#O*Wjd9#l>a<IR2hN
z0|5yDT>anA!@mWm-^Q_ji1){;Qx-jpXr8BPD+4fOeA%~zaCkxxm4LErp#f)xwt0zs
ztCPVhfi-Oy&j6biQNm1aobzVQHgsz!%oM6%JXxV7dP(q-wIji;&z^V=5yW^eSDX-e
z1uJ<gTtvtv7Un(N7SRTGj`WxW2%EDKXs{KM53al58)_bRFTeOCs`5iJKQixKY2uot
zD}r(i-o^ReR^~6yM@Jk{yLBf+LChjQS8XsE;$VWH8k~y~MW=Zg>?b2j1?r*F6uW-t
z*$OD@E*eHv*?{Ws!WN9;5wY@cXZ03?et5IpVkexW%l3v?DAgR9AbM_6TvaMsHRLg7
zJBXv%*yeMqIYY4J4iiUhpsm8GVN<@1t2viSPnkOby9n2!GZjqhbmhs&aqn`UVnMV1
zVrK2JWU^AMi|R)-a1>{9U21AcbFYGR9u|+D?ssQqH|Et9Z`I^tAzVw5)j~>9gWp^h
z9NJuWG+L!C;U69OA^uf~agGR5Edb@^0~Gmd`TcK7{GPV_pv8jd3BZ&jTt8rj2M;~p
z-6xd2J1yJY*Rp@9qM<<M!T)IW*pZm{V>cd(c*mCxq+peBR^RJ-xN#aK8{U%xGfx_q
zQF_dtKE*N^>PVulFuywT$(8D@%eTqE8OfvM9;AaJk}jOu0X}FN5E8EZ<crk)I5<4n
zvt|~}w78{MAS46Pe7iTeI;&#3bPMdg{5bD+eLs5f!%`l9;PLg|0BwF&H0^!xVAFtK
zPH^byy0s6VT<qla${D1E=6{ufT38#I|CBDm5o6XrO$^@v7XL5#$~R$>0Ex=RfVu{7
z4dvUR7#ZDd@s1Hmc;b^9E$5Q_6)1gyy!`<YUGHQau?^nRh2%>KXUW0N1?$z`w*^<E
zlZ?zZ0}^w?INkPiZH6+}na08XyQ(b82gEW?d$f>dMhqfw??X%*5ID`Q`V@I!Vpp*U
z*`7^&E}jIpGLNveGkptUoPTr1(Vw`;NdnqKC1YZDm$7ThRn#f9;LQJ#RqJDPPZ6-5
zGtV)OGH^t_mE)3597{F)%xgwL1BA^k=d&|-rydC`AtR6;{ivY}Vj1%Edn?DNse8;J
zmd_pyVfhHfn&ql@;5Q9z{ugELQ*NM$GeB{pw>YeZDjm(<-A2ZbsFcktpH$U0o|jko
zf2p70^!!G${yi)3YZZf~zV-JThJP|?*!~!h)_@%LJp>RC&o8O#n=n}?OUpk7q#~8S
z4G6U#s=?Vyf@(R}?d!Am^;jHbOQKR#r+=Rhl8Vvx>YalC%m?L{_l|=Icrpd&vD*-=
zkM7g@GB+u=uzIxH*}fpiLYx>l{R-A7Adj{a3$3?i6`ynYm?eW6qPup6QqTv}RzBJL
zhG}dV{u4XsZCJlO*(MMEJ9BZ4CEbj+Rw$&3i^*z?eESVL6o^K72Vb8~$ytP^07X_!
zTXLxYI+rwc(>Ex|T{pZznw+8s5icekOA%3hn|TjzmpO`#b@Qg2TV*uz)2ZtSLg|;H
ztS?5E+LGZzKRwn#QcY?y-oDuj($uN%Vws{|3LAuJi2Pg*Kb@iE`)S^GVAl;ub<TPO
z4k9^B%k*}*m1NE>c7=c}+FH6tLX}@9y{o8vFkAq{^o&l|tHWKrr_r)z@WY6QYS$_V
z{pp7pkCgSX14r<sFWeqOdo#d<=Auq#No+ZwxkLV$>LTYby(BR8A1O5=$*NvUR1DRd
zz6z*!6DBDknKZ+(e%Go=tPYOVjeC+Dp7Zq@9VRk1!0{2=NBm&cLP)$`AKp6QE+vQ>
zQ$lbw-tNqww-!q>CBF2XOi}3-yd=tpt+BS0uIL6!){cxO{$Qpr_hWC}MJ84|GTMwx
zBBQvlGenk+y4&G-jgWDJl4dtzVWb552`iEhtExecxT@u+FRPF;$qP!6@-Yn-N^r9)
zERZCv#nBIY9Ip)T6ux@;U#aHT2Ob(c|6=$B7{}4_R&mvtykfAkQpkjczUh^}Lsdzg
z?YaVDv@Df=>%k###exC^6Mymw2eNKFs<!haYbuGh$_<Xu%^mQZL0((2U>b5@z$EQr
zPY(8E6Q>O+57VX{lGGd?m6p6WaiCVdr*ceDiPk#_V%%<!T7gJ>45}p>jubIL5Eom@
zz*Cbnyk(R(@b1Dm?^1F24}{&ju49KxbM<G`%OnW|xU4cqD6y%HQ%`%^+F^79F^-~)
zV5%op-gPOfGc({-2yw={SL)U18+9@5zlU^JjC-)Bx9uz6rqq`_Isdw~xmz!0Ul1?>
z6SzOhT*GrTgLu%yJ%!;)^uRTX?1djG#Crhe{n?Sx>EJlx6RK6_yG752LCP0ec)?W{
zOJj~V^eH@YO9y4Ir7#gMjlH<@(v#q$%{p_Xl5M$CQWa<(W_pxrr5-{5jNw1u6#lh2
zN_%4~8%MyE&2Mr1dzATE;I9>Ae+Ya!H_fe`ZC)AM|8Ph=-CF2Xo2$$LL>olFA@OTm
z*xw3&s{SOtKS&91{m$Ib7{EXR`ftB?#NNmt`0+oH47pOPqu|;&s2VBz(ET}j;3ni5
zVPHM0bbNLaE>%^huXNs4HlPb`4CfE-l*L+wuXok!Tl(+!w+R#9(a#PR(S~Q43L$74
zD*2UZ-dXTQbKAQf80rZ?9D#ere41K`ZJq!z4XYFErU|hW^8f6;m~5O~_izG&9xdOH
z6uf*HDN9&!0k!?sCDWZOQPp9uz@H5}h>Ydo2R8X<<bUlB=O5tMTm5(}KOz30cO|L^
zK->(lo@(rWKZX5^P{k)>F@D1O`?WLx+`nJ>{R`yiBj0YSiEi>1ok80Jn?R^?_`XUR
zv_KK_Uh(5!X*c%#yr!qoOvx#k2|7Q5x^lIv&iwXuI$7QlSwRimT!3o|a3Wy|55?+N
zaT`yUO~zBiK)d>hyO-<lkYPSQPX9w!?AMI{kE>vRdeeVL=>H)Qa9IFw>FEcj`dRL;
zHNk(D`?vGzPkr{R{!#`{fP$Y=-B-V)=zn;GfPsUfJ>Zh<@3&%%jg)@7TPx^fZuxsR
z-Z(<w>DG|Q!Wh*DpjcQ+@Izp2S3h$mc%kilX>w)cQ+n~%j~ADZ?yy1Fr~*?vhq<)o
ziXPLNj-L_)l^PlmMaX3dM8b0HV(J{EaG4>yYElgtp|D>C9<teZ=TY?yU|{3yiMure
zrc>RpCCY7mJWpG!i`<WH{U#Q^`_P|h%`)ywkEh*-1D5{(8il{xyA|M`JD?WepZZ2P
zWkW$@Y)nFHZ;Ps;Qq<xT1uSMry}|3ueB|e<W^|-k3Jy(Ntv)YXj>#}j?d4Wlcqu75
zM}Rf$Bw;>U0RwDJ5QN5$zPjoB!L9O!>UzlewYI?f;uZCGn{T{24t{F6r_rEzJP~Jl
zfc5nA-*@bP(D&c%kZ$;oW-cQzteHoX4<bczeKdrnL?D*o%Ice&4wz)37&WQQ^8VP|
zZh<6C1PXn2YZv~6K`NgRHnVaj4z+t#EM6&+aG#w8?}>~NSvLAOZ=IW;zDD4MauWTd
zIbXo~wU*Ssv7bNe_j{L+7qBIO(tx_W3(tTkVSPSRf}ZJtY;(oT8Hh!Z@Q17-L!EcL
z5~opxxJ-3-n9{_n@?h3=FvX!iA2ia;H&L$dLYncEw9;lHLW2L~*K7NDyv>ei%9rlU
z2)gd?bl{y8Y&im11f5xR_3c{hpXMo7nbz>M!8*V)1g!t5(*E3}fRVoK?}wmO#LK5*
z)hBB~X$NQ;mJ)Oi*aJX~CM8tU)0q#Wou6zWd7R(fQ(<95fNA7aiD+z<H%%uxoj<u|
zFrtP@6oE)>j$LA&LqTLH=my}^hgbmt^*zUF+MjZ%4qo>d<QE+RLu9wcNb^~lr57R|
zxi2`iB?{AoKHMMq6J#>n{KLiIU%S8d4{CNXHuxdYc#4LMtmRb|0Dy%6iN@2nI{qg>
zKRxF6i1-_~^V?NkMPpOIw<PSpllq>K-*0R0eLy47KL_U*FJ_jq*$^cc&X=&m%YgxO
zC-?cWv3NZ0ANFF767Ymjf?uOOTh%bzaF3-iX%K0XHB;ho4@NUoRLmk?YhK6R4t^f`
zc&dsL{@Dk#q`g{ips`0oE=!%x@W8*3-&2*SOb>JyZh)-vJSwB=-h7>4Lmw#78Wyc6
zaK&;R6G)#9g(wlp+3ESho%Nt(I{Tqm$gNacn@n9TTV2W+>c2k!6#tj78GJu3zJF2X
zPk&&a4RA>YsAvUHh5pa{;Ym$@Jntz*{5`6D;}t66R}}$=RbbU}(ID9<$7|r^amtVT
z;OrbP_@SiIh-5yRkQ8sX;(AfTFZykf$$VPo-LotX&<?>%?n`flNf_FrlvLN$wuPL|
z%VnppNGVH)HKc`BoIfLzzMG}t1$FdiQ86}-@q%s6<Psz@f6I9eRadmSn?~n$CU(ZB
zKTrHDq?B)SzORuHQ%C8gcNGh86im+O9h{uxrD8NK&>ff#4+l>8*o5u@&TFv-<<q1k
zqQm0J^H!C>4Q&oLQP1O&>f$wawNB9XVzqXHntkXUY7cK%Ew#H6)!4BF<Wvc|bi=VG
zta7N)(V94SHcP~h)Pg4Fv0wr?l8ifxcgdC`oU|c}M<g<F8HM7Iq7YXGd<e4lzOkfG
zJ5!9*%B~qhrm$*9O#b*&*MjD?y78Nw&;vL)Qs-uVuF&X#@44O{HSKl0^j^(?c`G$=
zqIx*Ye~@^23i`MqfmP;CyIp@`%Q-%9jq}(qaUwR35QanGbUy{bgOj^XmwlJtUsX&0
z3h?#cit8S+fOS8)>6WiRTr10t_tKp|<ibBEOe+6NL;Rke0X{@x|FbPdgT<LV%|ze;
z>@oQN>XE;PkMFTsz|qm(+`!2ZFz@#5!ySJYO)~zBCY%EFK!T-Qb+(`sP2Co0V9N?6
zNG?U$wL}o}MK|jVNDv`r%wiOQRDGHHJ)D;tU_!>zeSzt2VF-%DFp`|j*bkyKBqQTk
zsgfoSMKf*+LD>{-s%X4^L9iFlBo!VSGX<Yx`~t`7^udttQ=CrC%7%B!wr++yxYgUJ
z3hR;!?;dXLPZ2M{o<hc-E{p@XjMWZ+>kt5&?f*4wPu~3JG55`%Gorhn&bOe66ROWZ
z)0nn!>BMW-;I;H=-R~1wjKgkEtg8?DeBB0#hO!vEQM%G|M0T6!o-;N#=r`%@-IbH1
z_L8z&wY@5y+epVmx{!5IkDTirv`a8{gwEVm8`rnA(kXX>7l>B#27xqmk74v35pH<I
zV287*@ij6|U5`0lwUp(r<YUSoj#ZEs(Pzw!2*jFmlMZe_6}rglDa$U~1D8_4@N9E@
z7O`inU=-e$pZuWq;?#XH_vFpdPrXo#FptC`0EF8BC|&=rp_BlO>j5tL+B&M(TmB5`
z_ZbqPy$|TGfrcTAsez@i)nRzL;K_yKNjai`h#qBqOF;?w;Rq}<#xePAy0fp0l;Mmr
zG*FMuHq6V2KME(xNxC;Si26EY`c}An^l@^L2|x=LTzq-f`_)zQ1LJA5UF{f5$+ZA}
z3V+=!d@rTgDwk74{`0fgREcNNa-;;<s~@>JqK&6yCpzyklSGJWkCt3XvSco3YoAHd
zur#!1UX*^l$HpBLvBQmNcjmzn9W^@aRo{G}zk^-9MtB|8*M3Y)zXkJGONH;KhW`YB
z)f~|4^!mSo_s<b10ImW~fF3VksP*>&$!}l7_>G*%cq8z{Z;LF<Q@yn$+6Q?K(TKKU
zC51>hV(1b=8#)z2O4s3zZkWUpz~)#om36ZYX65V#bYL$39H}LTg12XFMplF|H2Tf3
z>%w;STZc^6JQoYZV<s6ev_`=VES__34tNLGm&AzBR*><piRv*TkEYCNBIlkD7YPxD
zJU?xZsX*;??|GAQd0U~#hJpZB8GZrNXjv+W)|XnmJeUv9#|^=R#NjX@-*~NpyQF-f
zgcg2YaLD-u9AY$KVD5P<8hb<Wt6G|>FYVSOYV?k;d6s3jdTzyb;?+C9a*zQ<4%XMZ
z++3;(bcLon4!yVXk}Il|@c1d`R~GbAjt6K$0$}j}Uv1|BPi6bYaU`-Op==Tg8D($T
zdxns`_g>j#BqKs0GnEQiAu=<f%oLGLksTWHf6me2IXZcx{_p!apXYO4@8>+<=XYQC
zb&uz|ugl<Hwg`CC2d`A)uZiFWKt#6>Pfa7P&Q~&e;}wuDH(k$e6JpU$GRK1T7GK`^
z+od1ALV*>c!q-o{VZ?HnN1=Tw{m51HLeR3UuAyQLij#_xjJ4U!t@1l;^c}txlU#ko
z;Rj@vx>{+9B$t&k9<3h{7w6IObN>=6OWAyEgl=gF*l701>~lf03+I=+ZPEYe>7)D1
z>$Y}nqgtB--?lq-V$D;7OjsdH`M;YVi@7*C+t~mS)thUcb4^e`iPY{@MI%|cjDC{l
zP{8WCaHIuBe{5{Y5%O<tie8NuXyn;AZcZviL`;l13`cz-Jf-Sp@m~0j^dgeImvi>X
zI}SdUMv5^cGQMr143a~Yy`~Z0-<%me$|bBLKPV-6Tf%x0*>w%HMY(e<-`l>{)|CI(
z34W;^&pXHtq8ISlTTDINkDfO%HE^+ZhRqNqEUW>qC}wV8v6*<uW_#@m$zpfU0h#`8
zmcEflr|4C-+1bXNxr%Uu#`E^(iyHB=;o(Uy#oX)&%N;AeOHU8!e9E==YdUx^AnlkO
zVS(($D(=Fwoep9w)n%9_r`m?1<{B&E-BUP0t1l!LTNU{1EsY7>6aDT{c1z@NT0x$L
zxrOOo_i07>$6LWB&}@j%*w{lMEfppcNWsY*1RP6*u&juid&WCkcyBM0;Lu&1Eq059
z-CMZyufJ@wnRaQ%N|Etgsv=~Dc@g+PLd*BDQiND1lpS^l_~{&UnnKr7f#U}RCRGcn
z8l#-4#y)GU{~$qsLE4@SvPl$>oA>xZ^5F;*%bw+?X7@&Q>uj_ScYL~nlgg(h_$rw4
zse}3^<>@{S=hp{t56_qj{-71KTia#Mytgv~PJq#y*f|3SFLsEtieJQ;4v5kOe8l!9
z&h}4=+1UVre?WjCR0x5WP(Oq=<aIkk@^d>eetH_;OxjgtJPM<P_;O}OT`uyGihh50
z*+pNW6Mmnn)5oT|NiyhrB}nF*3sjA2Lz8d#c~O7I=RWzx@0c3i7$Lqxz*tf@%VeLh
zb0R0l@)3$~3iK>v#|udp)vbdcu~9$#F8RZ&p|UjMejc%E>IDx&zK1r}K`i%bE>P4u
zzml=M{i@(##A4GI+7`L0aY^tHReUW}<pvvm(F@?o!+{}cj|K=<z}DH(&f5B?D~^mV
zP^c5e4q5fW%vCLahh-e5#?I<@p8!qbI&V%U@wYKvarGXzNfZJ#avJ{i8$#<Vb63}q
z5BQtUH$I4|OXKd$nW~|TjH`c{WH~vKD2^jIA0$YP9@T1SuKY$wN+_~k;+toT)sZ&M
z)lW}QXPZLJJ}X+EW?Y#xc_M~mOeejRdH+QlPnB1HNpG>04|6V`(=)HjvlO@cYQHzQ
zv`MtcutdJ-@)}MHGf6wJf=X(jDji11f-6(`=DR+(!Ogqcb*X5{u{D<J6}jI~;9b}%
z-?5SeKrG05KxDt>B5iAI;%>4T87B|{%@-!T>Mbte(u5b<UV}?c$mn3t-(?kQb7t7{
zA<@Enc@Z+oxk}VW2cmc%a~X{YSDBE^A1mX?q%w-58`itWn$?s+$r|{<|0!|?0~K}b
zTa!zg`caRQ(r?czt#DI?wdEC*%9g2%M+Ov4JR5tJ@CLm!@vCP^j|Fp7hx~M8q)eB9
ztZtCpy8tm=<-jx6%NKpSi6KwD>HT)Tx7pi!`7MXHIsQ+F`m0O?C`_0GwuZ#IS9^p0
z7>lBzrHPTVI^an+!|_<0-0VN~RVdW45~2;Mnx?619m8(r&VCo75Q=f48@ae*w4B<8
zAgAPo_#qOH!+HnM1`nhjyh4PUe&F=-M%Jaq=7LH|9)nCT=h~GoxE|-eE*Hrd7r8ED
zsjPN044+DP%2jnWSV8=Gw!({Vwh>r?&9iMBDfd6{l7u=PUi%p5;_ourj>gI5K=e6M
zswbGUu1$Avtlytgx$MYQ-DK2H_GwwuYuV!sHmFD@vMHY?G%_`99^@6odqNiA`ah7W
zzdL#a&wA@73Z7B0%2oq(8QK8;;`fEt^Zct9=U?<RZ)`-(ZCu#+KC(2mG~_hLvH0QZ
z%(s~@-IpzUK4>AWIRXDS64FF34qHp30fFpE(dnzv*P733zNo@ZEVRntZYy?pKyq%f
z0f|@0r9tg$!8HyOZK3{8?;3cIG+%uk)@1fnpj$e_*uh+4shY&W<QW%1jQG2|J`R?T
z)5YVkcnD(*`_4Z-%eCR78Zo#dtn!kOlWgw+BqS`rQufvvpe-p6OiL^@fYVhb@&@*s
zJ69UIP9vOzmrHybY`%)JKS+1}+HOjZ(`IUxWGqc@{PwM+!KFX~+Ok+|1NQH$gQs8A
zoOs*ndR(viD>v`tJ11sONj9>YBo;1-m&CYe>pzAD(l%bq4G|r>iIz=pFtmlaD1CDN
z#YwiclmvEh6ShDZ6Z7wP3>Z5Pa&qV<W)!HLCOL6=YCa&4)y3Yu6`xeMM#Wm#0zF>5
zHk!y$i)!d{c=myNR6Q>qM~h}3vid;uBiXN3Zs=llI|sdaSsD(V!1$+NDjlj%LRgbB
z-z4)&_41AkGt&39dWl!QSz(bhn;dQa!k0l_a#{JHHWu2(y)5eHLY&Z8^K3&2W2}Oe
zAFVi@$z5_@Hd)s#2M^{tl@g&HJ9+)}F`nFasa81B7OO<jcA_;k_9&Un$luQ;Up=Xd
z_Jz0ni}UAkv?|=Zyep%(I=-MjdNe#^`Q5;oqx^VRmn6xxXEhDx-_x<AQagCuFCEtq
zK1=s4EQ!l5;E5!4?>V}QhNqm8V$Yt-t0yyfbitgEF@T^=Mf*`MUBIzALPy3Fd!MN!
z7Qws3jblsX2V%Oym~p7bC72u@w&|+yXpuFtv2{JKd8mmY6sHqQ-uUW@P=sUYS2}*v
zl&iTJLyPU5gE4s{Un<4M4;&j=u)p~c+kd`9jpNEmVn$LLGR>T3R!xoI>vTQtbm5qk
zg}%qj4b5$pYu=YTx-xzbicjvoblGvJh_D`G@KW;H=&bz#TUA3ZOKn9D_iB`cyE=t;
zi4%IRioPCMN%|t^!4~7=E5huG()5@e%OFUe_RSIZ(9zI%N#}Rx%3BzG)mS23hO6%k
zI+ckwe2?Ysi&^rv8vLB^K~9&2#xdA2{@`HX(f9zem-jl3va6lBrf}<PeFx#hlpwqQ
zWI!neMQI{l;RErQnG~*`A%)STBK8p7(^A|QN?3aEEUYYYuN;`qaH+qlN2wK}HB{Nj
zKI(tdl9<A!x@d6eY9&KBd4@>{pLXgJ>C~I24D}_iF4JU(eYBI_2zzXxe0Ie9#t(0~
zH_Ipd*6AauQN20_1dk3Z_x4M>-&5Dq->}z~azPhzlFl<NO)O{Wet+eGbw9y~o9ZL=
z0{_n_(-NBD1niMF&J+k#tDUZjnK@|7i=$6s<zJ=D>ZXAmaP-(j0GZ$OSY^RvEyu6l
z%Cd<i2$iq9`dF$?`aH;?DQTLsaikFM=k6<MO-}o!S2#Nxyph|VVU=);!uJ93YIBeB
zU5iSJim_%3L7hDDQ%|iM2G<wYCbK_J6v<Of#WSj}uTD1DVxY<&cslt&q^e)Jhs%Dz
ztJ9J7zyi5e4!w`rfp-Rj{cD%Dhfs!af0gtu%szF%YgioFYdk#EYwUFYl?fN^`dA4Y
z-+v(_QhXr#p<H0b|B;nMW=(x|fOFSb^>}IAq1SJcKE-8(&k6DovoI&LpB)Qs5}aHW
zTH$HLMP8wpKZH+AD~lG8-=Q>wAy?*}FDh>SP>trgA6D?}0&NL{DXnaEbU+T%#Y6nL
z58Fr++;wad?>bqMVVIGg?B{;N+J|$M=ML$euPs5}t{*`&WUI6wS8h*<R^d-eBPI+w
zAj2Pou7WYcIHt@*_Yrs2#hU9TQ-{;Npyf=SC{5&8%+sG(Pw?WOPZVua=(6d1SP?Q{
zmzFmrYg6j+?anx7-bMMGoJgVDpYpHu1|_c)f17+Xw{kOuvM*a_aIUk=qF94JQO_3b
zOhs>DWb}YjWUrGcagLJ-*~IvRh_H7wkshuwH@aMTXLa9~m3Wo(pX<NyC`0#$1JTCd
z$@>FyLMi1H_-3r~%z}fjV^1{p<j4MKL0=}5Z|h|uNI{+?WEDIAx^YOrZ;sysU)`dC
z982(=c*qc=Nus15=0PzrIl6B4m@g;V#cnR&y6X@W?-DMCVRc;HIqAl^`?qKWH(U+0
zh!#Z>iZsLICc;mCoNQ4!HF&BXeYGtA<q4&{0$!IlQ{xhoq3**^L{5kVTc5IzPF2v#
zmb+l8>DQQ48zg<D7B#W2T(U<E$FL43Tqelg&rr8FyjHu@VEFun>l!HQD_C9l#^*jM
zoGIWf(R29_MYrrPozX-)#fs0%8to*x8ig_;8z*&%ioTXJNv=kjWWb=|E&1!=Fu_un
zk3`6Ch?_VWKd*DAu=u`pSYaPMT|8exb1^P@WMTTo$_;)(il>#Kky?~^HD8E7qV=~^
zo2f5*&a2)*yX>%>6Wc*V=Xv@R`r}>=qepYjbT~|nF0*2<ZG~RE7;q$-Fs83i$M?RI
zM)H{Jc?QYjSH&(O%6N>82ghUb1FGW+mD!AWfVvJz9Xa&$Q=M0Y{c>&%NYdwY%#ZgN
zn#-b&s__Vrw9XwK8xa-#F+^ghZ1Ul&iex+cQGW(fa!s6O0cr1b8`198@rCM@B`0!S
zmN~O1;d4j452O<O@KVYP#b!vY^sTq>I!`%6zD`+u$o=re%7n_y0;k36f-Fk<tHtrx
zt0q6TNJlBAjI4EtsFJ1TqYO_Bow`;v$9r*PGJ9jY$I1ac_EN7w1~o7<83wi$_ZBb(
z?Xf_*H6RFUd%|{Er3RR+VOOr6_70Nu(NC!1#AvUN=45&IuGLwqi<=wQJZ+ut6PoCC
zl?<tvrPSNEN6!~AbD}auN-OJ_>mB6#s&65$F-fmJUfz_E-{^MsTH7a)4-%+&xewT;
zwS)6->Ew$l7V^cNw=|txie+WEb-gKhkUi30HbLTuDsp1Ms&S9Q8ZlG$wJ(}M?_!2R
zCn|ACWRbPY+dEfqyKHr5e6mXEE-us2D%QrFCy#%ZAp5{2aq>WgFgvE*lk6eEh^vv)
zQ^9q&Q##KqkQ`r1tZejT)oal4GDDuu3ec$Wl*4%0km}Wgdg-X}Gvqr?;i5$GB{^&K
z=PWh`i7ZVONvgBOi9g$)TW3be^?a}Rc(VDk^vu(sv$9C>2GMm51^2J@fRcOf+<IUE
zrh0$Ae248RA>PK|*z<20TG(zLv)%l`+8rtW1^4%Z2;+S+v>a4)gP*Gi0A}Zly4T}*
z(D$PdSkP}vnm7Z~Odx8{3_8^;j(q_bA-?$P56s+L<59}H(E;5`nuJOir|S(r%BiR}
za+Y-64_}<)X1u&`H(I80zSe0nwTzZ@2#X=c@*=z010@rK^xF6mtdiPew=m*4lw`c-
zMRTdCGuZn)zoN<N6R3G8nb5XPW5zdnyQ?I~%oxAz8?qQC6u6JGrubNr`QWA7L}vQ3
z%Y1E$&1EHTO1(>TWRYhj`tgO{7D={=pm9nU_FqvZy>84Uy=-!l^K#Xz*^?ISGo{@h
z-dj2Qpga%4pb@RR*Z#^yA<w+<;R>F0vMF;|*gdnF=#w<uZ&0{9*=%vlyZBD@`*Vd1
zyv@OQ-l+DRj=T5t=ntR80p7cq)1ihpjgX6%ommepL=C*M_w~q@js8rXX0dThzxvgg
zX-c1~-%{)a4X#CJRx$)wjn}$8WvJ6k>HSWcNe4PA7OUo<aySU>Fy#2867Z4vYa0MJ
z612ny>meYDB}X6FoE$~L6*+Aqb@b5dWrKIRbG{1Msz7E+caPAL<IamkQ`|g8L<2Eu
zHtqObbac;_s1Is%)F|I$wI2H+>E3w@lu{WIK2cPU7gPYi+5!f)x4lS2#sy?6G1o8v
z0tR6jH6x>HAlvZg=hnk17CI@1P{PRg^$*<}EY0u6ENas}QNK24C>7^UHE7ClrjUc;
zKG9i6N$q$1$8t#nC?q8xk|<-CSTk2^6H}3x89kSqBR}X9%omFLK(EYj?tZ!?Y5p~?
zvIlisC+Va5^}~=qEv}t;V4rgDj*TXY1@=;`v2w@#NQO@KHjbotz8l^unYX=_Q?D&X
zn{h1Zwti1Dy-sghb=M!$19{jHjXjNb4DWgBj$JWjv(b!UK%FOmI(y4@f>0ehC%C>B
z8Pf(C02=2!Fe&?i!VRJy4dRECG;GF$xSu>Et?fKv{PK=PU&VEHwv)I=1sh(z^7ZwY
zal3m+N6B$6u*4FZyQ3pGg<pl9&jvm0HLt|$mqemd%@x)2{^)UN56i#BpYCl8W9m|3
za*R(uW~G>VqXviVt<|uvK_o}H5OW<fnt1X_#=N|lN2FR8K8<?DM=YL9T0fj{D`9fw
z-Xnq~zS&k^i9V;u!5li%BMTLzL&!cO@2jj|_j3{px=Lfnq^Q(|3W$u_-m@n{iM8>l
zdOl4`)_%Ulk;J^-oaAMKs7}?6W%6iMzB^=tE$W|$`E%!0)XsP_7AG>A%@z<-eDWjV
z@f305rV-T7?bPB_PtentwUuZiFvZTX1`Jl7LMakK&m?W$m~VcCJ&M6^X=uliB(`{@
z?&^h+>t!SQA<@bHaZ<u4*$-6=Ue;&4A3h)#G)AemBxjVwhEe|MRIm8==U?eYdCiqs
z2Z%SY_*Ae*ALFi8Q)HjCm{VV}kK~!1nQi}^GH`dLvG~iV-AupLhU3(!rCXZg>}txT
z>8|`Wp?xD|L*grAM3+@RT2O@_l6Fc#m*}-Fs>6^WWY+n3S`hr6C_cttCH1o1RTe<9
zBfwfg`LEr|)`s==5D*z74|zWsyviFq-{PNvl^B5KU_opl_K`*AgCR{6`MHv;7DrLm
zDle1C92&Me+F?m^k%OcbLl+sMPpRf>lTt^#6Atz=DY1^SDj{MwqRM`(9~^s_I-|2i
z^D7RYK3!Ao^y9J-`QT1NB6&yYFo7EsXB7fZ7coTPZD3uzuQFeEHaUQ?T`#d<Oy}4#
z9bUHISLI{GLV_)I<Z(EIrFsM<Qk^-yUs5i~2;Gq8qFrbhl6Esmd^mWib5eYy>Dkd(
zcVun8OXs<)Bs(;pJZ|=<)g4w0EEYg6qU%oK>d#5*%symxwvOy(XD3x?Q~R}7jJ3jn
z1E?H|%U{INjZz<dvUNG&#5{8)^21At4qLT}CzemH#tbs79{habu}D+99EVPGAG5>p
zP6-p7Xa2m4Sld%Vi2L;Pe)rlNXp~^!1M&NNo0LE&5}>ge);QY-hL1i6;uon1k=hI8
z7SO4fhQf;KZ{Ce2LibyV$YQ1nUe<r7Tlw^<@$<LbL5bx3Dl0VtkF^}4JWTntO)n=V
zVo(#QdSgq9suV|1B8%y!H(qFXs8hf{ifSi{OP|i@98gLaN9J>3RY-@6JXk{~h=?$&
z)69dEVJej?z`JVuNgo1c7-}e}LJF8+7%=($`+?%;lLE;@3~ZqD5TN_o1p-Fswt*Re
zK@{O?LalPIoBC)*k?M^DxMR=XbiWD9VA!Y($%@N3)Ke$D@@;T{&rNAIUF5!V-B$&t
zx829J`A=1vNiu2Hm^28>m{i--(TckFGulkillfspx5=3(-Y;U72~;m?p+iAu5^{Nh
zYih2fhrWR&8$UE|LH<&N%lzcT;6!#Ocd0e%l^<Fbr9R%kD)TKa(}3|Un^^j{bW{t3
z&o9**zWrwP<FP#1(l_O-!r&totpoDCN;GZrFAVKe>^-KEl-x#cqgK)DN}VCO^u87U
z7KO0p@&RoF91W6>9*4EcB_{H0%$;AUGtl9m=wU(Y)odflWR@@<9J}MqL_0I~a;8;{
zImCeb^_2p_!8m1?z%yf{+wIT@%m%$@?(&xbmgWnz#lL8W%`=Z6H@X>Q1DtrIIGS~4
z$fOC)Q>pPTdemDYSr=KEUY_Uk11X1i`LXS!f8bS}zzruQiJOVEOfEHMp|G5J^Iq*r
zSqpPKW+=CCzMK`c^`|%J9>IKfF`ML6jyiR`mO_5<nJGbSt=4(Yo}!hNs<Oe?fbl}f
z)T9B<pgzf&u)!X~#0QznJn|Zjyl?3}y{=Nq9=?1wf-=2D0ll)Ho_6W7zrBrM2>WBB
z$uml6t@#deIJQq_#;GVqpaC|BC-{4NLk1bR5oXCS46<8>L`p*5LGSH-J?JNY+P#>8
zwY8yvkrmYRaay;+t|70UKcLyRa|WNK(Ptb6W_Nae(@pfI{-!+FY_*-(pBkUz8zl(W
zQM+$Py(}$$EINerai9jVY!k|rcd8+CnwaaP{KGpV<%_M{>LAdN_nxxAXKz00rxviB
z9^&rMV*)>O+><wh3)l&dPK-_9$*5u=Td1-ol5E(HJj{_gMjNQPEYIBIPLj%B|Co}D
zKfb<L@#Tl3GBnlg<<u@x#f9Wj*nC{^eeRVThi{c0q*(RYHh74OO&K??tpKq30fXOL
zb`m(<ot!rll)z^KONrvc17ga8faOmVl?ZBv(y4k>Y$>^?u3U-uhoq09hX<|A1zqV5
z4kLY4^{R?s9OJ0}l8pU_Vs)=5v-`<HVd0q6ktazdq*e4VGwGxPTk}ugUSBnKy{?A#
ziK(4AdVsC_rGPZmDV02uL)`kIL6s%u)!ey$%~oeGE|T?fEiqnAPjL;gP!p7^2-LfQ
z_f@Ne<g&<ZVjnU)vW4*4G<CzHdUQjr_c2!8W)?1#A1tmAbiZI=z;NTiy(oHkmAu=(
zX7vEBnTTnxRbqCi1a~y|lV-o|2rK^O$<yDT#7Fz4g<1w{7I$jsD!aaq<e+0Y`Lgf2
zs9TTkrAZWd8NV#7G9(YG0*B{LFOv%z7mnR7V8qYP>0Z-z@1k#;$XD`|AZAV1!JMBj
z?^*~9BTTk$zDiBY${kX6<`~MC{tx(GbO$^~1&>{49OBBRJo&16;RT16ff~D=3?*B#
zKdQECv)3F|(XpzWnza@VR-ez*0#qepjKy~0m*lWGWAq>Ko^VOe?Wvuq5fN)d?-;dj
zu8~aVpWbK*LBlSRd@9^BeRt^-cRTwv$-o1Iv4b4XRy*_)-Ypm2oj(5&x$|~rg(!m+
zhGObv;*Olm`oi=pD3|Ke*~*`!P&Q)wxwaJB3d&5CyDVp2PsctNZ#=JIT)Hwzlz5;I
zzju)NZdMZI^2CR)`t8S`Vf!ApkhvLug?`j8PcD)3{ZX^@_yB@J)$h0u@OTdQ(bcbH
zS|$Ei3DjLLJ7O*$tUY4yFJsd+{;J#FMYfQl8|V6r1_35x@n>-x6#iN6c1y2}&$c~k
z@ltUsY!{d+TJklTEf+F^jBan3r92S*e#N<*<=AYklGxFh3M<yJ*<%{m>UAvCHJ)1L
z7H#-+2?q%9Ws*OfmS0~VjK`Obe|bmoHG1ka`3kMR-Q?R1igxvD14Xn}&s$b<<1Axd
znTg?b#8WY+XK*4b=H?GK&@h!*SzJLme7YJvNwRcywxD^2YrW?<xm)sE<ec%=1gQay
zgEa9KIJmVv;_VG(t%cR`XkP<^ZBUti_#Nrw4WMrya(KeT6?ye#$<*1Z$K1hmACUYl
z<zopmJ>pJUU9YT+Sko$SAkaR3QN<7a;;ZL$?ChgI^q$e4M3-y980E+){1jUf%Y8<f
z<C;uPn64YAa~&V$kBbG_mk&vLX7Z*esWCV|Y&Sj5jZt>(xZaciT4jfuSVbuhfrbJ_
z(#TY0{kJzu?M;@8=T1+zMm{|pJ}6-A6Yu?Pm$TNKd-sl@YEavuUFTM{l8u4i$^kxm
zpA`au%g_o_7l7gf+vVYa$jz;+i#8DjkPs8pZ*s#JkCBcV9<roQY(g=7f$9%Lm=K1d
zg`fE`r^lv{c&I-1QV(}dhkd%P^&;OvN;+a*nNhMcr!;&TBo`lkY(0!6J3DyWHvL+4
zaert`TF(5@^pM5;T0Gt}Zo5Qw?XAii#J$)+-f-F*{E{x!q`~rO5|E2#0FZ9)J0{z|
z3VnkL`F$X&Ycr=nF_2uopOet%n(x65!B$2x9$7Yh-EbPMn`wg$EQWRstTX<x*KAmd
z?#9IF=1uv&=eZI`^Y&#d&P6@Lu(2}lNj_rBwG4W_(9^2654D*px%mVH_;~o%7p;a9
zsIaTlg1bdEd@Ps*8!xeZz!3Zr*pg-+9dW;@W-<MRimB|~3uq%|`3gy*$#gjxilnIx
z*=CKCCk(Al6~tatCOLBook5I;?ZR<X@7A<s(W5jRxhki%jHx(V&S)vdiQWjkl!1NS
zGpwJEf?>g8aF8J@N@D4K=eN$w9Avhfx6VIq4l9UA$GtT$f2E`6v%BZz0MkYzp`*u>
zj}ZO18z-L7^)Q<5W_&YYWRGLr8WYpdO)le==cn?*8-%$zR!J@V>&IF=aywhxlyW20
z9u*=xTn~14<vE)9fn(v*xbs=^=xDsmw-wEb91FvXD=Uutq`Ha?V;Va0&+Q}&JB+U?
za*a5Ck680L>%)idmzYkmrm4M%)TS0hKZZR>m}XS_4)wYYM$*k(Y~9mD@j8B*iRa#+
z2oTV{iFYKta0PARghX!qV&_t>z%!|i{9du-IVpUalqa1TS!MC3-;j7ESX0Ss#IM|s
zdwqM=(>$X<?>kE`yYk605sBovDl+*;NwjyJeIGKM7WzyycE3Vnh-M)|yd3@YpzO1!
zTqDtyNd@_tW|pUJ)qGJ^7zpt4=0LuE_4LCq1M{}|gGUw!c%)*2Xolp^OWsh+=48LZ
ze<CUvyZiWUZp!2ONmWDMDb;x|xC-flXp<QETk1o#@A8a3Ef8tK)Oc<i#!t~?Y!N?5
zAQF@3CYPnGe7og@iC_aIM<2nxj&}q}=_=%hBrs&oe?0ZPDCR^nveWeWy5nc>G2IL0
z?jvL(i1ncF))^aOAU`7F(|yOrgH$Cl%O>tMjrh6aCwOQDZlQ@QG>HqJw~&{xj1Z4(
z6KC>zudYw56zYangcc#&*4bKne4|o6KjbE#o<n#`_uJgDW%YpZWfOM{MXJk-M(fk$
zL^+IaiqU*YTfcFsgc^Caq2YO%#2enL752<`3M1m|w-tRTZtq0D@`g$9v!~?wr?f>w
zMBXM?5_!VoF2UlAYh#R^1_f*(hLtjFGr^Z<?4MQJUtIV=!@)BvGU$8fjgi#)N}@5g
zm!$de4pU^Gt2tjAC$BuT;w4^)C>DRg&g2!mLE}tPDlQ|w#C<q!lvC6@OHjq|aCP9A
zm{bv&%=s{ERuLV`wh)qQXJ4T+p--16N#)ywMT$(@=u@8Kn$>w+ojgpoAlv#DgW%%q
zXrb8;;rfhL{m@X9$In=)gKs3_Gg3(xX4lkK6X2l*(z#HXGE!W=l^dXaZCtYKM)<VC
z++F#~H>V1y^H@{LG(yVjdYpso1?>#G_&j+nto$zw`(8<YMZUJGHaBzJmWC<@m)OO{
zn!|{oBX?D>DOS^sK@*3(Idk2w$W1VWigK3po02td<M`Sfe>vtyv;M_=j$3r+6>1bn
zl~|NQ?z6oX7{6(eW<nm}*<E`xz(MhHBC5E1?39@0RW##L$KI?8HV<OooF6ko3Z7jL
z(Mu`)1|E_Hsfwl!M1&V(xXbt4j*=KCZV2`Xh<qiJN=lhOlAifAMLt$sPTBM5cyS~l
zv5)jQu_6iLRQqhB4Pyy;DZgTFlZYxz&vF}_&xW?;H`%g2^uBNUWY>K4N5Pv54oH|<
zMG*qUdf#sg%}l(z>3Z+`t=ErmT$BZm<%_ZNzFu@bU-yG0Yj|J-XR-nHR<t_LNqthv
zpwiE4#?j&eQ{;(n*Y0%Pb3R)?RDrFlaBN6P4j)gvoKecymr0PJ?^XLzW&!V$S=v^V
zRFxwdt4X-SV^KUW9)FYx$#$q&XP7jSza5t>*2bJWzGOS^8cEEakd2o>$=m0yaOz>J
z_uQ0^;MY@M*hdDeFZ$*Ax;eR-nhZ}AJU!>ctfiByJw*EP<;z@}YT4XxkpefWjt&~}
zis$?wM+-n!%&8#N)bu)nGCOvBMBn={YKq%QE#7Blu_SGz1{D#Z0@*`Eb-{%!uaAs-
zcv7*9`4v)m*`(N!k%|k-CM&Kh6jIYKiM@0f!^WY=;)xa|>aJE<bg`K=m(ZIR_nfU6
zX*lP`uXnNf`}0oOKzaPY!2Zs$kyT7|^FW7(lek7-P|Q(_zkX|`#~pWPs{0^W_AOwM
z_cBLn>!W8L0&?#|ODl|s-qWAEL}D*@$;h#<#$W5Uv2vp7T}keIdIQtCG^$kbJGoCE
z$ustZlFi{J<wW4bvtT94T2>NMT(}f+_*j6*GPTx;nmq2Dh=gW~T!Rd+G70&{nmW?^
zMvT`+-E-#-QOq2SCQCzq@g)&YjO^Z58cNaJs#Tp^OgD~LPvv)<t+-)M=jzdN=z-hg
z;#(F2bXszj6t!>j1B;HXfAc7D9bIGmoS^1FX0y(A;`PX^!BY+9tW-mbpc{$8vmrgj
z!>co<)Lz(l#A3ZEhG9OZAANqOJaUKv>xB@7Lo@MImyuOdHr^r1Bg9kD?W@^i0xHzD
zxOF-M#;+yDBflmYC|~`WUd7Ih-R`SHBfX(R<Nsw8|G`a#@hKjH7w0q^uXTTzPU)l&
z_NeOTx+u%{gL1Xrz<%mts}TC6)7*~z^>&5GSB$`GEqAQ_tnCm?0Di8oq3h}%4SA=2
zPJDq|&kP&s`7)KR@qS8w>HMJYrRGCgHzv9yGHOT0nvg?;NX%C3U*`r6iu9dTUma~v
z`ig%G)pfP9^xKVNRnkK^$ySBMKus%FUY=u><S9?TA%Djd>5|pLJeaX~+U5h#kMT}a
z(XryzeCI?l^$Bya_BWx{!EMb*f|)KV39K@TL!oELo@dsLswx!p9DUG0B=afVQHm!k
zQ1lcq{<phF(;0i(#1Wc=<j43N{aDX*6}9R)ndk69U1CE0seA4|hl8Th>Rz>Yjrx$`
za@~?Yg)*krKd#i1Ffi}w=);quTSfPVZASH8J5T<a7ag;*p0x-`Kz!Iie|5tn%Uar5
z9C^o9p39thF^-hX@?Ao6>@2jZ)i~e%b5z;WI#dJaF|LdrlQX?CzvRxDgu~sO(ER=5
zL>F1rRXe-Jt}kPbXk4ZCJ{*;at@K=~o?nqhKU`RIVXq`XiZxY3r;Ic~Lsfm8nuxw&
z8cKdB_z^WvU=owDM0bk`-Hk)C>wYCCB=p-KWsg?zq9i&Ur|a#+qSX8B?vQQ}8~t)M
zIW$for6BHJzF{P(&0H4_OQ%cr)3dc-yG~Gt_IW-zf=Bc4soID7%%gh!T|YX`NtaB1
zmNZBu_>|k++G&wZSUSI4e9J{JWK|1zhu2!iWxzVYU-0;ZdvF>?TR}8kx$rYO!sloy
z=rJbg=x8>CFY-_;OZev`t|xHQtqL1g5!}CBo6Wkw&#*RC&^j&s-Sv*K2Oj0E7Z=VB
zaunfVuG^58Sn+!i4Sbgkb`7J`u~5VOw3Jy;nHl)rd3-=S=m7m&@66?I&V<?)_Ycbd
z;CO8_u8CVk*NlwiEIeE~b(&OyXJp3BrO`FTLnFo7`%04A*huVpYo1hVbn_uwj0R!p
zXS$;c^fB&EMKOtmICT<XBiY@|&MqvklLN8BPR&iwuJ_t!ja}B^rW3&WtTsT7S6geT
zUwkX}Men^%dwWx>kI6+B{T&wL4IJCe=c^_*jxcrjrY$j|lab$Ei66smJuDmBd^fxV
zt-MvHj<$hL>SGH7vpfHjZdr1)!<^?%bnzI_9+?p)q7oQ8uB(3~YAm;jRtb+#`0VBT
zT=kqQlj3$OrFZCMBG^0c`9H^HjTtmAWUt_+Rjw|4Ue_!#sZBekjN1C-M|?6l^T6$J
z>HDL7Ys}1IlN*Yb?1N)N%~S8Q>6Nwh9?tQV_Afa5(&bL|rw~of+9j13_2DXt-1b~D
z<XT<{u(yx8$TgIwI^EfOk}-&X-qub>S}BtnJ^vC?xx@0QxtHjp&nB5a@^m){nY^bA
z#JzsO7{hMG(y4}__xw^>f3=-FU;ly-Sz;-rtiphU+}i4M&KCu`x$>B}Q%R!SIUJ1q
z6Df}aFHc8BYWr3%J;I;+ntMkh-K4Gf)%15KnfHmK2aR7FCwvEvDj}m#A|c*9Btkj?
zEaD*l;BQ`jvwen%L<RjjG7<?=-f1nhJmy~Hr}PE~QrLQtVc$3Jv%O5zZq{cO!UMuz
zfjt}Qt@}WJ=Pd9+yiF%3Ehes@D$e5U?hL*q5(bYd8EG%_eFa3fMEq#Sw{8h}w8sDl
z;#=A|nw<gP>*m#q(8nuQC_10~%j0d{YiG3dDY$!m-1S~NDB$khv_ggqk+hzi9D0SZ
z?AC;=aQ9{h9(Knan9s4Wvv8b&Jm-$ToG~;puyukXfZY-H^sw){5pcs1`0azh6iCft
z=jgEql5I0%a}Ihd3AC^r@R8agp#r|W{tFUFC25IGD(Gknwh)*#>Rd8}b^v&dw#iPd
zV#R3#9FSvhYH(zMhxgt}FpZ=vOdJgyjm#~K46Ofzl1$oYSIVc;Ss{>@|4P6|9*$Cx
zVE>fTwieE?#7bLLxe<wY1lxF5ygP#-vzh=JB=3_F9Nr-yvUG<*|EH<LM3e)vTtK2Y
z{zSm8&xi;&9l_4Ry=S%v0oy}*xi>;PJ7>5a5PDn#3E~ZIi)>!u?F_Nk<AMVq1&nbI
z5<vg}n+NKkn81O+Zk+A1=@MbzcXJBja3J>k2QhGQwgdJIH;)|uHI@P#R@cA6+B&2M
zHgT9tdy!28j!)?5zS|F8wk<xOzKE-}3A~-bIBzE-YTj*sMw3$-{~a)Eci=^g<rXIu
z@Lvl5Z=B+`#`bm=w$9*{4_ITEFZOt1g20U+?xX@+?2t~%MZ9;7e`}JqLE6wRi_WG4
zy~4UMcy0vAW~Y+&=t>rFb1C4h--Rt4h?KE^i=%1}iNh5I`Z8#H{g*L}H|ZnC$jM%0
z7%=R*TbG6(=W|K+tlO3qf?IHR>qG42gtsJvv>@`a{gdq0AByUB?+?M<*Ww_NF&)6i
zWQ&Lj_;%?Z5P@3n=gX0wec)$um0y|^))f@IOc8X2&29{_J-YRS7BK)MB+0QX9Jbl<
zJqx*QZ2%<HM?-T&`~nBFw}2d3XvYZA+Ps48ZRcRhz6A$qWdqW^zyTu$^eq$E(m3R8
zq4$PeVV1WW1H7*&*cSsR1PY8pD&+>nfn8x(JAK96Ox9V*tF}epBe5k374Qw4Y(J8K
za1hSSU`-{i>ICIeW!}8*<jNQRg6juRK%y5E;kby&|B~y^Y)RD)UO+G)B(&m^NVP;4
z0QUwkbZIz1REqro{@NpdF>_cSJY{0`+dc?E3+1!^>I|So0w4HUtsv!JqKUf#C)AZ(
z46QAk%zvKK23sABkU-IVS3<f$emV(&4pQ>+Je+t`RQn;62Ws~jn3<?<SI9<0_3V-b
z0xHDAIQ(3@X^&Kn@KfBF1aGLZV^(fn|HL=&Zpi}iPe-ZuCJO)n>WN@6YHs;MSzuQf
z8`!>O)g4rrq$9Py0(X`L=3|muEPxJ3Hh;w;Vr^mIB=Iu_3Jiwy?LB?(@m^#Y80@+U
zhIpvv*aCxy)Jn5wkxXn|5zhMmYji%~c2rLWxFuw5E3*Yb1$-l?-4}$ot*eEjovjVf
zy~GUcx6S~-3G{QHikQRdw`RQaun+tw_iFEKK)F^h!>d_c=>FAz>670e#EK8RoG3rE
zbKis#*c1HoRU@pltF*1Xi!*Qt%*4RvKRS7*m^A`*w$~Z9r%aaXfVhcSBFI5B*ajt}
z<>DFkLk0x*?e29rO>B1sf-n6G1}bL#8z4|2U~mh<T=a&E9TW@JqPul7cweN?wjV55
zab7SB?A|bIf_(@3BFKOSUm6%J(UZSofwdi?Lcw58m}YsG>=9_TZCmgKe!-kK+4rm&
zG`{=y<$e+IrPEj<Fg3)k^W2v0LtN)K;3VIl_eztk3YNP%hu<|Pd`(@jObTcBiGjFq
zAtH@j?HzV)L-^vkU^o;Y7<ykCZNtF_&?3TP)ppz!556)k7_WZccw4Rc+ZpE<GN)as
z;7iqlshWYf!2OA~MFn&OU?Kfmwgxn31Z;?n9^R3~aP5-~S~M2idN4~z?8p$ah{1Kh
z4}Zl1>^E-~u>EtWZLbAi<`&#|GC;WEz8Vj{s_t)#-hydiKGt{s&zn;ePC^ZyzoPwF
zmKMykd$VpU2w%JwtYFDMVcM;fEtnUkp+uhxf-bSm3tvDM%saySFEmu$wVW&>V&r;P
z1jL9t4*b%rjc+f+=0Iv(gkx6J$Ib0HSd;HI9pZ#DyW{+O2Kad{1S|yXzKA)tn-0F-
zEV$`x_sy|+xC4?66n0YOx6amN`Z9uc+Qx$~{0hbk64<j$5F$`PIj~$XOMe;Swkr>O
z;Z!hBH;`)J&wU%zZXi71GOCDx!V=tf1%j`M3I+-X(qilb2vi{z5s!+t$F4l^Wlh06
z7lil41N41ZkyAuGSXQ39^1v691oJqE?V0E2p7wv(P_LTTu1N5u5y42DK$V(3HW{pk
z{RdOTRc{1Lf8r07fPJ+;XM$E01h><l`XTs2hG0=r_73n%Swk=ptg8=o`|MMa4IqN!
z&n1CY?gInBBym4n42{`=ec!oCg)bHemP8KN=iDOzT<JhC4NQ)^RldKKV`l^r{5BaO
z5X|!DG+PC(zz}>zC!rxkuq!OI2s~=;gxKC}fh;&p_6Gs+!?2=hV4$!CIw;VcM-0%b
z8w&;W3T`9F>nZrsYT!1i{d*wD_^?Z%H83yiHHaz6rjRiH-2{Y>zIYFu=iEmtLTaCZ
zL8@4ophCf}uom4Z9DIc|uyALAJ<xrE{As;3FfdHHQgwK6uyQ+hLE-KHu;N~T5x!PN
zQ`U!WgCcebh}|^&+S71<5Wt&9;5{f@3&PydURdDcXUhMI<u~scc9&>-#t2`L4QyEC
zO8aW3pAvzv;LC{sRZS4qX9F7<%*h@Z@<-rgx8dOnse$2XmH#okDuR-7h>+jS2keRr
zUl9$Aj02p||MQN#)h~Y4`%h70`T}=Fg)epnMjiOqsIYg!yX-Tm)dxXoVTKL%kdRGk
z_^M@K+FI3rEbKNdxP}=bYdHKU7y&e52ethc8!|xGtNkNr$RSoR8caW!zk+?=sV97K
zGO(Vf)&C(H%sIfvzo>vqm4WGDp5b*u$R7)<0=Hja2;`IaC*2Gp>{bOYFe6OS|56yf
zt{7P1&i@M|WPSwm4Zq!C(2EWIV`0_dgq;Q=dH<QPn_g|R0u~}|9l19b12C<3S}%N^
zEU>nETK^|Zm?dv|hd-&B1%5D?VIT1hL!kfmkOyDM3jAR4KsfsUMSs|XLF{MS_5Id@
zl=ZLf`ULO=q`*%wbn*ZE1iO@zLev(74w1V)34E<4@RJDX{-2)Yk1IDJdY%{B*LHm#
z_)16M=jqV<htC7{L*Tkch>(;0uk4BpUx^5eJa*}CkayH2LWHKU;s-^8EdX{~0l}{w
zOZE4K_Pde%zkDHl6(X=k*arIs`Hz}Jhy-(wjoP&>;cE+lIS2R82^;Ws7EM9~$n71C
z01)wPjUR68OETQIkkI_fU>ewvhPYV~(`*OvLFSH2e@O$Y5QK<ID5DIz3kRdzIq<?)
zDgrm6y3yZh1fznVDgJgC3Kfd^<Hm#!#-KFb6X<pY9YlIvyS6|8Ip^~`z2J)%f%S6S
zF9v)mBQO+fk}<##i$I&rNye}BguqbFCi~O|m^gr|3xTOZ>X7hsnR<~ud9MGK3bMk3
zFWdvBN;lmn6}XHK7zrkn5N#X+q|H9KbAuKBy=a2jUXXrq0!2rjK=%b<S0Q63=#Ce-
zyZu^;2dv51-T@HS<pIm$M|{ENHE^)xh}C^49X9gj6-)(bDfp@~V5&zJdzJ;7AqlR=
z3>XR4Qa?E2p)G|-s9#G~fRV;*_KdW%fCU)HPtN#NFQ8GrbrDn}*cGhNuNnElKsOxr
z474*pKOB(6%qj#3W=gQ@CJ^HBgavMNBXrse(9UVfSiK9>bk8(zjvVkUg!umOJI4BZ
zzCScOEm#EDO?QL%H5opvRUm_E!TumX`=DT+19zsO)&aZ1_`p{3YXW^34;8?J<Gj~K
z*_pC;M>>5l9@0>YLq8A<-mKXG#Wca(yn^w5%^MHKD|Y!?Ja86yIJVd<t=9nC`qLMi
z65iOng4rNW2tGYLn9b7lZ`poH77qvbGf@1=`5V7=Nf1Ez4DDdRP`AGZ+>x&x5ub^7
z!mfPqNzcK2J??+Y_j3}rmAe-apOjGIZ~1=BE)M3y_WVbDzq3KV+r5$R0iQbIn)F*l
zNE5^7*ajos^ZHka+ZneJi5UIp=5Gmq&5aEvyzc#v2%(YGzs%G9E+4)Nkx)MI)^7oS
zO&SdbB=z}wz#S>1!3z4NkR?NWV0;_AtKMzggkMOA`0f=DL1fzQ!{_$KAbgHzuugIN
z#rWAt;W9ph6@tyZ-dUymwh1A<06vQ|7){=9p9*co@xbMDMg*7Zow_R=e2!)?9Jc@d
z;SgqQMuaC4d3#qp_~gi7JobRUz=KPbjED;}H4VxIGr!%e9zGz`3OF|X=ljr**&?vn
z|I2w^*nMFWHrV%_qda`RTChIP_RVqOx7lkEDV6y>{g0J`KV=^ivR9?H)5d{GVA}kb
zR`5A%!CFoJ1<9`&Y{6_WA7MO^fk35g_XVF$56m`oZT~85vHf&qzl=gKykhU{9e4-P
UfJruz5Ad%hka^zwI^^5`0C;tDe*gdg


From d269a7e717c343c34a82e0d366ab8547cb1a873e Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 15 Apr 2021 19:33:15 +0800
Subject: [PATCH 280/433] CWE-598 reduction

---
 .../Security/CWE/CWE-598/SensitiveGetQuery.ql      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
index c381595af14b..f0f2fe905f7b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -2,6 +2,8 @@
  * @name Sensitive GET Query
  * @description Use of GET request method with sensitive query strings.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/sensitive-query-with-get
  * @tags security
  *       external/cwe-598
@@ -23,6 +25,16 @@ class SensitiveInfoExpr extends Expr {
   }
 }
 
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private predicate isGetServletMethod(Method m) {
+  isServletRequestMethod(m) and m.getName() = "doGet"
+}
+
+/** The `doGet` method of `HttpServlet`. */
+class DoGetServletMethod extends Method {
+  DoGetServletMethod() { isGetServletMethod(this) }
+}
+
 /** Holds if `ma` is (perhaps indirectly) called from the `doGet` method of `HttpServlet`. */
 predicate isReachableFromServletDoGet(MethodAccess ma) {
   ma.getEnclosingCallable() instanceof DoGetServletMethod
@@ -64,4 +76,4 @@ from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveGetQueryConfig
 where c.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
   "$@ uses the GET request method to transmit sensitive information.", source.getNode(),
-  "This request"
+  "This request"
\ No newline at end of file

From 0e183ab4a48acc09add7ef400b535b0159a807cc Mon Sep 17 00:00:00 2001
From: haby0 <ha_yub@163.com>
Date: Thu, 15 Apr 2021 19:49:06 +0800
Subject: [PATCH 281/433] Finish comment

---
 .../experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll    | 3 ++-
 .../src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 8c7433fd1b69..1bef46f99d05 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -13,8 +13,9 @@ import semmle.code.java.frameworks.spring.SpringController
 abstract class RequestGetMethod extends Method {
   RequestGetMethod() {
     not exists(MethodAccess ma |
+      // Exclude apparent GET handlers that read a request entity, because this is the principle of JSONP.
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
-      any(this).polyCalls*(ma.getEnclosingCallable())
+      this.polyCalls*(ma.getEnclosingCallable())
     )
   }
 }
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
index f0f2fe905f7b..a9528ee2f9b0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -76,4 +76,4 @@ from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveGetQueryConfig
 where c.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
   "$@ uses the GET request method to transmit sensitive information.", source.getNode(),
-  "This request"
\ No newline at end of file
+  "This request"

From 7fbc62358e11ba18c4c5bbbe4f471e665c112125 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Thu, 15 Apr 2021 13:57:44 +0200
Subject: [PATCH 282/433] C++: Accept test changes after making the
 exprMightOverFlow predicates more sound.

---
 .../CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected | 1 +
 .../test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
index cbaf5d630795..77b08e62d838 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
@@ -3,4 +3,5 @@
 | test.c:50:3:50:5 | sc3 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:49:9:49:16 | 127 | Extreme value |
 | test.c:59:3:59:5 | sc6 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value |
 | test.c:63:3:63:5 | sc8 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value |
+| test.c:75:3:75:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
 | test.c:124:9:124:9 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:118:17:118:23 | 2147483647 | Extreme value |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
index 8760641c8e2d..ee2e041db3c3 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
@@ -72,7 +72,7 @@ void test_negatives() {
   signed char sc1, sc2, sc3, sc4, sc5, sc6, sc7, sc8;
 
   sc1 = CHAR_MAX;
-  sc1 += 0; // GOOD
+  sc1 += 0; // GOOD [FALSE POSITIVE]
   sc1 += -1; // GOOD
   sc2 = CHAR_MIN;
   sc2 += -1; // BAD [NOT DETECTED]

From b359205d17c6fa39c3ad36c41df9f69d237cde76 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Thu, 15 Apr 2021 13:37:11 +0200
Subject: [PATCH 283/433] Python: Add taint tests for .get() in flask

---
 .../frameworks/flask/TestTaint.expected       | 162 +++++++++---------
 .../frameworks/flask/taint_test.py            |   8 +
 2 files changed, 93 insertions(+), 77 deletions(-)

diff --git a/python/ql/test/library-tests/frameworks/flask/TestTaint.expected b/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
index 8c3b4ea57c9d..1d514b934e2b 100644
--- a/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
+++ b/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
@@ -19,80 +19,88 @@
 | taint_test.py:36 | ok   | test_taint | request.access_route[0] |
 | taint_test.py:39 | ok   | test_taint | request.args |
 | taint_test.py:40 | ok   | test_taint | request.args['key'] |
-| taint_test.py:41 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:44 | ok   | test_taint | request.authorization |
-| taint_test.py:45 | ok   | test_taint | request.authorization['username'] |
-| taint_test.py:46 | fail | test_taint | request.authorization.username |
-| taint_test.py:49 | ok   | test_taint | request.cache_control |
-| taint_test.py:51 | fail | test_taint | request.cache_control.max_age |
-| taint_test.py:52 | fail | test_taint | request.cache_control.max_stale |
-| taint_test.py:53 | fail | test_taint | request.cache_control.min_fresh |
-| taint_test.py:55 | ok   | test_taint | request.content_encoding |
-| taint_test.py:57 | ok   | test_taint | request.content_md5 |
-| taint_test.py:59 | ok   | test_taint | request.content_type |
-| taint_test.py:62 | ok   | test_taint | request.cookies |
-| taint_test.py:63 | ok   | test_taint | request.cookies['key'] |
-| taint_test.py:65 | ok   | test_taint | request.data |
-| taint_test.py:68 | ok   | test_taint | request.files |
-| taint_test.py:69 | ok   | test_taint | request.files['key'] |
-| taint_test.py:70 | fail | test_taint | request.files['key'].filename |
-| taint_test.py:71 | fail | test_taint | request.files['key'].stream |
-| taint_test.py:72 | ok   | test_taint | request.files.getlist(..) |
-| taint_test.py:73 | fail | test_taint | request.files.getlist(..)[0].filename |
-| taint_test.py:74 | fail | test_taint | request.files.getlist(..)[0].stream |
-| taint_test.py:77 | ok   | test_taint | request.form |
-| taint_test.py:78 | ok   | test_taint | request.form['key'] |
-| taint_test.py:79 | ok   | test_taint | request.form.getlist(..) |
-| taint_test.py:81 | ok   | test_taint | request.get_data() |
-| taint_test.py:83 | ok   | test_taint | request.get_json() |
-| taint_test.py:84 | ok   | test_taint | request.get_json()['foo'] |
-| taint_test.py:85 | ok   | test_taint | request.get_json()['foo']['bar'] |
-| taint_test.py:89 | ok   | test_taint | request.headers |
-| taint_test.py:90 | ok   | test_taint | request.headers['key'] |
-| taint_test.py:91 | fail | test_taint | request.headers.get_all(..) |
-| taint_test.py:92 | fail | test_taint | request.headers.getlist(..) |
-| taint_test.py:93 | ok   | test_taint | list(..) |
-| taint_test.py:94 | fail | test_taint | request.headers.to_wsgi_list() |
-| taint_test.py:96 | ok   | test_taint | request.json |
-| taint_test.py:97 | ok   | test_taint | request.json['foo'] |
-| taint_test.py:98 | ok   | test_taint | request.json['foo']['bar'] |
-| taint_test.py:100 | ok   | test_taint | request.method |
-| taint_test.py:102 | ok   | test_taint | request.mimetype |
-| taint_test.py:104 | ok   | test_taint | request.mimetype_params |
-| taint_test.py:106 | ok   | test_taint | request.origin |
-| taint_test.py:109 | ok   | test_taint | request.pragma |
-| taint_test.py:111 | ok   | test_taint | request.query_string |
-| taint_test.py:113 | ok   | test_taint | request.referrer |
-| taint_test.py:115 | ok   | test_taint | request.remote_addr |
-| taint_test.py:117 | ok   | test_taint | request.remote_user |
-| taint_test.py:120 | ok   | test_taint | request.stream |
-| taint_test.py:121 | ok   | test_taint | request.input_stream |
-| taint_test.py:123 | ok   | test_taint | request.url |
-| taint_test.py:125 | ok   | test_taint | request.user_agent |
-| taint_test.py:128 | ok   | test_taint | request.values |
-| taint_test.py:129 | ok   | test_taint | request.values['key'] |
-| taint_test.py:130 | ok   | test_taint | request.values.getlist(..) |
-| taint_test.py:133 | ok   | test_taint | request.view_args |
-| taint_test.py:134 | ok   | test_taint | request.view_args['key'] |
-| taint_test.py:138 | ok   | test_taint | request.script_root |
-| taint_test.py:139 | ok   | test_taint | request.url_root |
-| taint_test.py:143 | ok   | test_taint | request.charset |
-| taint_test.py:144 | ok   | test_taint | request.url_charset |
-| taint_test.py:148 | ok   | test_taint | request.date |
-| taint_test.py:151 | ok   | test_taint | request.endpoint |
-| taint_test.py:156 | ok   | test_taint | request.host |
-| taint_test.py:157 | ok   | test_taint | request.host_url |
-| taint_test.py:159 | ok   | test_taint | request.scheme |
-| taint_test.py:161 | ok   | test_taint | request.script_root |
-| taint_test.py:169 | ok   | test_taint | request.args |
-| taint_test.py:170 | ok   | test_taint | a |
-| taint_test.py:171 | ok   | test_taint | b |
-| taint_test.py:173 | ok   | test_taint | request.args['key'] |
-| taint_test.py:174 | ok   | test_taint | a['key'] |
-| taint_test.py:175 | ok   | test_taint | b['key'] |
-| taint_test.py:177 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:178 | ok   | test_taint | a.getlist(..) |
-| taint_test.py:179 | ok   | test_taint | b.getlist(..) |
-| taint_test.py:180 | ok   | test_taint | gl(..) |
-| taint_test.py:187 | ok   | test_taint | req.path |
-| taint_test.py:188 | ok   | test_taint | gd() |
+| taint_test.py:41 | ok   | test_taint | request.args.get(..) |
+| taint_test.py:42 | ok   | test_taint | request.args.getlist(..) |
+| taint_test.py:45 | ok   | test_taint | request.authorization |
+| taint_test.py:46 | ok   | test_taint | request.authorization['username'] |
+| taint_test.py:47 | fail | test_taint | request.authorization.username |
+| taint_test.py:50 | ok   | test_taint | request.cache_control |
+| taint_test.py:52 | fail | test_taint | request.cache_control.max_age |
+| taint_test.py:53 | fail | test_taint | request.cache_control.max_stale |
+| taint_test.py:54 | fail | test_taint | request.cache_control.min_fresh |
+| taint_test.py:56 | ok   | test_taint | request.content_encoding |
+| taint_test.py:58 | ok   | test_taint | request.content_md5 |
+| taint_test.py:60 | ok   | test_taint | request.content_type |
+| taint_test.py:63 | ok   | test_taint | request.cookies |
+| taint_test.py:64 | ok   | test_taint | request.cookies['key'] |
+| taint_test.py:66 | ok   | test_taint | request.data |
+| taint_test.py:69 | ok   | test_taint | request.files |
+| taint_test.py:70 | ok   | test_taint | request.files['key'] |
+| taint_test.py:71 | fail | test_taint | request.files['key'].filename |
+| taint_test.py:72 | fail | test_taint | request.files['key'].stream |
+| taint_test.py:73 | ok   | test_taint | request.files.get(..) |
+| taint_test.py:74 | fail | test_taint | request.files.get(..).filename |
+| taint_test.py:75 | fail | test_taint | request.files.get(..).stream |
+| taint_test.py:76 | ok   | test_taint | request.files.getlist(..) |
+| taint_test.py:77 | fail | test_taint | request.files.getlist(..)[0].filename |
+| taint_test.py:78 | fail | test_taint | request.files.getlist(..)[0].stream |
+| taint_test.py:81 | ok   | test_taint | request.form |
+| taint_test.py:82 | ok   | test_taint | request.form['key'] |
+| taint_test.py:83 | ok   | test_taint | request.form.get(..) |
+| taint_test.py:84 | ok   | test_taint | request.form.getlist(..) |
+| taint_test.py:86 | ok   | test_taint | request.get_data() |
+| taint_test.py:88 | ok   | test_taint | request.get_json() |
+| taint_test.py:89 | ok   | test_taint | request.get_json()['foo'] |
+| taint_test.py:90 | ok   | test_taint | request.get_json()['foo']['bar'] |
+| taint_test.py:94 | ok   | test_taint | request.headers |
+| taint_test.py:95 | ok   | test_taint | request.headers['key'] |
+| taint_test.py:96 | ok   | test_taint | request.headers.get(..) |
+| taint_test.py:97 | fail | test_taint | request.headers.get_all(..) |
+| taint_test.py:98 | fail | test_taint | request.headers.getlist(..) |
+| taint_test.py:99 | ok   | test_taint | list(..) |
+| taint_test.py:100 | fail | test_taint | request.headers.to_wsgi_list() |
+| taint_test.py:102 | ok   | test_taint | request.json |
+| taint_test.py:103 | ok   | test_taint | request.json['foo'] |
+| taint_test.py:104 | ok   | test_taint | request.json['foo']['bar'] |
+| taint_test.py:106 | ok   | test_taint | request.method |
+| taint_test.py:108 | ok   | test_taint | request.mimetype |
+| taint_test.py:110 | ok   | test_taint | request.mimetype_params |
+| taint_test.py:112 | ok   | test_taint | request.origin |
+| taint_test.py:115 | ok   | test_taint | request.pragma |
+| taint_test.py:117 | ok   | test_taint | request.query_string |
+| taint_test.py:119 | ok   | test_taint | request.referrer |
+| taint_test.py:121 | ok   | test_taint | request.remote_addr |
+| taint_test.py:123 | ok   | test_taint | request.remote_user |
+| taint_test.py:126 | ok   | test_taint | request.stream |
+| taint_test.py:127 | ok   | test_taint | request.input_stream |
+| taint_test.py:129 | ok   | test_taint | request.url |
+| taint_test.py:131 | ok   | test_taint | request.user_agent |
+| taint_test.py:134 | ok   | test_taint | request.values |
+| taint_test.py:135 | ok   | test_taint | request.values['key'] |
+| taint_test.py:136 | ok   | test_taint | request.values.get(..) |
+| taint_test.py:137 | ok   | test_taint | request.values.getlist(..) |
+| taint_test.py:140 | ok   | test_taint | request.view_args |
+| taint_test.py:141 | ok   | test_taint | request.view_args['key'] |
+| taint_test.py:142 | ok   | test_taint | request.view_args.get(..) |
+| taint_test.py:146 | ok   | test_taint | request.script_root |
+| taint_test.py:147 | ok   | test_taint | request.url_root |
+| taint_test.py:151 | ok   | test_taint | request.charset |
+| taint_test.py:152 | ok   | test_taint | request.url_charset |
+| taint_test.py:156 | ok   | test_taint | request.date |
+| taint_test.py:159 | ok   | test_taint | request.endpoint |
+| taint_test.py:164 | ok   | test_taint | request.host |
+| taint_test.py:165 | ok   | test_taint | request.host_url |
+| taint_test.py:167 | ok   | test_taint | request.scheme |
+| taint_test.py:169 | ok   | test_taint | request.script_root |
+| taint_test.py:177 | ok   | test_taint | request.args |
+| taint_test.py:178 | ok   | test_taint | a |
+| taint_test.py:179 | ok   | test_taint | b |
+| taint_test.py:181 | ok   | test_taint | request.args['key'] |
+| taint_test.py:182 | ok   | test_taint | a['key'] |
+| taint_test.py:183 | ok   | test_taint | b['key'] |
+| taint_test.py:185 | ok   | test_taint | request.args.getlist(..) |
+| taint_test.py:186 | ok   | test_taint | a.getlist(..) |
+| taint_test.py:187 | ok   | test_taint | b.getlist(..) |
+| taint_test.py:188 | ok   | test_taint | gl(..) |
+| taint_test.py:195 | ok   | test_taint | req.path |
+| taint_test.py:196 | ok   | test_taint | gd() |
diff --git a/python/ql/test/library-tests/frameworks/flask/taint_test.py b/python/ql/test/library-tests/frameworks/flask/taint_test.py
index 31c0c7e6121b..986bbcfec79e 100644
--- a/python/ql/test/library-tests/frameworks/flask/taint_test.py
+++ b/python/ql/test/library-tests/frameworks/flask/taint_test.py
@@ -38,6 +38,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
         request.args,
         request.args['key'],
+        request.args.get('key'),
         request.args.getlist('key'),
 
         # werkzeug.datastructures.Authorization (a dict, with some properties)
@@ -69,6 +70,9 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         request.files['key'],
         request.files['key'].filename,
         request.files['key'].stream,
+        request.files.get('key'),
+        request.files.get('key').filename,
+        request.files.get('key').stream,
         request.files.getlist('key'),
         request.files.getlist('key')[0].filename,
         request.files.getlist('key')[0].stream,
@@ -76,6 +80,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
         request.form,
         request.form['key'],
+        request.form.get('key'),
         request.form.getlist('key'),
 
         request.get_data(),
@@ -88,6 +93,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # which has same interface as werkzeug.datastructures.Headers
         request.headers,
         request.headers['key'],
+        request.headers.get('key'),
         request.headers.get_all('key'),
         request.headers.getlist('key'),
         list(request.headers), # (k, v) list
@@ -127,11 +133,13 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # werkzeug.datastructures.CombinedMultiDict, which is basically just a werkzeug.datastructures.MultiDict
         request.values,
         request.values['key'],
+        request.values.get('key'),
         request.values.getlist('key'),
 
         # dict
         request.view_args,
         request.view_args['key'],
+        request.view_args.get('key'),
     )
 
     ensure_not_tainted(

From dedf7655422036df96a3c1ffdd58e5017189d81f Mon Sep 17 00:00:00 2001
From: haby0 <Ha_yub@163.com>
Date: Thu, 15 Apr 2021 22:59:22 +0800
Subject: [PATCH 284/433] Update
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Co-authored-by: Chris Smowton <smowton@github.com>
---
 .../experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index 1bef46f99d05..6da4f87294a5 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -13,7 +13,10 @@ import semmle.code.java.frameworks.spring.SpringController
 abstract class RequestGetMethod extends Method {
   RequestGetMethod() {
     not exists(MethodAccess ma |
-      // Exclude apparent GET handlers that read a request entity, because this is the principle of JSONP.
+      // Exclude apparent GET handlers that read a request entity, because this likely indicates this is not in fact a GET handler.
+      // This is particularly a problem with Spring handlers, which can sometimes neglect to specify a request method.
+      // Even if it is in fact a GET handler, such a request method will be unusable in the context `<script src="...">`,
+      // which is the typical use-case for JSONP but cannot supply a request body.
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
       this.polyCalls*(ma.getEnclosingCallable())
     )

From 254de76078cbc7825565b4e75481b0cf22c1fa8f Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Thu, 15 Apr 2021 16:20:27 +0100
Subject: [PATCH 285/433] Remove unnecessary stubs

---
 .../boot/SpringBootConfiguration.java         |  10 -
 .../autoconfigure/SpringBootApplication.java  |  12 --
 .../context/annotation/Bean.java              |  10 -
 .../HttpInvokerServiceExporter.java           |   8 -
 .../RemoteInvocationSerializingExporter.java  |   3 -
 .../org/springframework/util/ObjectUtils.java | 202 ------------------
 .../org/springframework/util/StringUtils.java |  30 ---
 7 files changed, 275 deletions(-)
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
 delete mode 100644 java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java

diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
deleted file mode 100644
index 483c5cc56065..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package org.springframework.boot;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Target;
-
-import org.springframework.context.annotation.Configuration;
-
-@Target(ElementType.TYPE)
-@Configuration
-public @interface SpringBootConfiguration {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
deleted file mode 100644
index 38bbc35733e9..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package org.springframework.boot.autoconfigure;
-
-import java.lang.annotation.Target;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Inherited;
-
-import org.springframework.boot.SpringBootConfiguration;
-
-@Target(ElementType.TYPE)
-@Inherited
-@SpringBootConfiguration
-public @interface SpringBootApplication {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
deleted file mode 100644
index 24d7be0f8174..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package org.springframework.context.annotation;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Target;
-
-@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE})
-public @interface Bean {
-
-	String[] name() default {};
-}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
deleted file mode 100644
index 5eb56c0897b2..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package org.springframework.remoting.httpinvoker;
-
-public class HttpInvokerServiceExporter extends org.springframework.remoting.rmi.RemoteInvocationSerializingExporter {
-
-    public void setService(Object service) {}
-
-    public void setServiceInterface(Class clazz) {}
-}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
deleted file mode 100644
index 5449b83ba865..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
+++ /dev/null
@@ -1,3 +0,0 @@
-package org.springframework.remoting.rmi;
-
-public abstract class RemoteInvocationSerializingExporter {}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
deleted file mode 100644
index a5a51786d209..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/ObjectUtils.java
+++ /dev/null
@@ -1,202 +0,0 @@
-package org.springframework.util;
-
-import java.lang.reflect.Array;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Map;
-import java.util.Optional;
-import java.util.StringJoiner;
-import org.springframework.lang.Nullable;
-
-public abstract class ObjectUtils {
-
-    private static final int INITIAL_HASH = 7;
-    private static final int MULTIPLIER = 31;
-    private static final String EMPTY_STRING = "";
-    private static final String NULL_STRING = "null";
-    private static final String ARRAY_START = "{";
-    private static final String ARRAY_END = "}";
-    private static final String EMPTY_ARRAY = "{}";
-    private static final String ARRAY_ELEMENT_SEPARATOR = ", ";
-    private static final Object[] EMPTY_OBJECT_ARRAY = new Object[0];
-
-    public ObjectUtils() {
-    }
-
-    public static boolean isCheckedException(Throwable ex) {
-        return false;
-    }
-
-    public static boolean isCompatibleWithThrowsClause(Throwable ex, @Nullable Class<?>... declaredExceptions) {
-        return false;
-    }
-
-    public static boolean isArray(@Nullable Object obj) {
-        return false;
-    }
-
-    public static boolean isEmpty(@Nullable Object[] array) {
-        return false;
-    }
-
-    public static boolean isEmpty(@Nullable Object obj) {
-        return false;
-    }
-
-    @Nullable
-    public static Object unwrapOptional(@Nullable Object obj) {
-        return null;
-    }
-
-    public static boolean containsElement(@Nullable Object[] array, Object element) {
-        return true;
-    }
-
-    public static boolean containsConstant(Enum<?>[] enumValues, String constant) {
-        return true;
-    }
-
-    public static boolean containsConstant(Enum<?>[] enumValues, String constant, boolean caseSensitive) {  
-        return true;
-    }
-
-    public static <E extends Enum<?>> E caseInsensitiveValueOf(E[] enumValues, String constant) {
-        return null;
-    }
-
-    public static <A, O extends A> A[] addObjectToArray(@Nullable A[] array, @Nullable O obj) {
-        return null;
-    }
-
-    public static Object[] toObjectArray(@Nullable Object source) {
-        return null;
-    }
-
-    public static boolean nullSafeEquals(@Nullable Object o1, @Nullable Object o2) {
-        return false;
-    }
-
-    private static boolean arrayEquals(Object o1, Object o2) {
-        return false;
-    }
-
-    public static int nullSafeHashCode(@Nullable Object obj) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable Object[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable boolean[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable byte[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable char[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable double[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable float[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable int[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable long[] array) {
-        return 1;
-    }
-
-    public static int nullSafeHashCode(@Nullable short[] array) {
-        return 1;
-    }
-
-    /** @deprecated */
-    @Deprecated
-    public static int hashCode(boolean bool) {
-        return 1;
-    }
-
-    /** @deprecated */
-    @Deprecated
-    public static int hashCode(double dbl) {
-        return 1;
-    }
-
-    /** @deprecated */
-    @Deprecated
-    public static int hashCode(float flt) {
-        return 1;
-    }
-
-    /** @deprecated */
-    @Deprecated
-    public static int hashCode(long lng) {
-        return 1;
-    }
-
-    public static String identityToString(@Nullable Object obj) {
-        return "";
-    }
-
-    public static String getIdentityHexString(Object obj) {
-        return "";
-    }
-
-    public static String getDisplayString(@Nullable Object obj) {
-        return "";
-    }
-
-    public static String nullSafeClassName(@Nullable Object obj) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable Object obj) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable Object[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable boolean[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable byte[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable char[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable double[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable float[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable int[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable long[] array) {
-        return "";
-    }
-
-    public static String nullSafeToString(@Nullable short[] array) {
-        return "";
-    }
-}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java
deleted file mode 100644
index a78d47e44c6a..000000000000
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/util/StringUtils.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package org.springframework.util;
-
-import java.io.ByteArrayOutputStream;
-import java.nio.charset.Charset;
-import java.util.ArrayDeque;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Deque;
-import java.util.Enumeration;
-import java.util.Iterator;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Locale;
-import java.util.Properties;
-import java.util.Set;
-import java.util.StringJoiner;
-import java.util.StringTokenizer;
-import java.util.TimeZone;
-import org.springframework.lang.Nullable;
-
-public abstract class StringUtils {
-  
-    @Deprecated
-    public static boolean isEmpty(@Nullable Object str) {
-        return true;
-    }
-
-}

From c37994089c24e1b89a6fe7d70df9a9d5c6efdd90 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Thu, 15 Apr 2021 16:24:29 +0100
Subject: [PATCH 286/433] Revert changes to unrelated query

---
 .../src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql  | 2 --
 1 file changed, 2 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
index a9528ee2f9b0..bc9850cfddb9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -2,8 +2,6 @@
  * @name Sensitive GET Query
  * @description Use of GET request method with sensitive query strings.
  * @kind path-problem
- * @problem.severity warning
- * @precision medium
  * @id java/sensitive-query-with-get
  * @tags security
  *       external/cwe-598

From 3e7dc12246981518b36d2b3ea36340f1dca04d45 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Thu, 15 Apr 2021 18:00:33 +0200
Subject: [PATCH 287/433] Python: Port taint tests to use inline expectations

The meat of this PR is described in the new python/ql/test/experimental/meta/InlineTaintTest.qll file:

> Defines a InlineExpectationsTest for checking whether any arguments in
> `ensure_tainted` and `ensure_not_tainted` calls are tainted.
>
> Also defines query predicates to ensure that:
> - if any arguments to `ensure_not_tainted` are tainted, their annotation is marked with `SPURIOUS`.
> - if any arguments to `ensure_tainted` are not tainted, their annotation is marked with `MISSING`.
>
> The functionality of this module is tested in `ql/test/experimental/meta/inline-taint-test-demo`.
---
 .../commonSanitizer/InlineTaintTest.expected  |   3 +
 .../{TestTaint.ql => InlineTaintTest.ql}      |   2 +-
 .../commonSanitizer/TestTaint.expected        |  27 ---
 .../test_string_const_compare.py              |  42 ++---
 .../customSanitizer/InlineTaintTest.expected  |  20 ++
 .../{TestTaint.ql => InlineTaintTest.ql}      |   2 +-
 .../customSanitizer/TestTaint.expected        |  61 ------
 .../tainttracking/customSanitizer/test.py     |   4 +-
 .../customSanitizer/test_logical.py           |  62 +++---
 .../customSanitizer/test_reference.py         |  12 +-
 .../InlineTaintTest.expected                  |   3 +
 .../InlineTaintTest.ql                        |   1 +
 .../TestTaint.expected                        |  34 ----
 .../TestTaint.ql                              |   1 -
 .../test_collections.py                       |   6 +-
 .../test_pathlib.py                           |  24 +--
 .../test_string.py                            |  20 +-
 .../test_unpacking.py                         |   8 +-
 .../InlineTaintTest.expected                  |   3 +
 .../InlineTaintTest.ql                        |   1 +
 .../TestTaint.expected                        | 176 -----------------
 .../defaultAdditionalTaintStep/TestTaint.ql   |   1 -
 .../test_collections.py                       | 108 +++++------
 .../defaultAdditionalTaintStep/test_json.py   |  18 +-
 .../defaultAdditionalTaintStep/test_string.py | 134 ++++++-------
 .../test_unpacking.py                         |  18 +-
 .../InlineTaintTest.expected                  |   3 +
 .../unwanted-global-flow/InlineTaintTest.ql   |   1 +
 .../unwanted-global-flow/test.py              |   8 +-
 .../unwanted-global-flow/testTaint.expected   |   6 -
 .../unwanted-global-flow/testTaint.ql         |   1 -
 .../experimental/meta/InlineTaintTest.qll     |  91 +++++++++
 .../InlineTaintTest.expected                  |   5 +
 .../inline-taint-test-demo/InlineTaintTest.ql |   1 +
 .../meta/inline-taint-test-demo/taint_test.py |  37 ++++
 .../django-v2-v3/InlineTaintTest.expected     |   3 +
 .../django-v2-v3/InlineTaintTest.ql           |   1 +
 .../django-v2-v3/TestTaint.expected           | 100 ----------
 .../frameworks/django-v2-v3/TestTaint.ql      |   6 -
 .../frameworks/django-v2-v3/response_test.py  |   2 +-
 .../frameworks/django-v2-v3/taint_forms.py    |  22 +--
 .../frameworks/django-v2-v3/taint_test.py     | 163 ++++++++--------
 .../fabric/InlineTaintTest.expected           |   3 +
 .../frameworks/fabric/InlineTaintTest.ql      |   1 +
 .../frameworks/fabric/TestTaint.expected      |  10 -
 .../frameworks/fabric/TestTaint.ql            |   1 -
 .../frameworks/fabric/fabric_v1_execute.py    |   6 +-
 .../frameworks/flask/InlineTaintTest.expected |   3 +
 .../frameworks/flask/InlineTaintTest.ql       |   1 +
 .../frameworks/flask/TestTaint.expected       |  98 ----------
 .../frameworks/flask/TestTaint.ql             |   6 -
 .../frameworks/flask/taint_test.py            | 177 +++++++++---------
 .../frameworks/stdlib/CodeExecution.py        |   8 +-
 .../stdlib/InlineTaintTest.expected           |   3 +
 .../frameworks/stdlib/InlineTaintTest.ql      |   1 +
 .../frameworks/stdlib/TestTaint.expected      |  37 ----
 .../frameworks/stdlib/TestTaint.ql            |   9 -
 .../frameworks/stdlib/http_server.py          |  84 +++++----
 .../tornado/InlineTaintTest.expected          |   3 +
 .../frameworks/tornado/InlineTaintTest.ql     |   1 +
 .../frameworks/tornado/TestTaint.expected     |  41 ----
 .../frameworks/tornado/TestTaint.ql           |   6 -
 .../frameworks/tornado/taint_test.py          |  78 ++++----
 63 files changed, 703 insertions(+), 1115 deletions(-)
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.expected
 rename python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/{TestTaint.ql => InlineTaintTest.ql} (80%)
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.expected
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.expected
 rename python/ql/test/experimental/dataflow/tainttracking/customSanitizer/{TestTaint.ql => InlineTaintTest.ql} (95%)
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.expected
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.ql
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.ql
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.ql
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.ql
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.ql
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.expected
 delete mode 100644 python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.ql
 create mode 100644 python/ql/test/experimental/meta/InlineTaintTest.qll
 create mode 100644 python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
 create mode 100644 python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.ql
 create mode 100644 python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
 create mode 100644 python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.expected
 create mode 100644 python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.ql
 delete mode 100644 python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
 delete mode 100644 python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql
 create mode 100644 python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.expected
 create mode 100644 python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.ql
 delete mode 100644 python/ql/test/library-tests/frameworks/fabric/TestTaint.expected
 delete mode 100644 python/ql/test/library-tests/frameworks/fabric/TestTaint.ql
 create mode 100644 python/ql/test/library-tests/frameworks/flask/InlineTaintTest.expected
 create mode 100644 python/ql/test/library-tests/frameworks/flask/InlineTaintTest.ql
 delete mode 100644 python/ql/test/library-tests/frameworks/flask/TestTaint.expected
 delete mode 100644 python/ql/test/library-tests/frameworks/flask/TestTaint.ql
 create mode 100644 python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.expected
 create mode 100644 python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.ql
 delete mode 100644 python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected
 delete mode 100644 python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql
 create mode 100644 python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.expected
 create mode 100644 python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.ql
 delete mode 100644 python/ql/test/library-tests/frameworks/tornado/TestTaint.expected
 delete mode 100644 python/ql/test/library-tests/frameworks/tornado/TestTaint.ql

diff --git a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.expected b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.ql
similarity index 80%
rename from python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.ql
rename to python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.ql
index 9aec6dc21d86..8e122f44fb6f 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.ql
+++ b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/InlineTaintTest.ql
@@ -1,4 +1,4 @@
-import experimental.dataflow.tainttracking.TestTaintLib
+import experimental.meta.InlineTaintTest
 import semmle.python.dataflow.new.BarrierGuards
 
 class CustomSanitizerOverrides extends TestTaintTrackingConfiguration {
diff --git a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.expected b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.expected
deleted file mode 100644
index cf4e56bee5de..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.expected
+++ /dev/null
@@ -1,27 +0,0 @@
-| test_string_const_compare.py:16 | ok   | test_eq | ts |
-| test_string_const_compare.py:18 | ok   | test_eq | ts |
-| test_string_const_compare.py:20 | ok   | test_eq | ts |
-| test_string_const_compare.py:27 | ok   | test_eq_unsafe | ts |
-| test_string_const_compare.py:29 | ok   | test_eq_unsafe | ts |
-| test_string_const_compare.py:35 | fail | test_eq_with_or | ts |
-| test_string_const_compare.py:37 | ok   | test_eq_with_or | ts |
-| test_string_const_compare.py:43 | ok   | test_non_eq1 | ts |
-| test_string_const_compare.py:45 | ok   | test_non_eq1 | ts |
-| test_string_const_compare.py:51 | ok   | test_non_eq2 | ts |
-| test_string_const_compare.py:53 | fail | test_non_eq2 | ts |
-| test_string_const_compare.py:59 | ok   | test_in_list | ts |
-| test_string_const_compare.py:61 | ok   | test_in_list | ts |
-| test_string_const_compare.py:67 | ok   | test_in_tuple | ts |
-| test_string_const_compare.py:69 | ok   | test_in_tuple | ts |
-| test_string_const_compare.py:75 | ok   | test_in_set | ts |
-| test_string_const_compare.py:77 | ok   | test_in_set | ts |
-| test_string_const_compare.py:83 | ok   | test_in_unsafe1 | ts |
-| test_string_const_compare.py:85 | ok   | test_in_unsafe1 | ts |
-| test_string_const_compare.py:91 | ok   | test_in_unsafe2 | ts |
-| test_string_const_compare.py:93 | ok   | test_in_unsafe2 | ts |
-| test_string_const_compare.py:99 | ok   | test_not_in1 | ts |
-| test_string_const_compare.py:101 | ok   | test_not_in1 | ts |
-| test_string_const_compare.py:107 | ok   | test_not_in2 | ts |
-| test_string_const_compare.py:109 | fail | test_not_in2 | ts |
-| test_string_const_compare.py:119 | fail | test_eq_thorugh_func | ts |
-| test_string_const_compare.py:121 | ok   | test_eq_thorugh_func | ts |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/test_string_const_compare.py b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/test_string_const_compare.py
index fe5d53563fd4..17860c519a8d 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/test_string_const_compare.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/test_string_const_compare.py
@@ -15,32 +15,32 @@ def test_eq():
     if ts == "safe":
         ensure_not_tainted(ts)
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     # ts should still be tainted after exiting the if block
-    ensure_tainted(ts)
+    ensure_tainted(ts) # $ tainted
 
 
 def test_eq_unsafe(x="foo"):
     """This test-case might seem strange, but it was a FP in our old points-to based analysis."""
     ts = TAINTED_STRING
     if ts == ts:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     if ts == x:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_eq_with_or():
     ts = TAINTED_STRING
     if ts == "safe" or ts == "also_safe":
-        ensure_not_tainted(ts)
+        ensure_not_tainted(ts) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_non_eq1():
     ts = TAINTED_STRING
     if ts != "safe":
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
         ensure_not_tainted(ts)
 
@@ -48,9 +48,9 @@ def test_non_eq1():
 def test_non_eq2():
     ts = TAINTED_STRING
     if not ts == "safe":
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
-        ensure_not_tainted(ts)
+        ensure_not_tainted(ts) # $ SPURIOUS: tainted
 
 
 def test_in_list():
@@ -58,7 +58,7 @@ def test_in_list():
     if ts in ["safe", "also_safe"]:
         ensure_not_tainted(ts)
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_in_tuple():
@@ -66,7 +66,7 @@ def test_in_tuple():
     if ts in ("safe", "also_safe"):
         ensure_not_tainted(ts)
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_in_set():
@@ -74,29 +74,29 @@ def test_in_set():
     if ts in {"safe", "also_safe"}:
         ensure_not_tainted(ts)
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_in_unsafe1(xs):
     ts = TAINTED_STRING
     if ts in xs:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_in_unsafe2(x):
     ts = TAINTED_STRING
     if ts in ["safe", x]:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 def test_not_in1():
     ts = TAINTED_STRING
     if ts not in ["safe", "also_safe"]:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
         ensure_not_tainted(ts)
 
@@ -104,9 +104,9 @@ def test_not_in1():
 def test_not_in2():
     ts = TAINTED_STRING
     if not ts in ["safe", "also_safe"]:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
     else:
-        ensure_not_tainted(ts)
+        ensure_not_tainted(ts) # $ SPURIOUS: tainted
 
 
 def is_safe(x):
@@ -116,9 +116,9 @@ def is_safe(x):
 def test_eq_thorugh_func():
     ts = TAINTED_STRING
     if is_safe(ts):
-        ensure_not_tainted(ts)
+        ensure_not_tainted(ts) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(ts)
+        ensure_tainted(ts) # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.expected b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.expected
new file mode 100644
index 000000000000..6c58f2104298
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.expected
@@ -0,0 +1,20 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
+isSanitizer
+| TestTaintTrackingConfiguration | test.py:21:39:21:39 | ControlFlowNode for s |
+| TestTaintTrackingConfiguration | test.py:50:10:50:29 | ControlFlowNode for emulated_escaping() |
+isSanitizerGuard
+| TestTaintTrackingConfiguration | test.py:35:8:35:26 | ControlFlowNode for emulated_is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:29:8:29:17 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:44:8:44:17 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:52:12:52:21 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:72:8:72:17 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:80:12:80:21 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:104:8:104:17 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:127:12:127:21 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:132:16:132:25 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_logical.py:137:20:137:29 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_reference.py:30:8:30:17 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_reference.py:40:8:40:25 | ControlFlowNode for is_safe() |
+| TestTaintTrackingConfiguration | test_reference.py:55:8:55:21 | ControlFlowNode for is_safe() |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.ql
similarity index 95%
rename from python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.ql
rename to python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.ql
index 7f3582727a0a..8d3299dccbc2 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.ql
+++ b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/InlineTaintTest.ql
@@ -1,4 +1,4 @@
-import experimental.dataflow.tainttracking.TestTaintLib
+import experimental.meta.InlineTaintTest
 
 class IsSafeCheck extends DataFlow::BarrierGuard {
   IsSafeCheck() {
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.expected b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.expected
deleted file mode 100644
index 648ccf975b1a..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/TestTaint.expected
+++ /dev/null
@@ -1,61 +0,0 @@
-test_taint
-| test.py:22 | ok   | test_custom_sanitizer | s |
-| test.py:36 | ok   | test_custom_sanitizer_guard | s |
-| test.py:38 | ok   | test_custom_sanitizer_guard | s |
-| test.py:40 | ok   | test_custom_sanitizer_guard | s |
-| test.py:51 | ok   | test_escape | s2 |
-| test_logical.py:30 | ok   | test_basic | s |
-| test_logical.py:32 | ok   | test_basic | s |
-| test_logical.py:35 | ok   | test_basic | s |
-| test_logical.py:37 | fail | test_basic | s |
-| test_logical.py:45 | ok   | test_or | s |
-| test_logical.py:47 | ok   | test_or | s |
-| test_logical.py:51 | ok   | test_or | s |
-| test_logical.py:53 | ok   | test_or | s |
-| test_logical.py:57 | ok   | test_or | s |
-| test_logical.py:59 | ok   | test_or | s |
-| test_logical.py:67 | ok   | test_and | s |
-| test_logical.py:69 | ok   | test_and | s |
-| test_logical.py:73 | ok   | test_and | s |
-| test_logical.py:75 | ok   | test_and | s |
-| test_logical.py:79 | ok   | test_and | s |
-| test_logical.py:81 | fail | test_and | s |
-| test_logical.py:89 | fail | test_tricky | s |
-| test_logical.py:93 | fail | test_tricky | s_ |
-| test_logical.py:100 | fail | test_nesting_not | s |
-| test_logical.py:102 | ok   | test_nesting_not | s |
-| test_logical.py:105 | ok   | test_nesting_not | s |
-| test_logical.py:107 | fail | test_nesting_not | s |
-| test_logical.py:116 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:118 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:121 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:123 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:126 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:128 | ok   | test_nesting_not_with_and_true | s |
-| test_logical.py:137 | fail | test_with_return | s |
-| test_logical.py:146 | fail | test_with_exception | s |
-| test_reference.py:31 | fail | test_basic | s2 |
-| test_reference.py:31 | ok   | test_basic | s |
-| test_reference.py:33 | ok   | test_basic | s |
-| test_reference.py:33 | ok   | test_basic | s2 |
-| test_reference.py:41 | fail | test_identical_call | s.strip() |
-| test_reference.py:43 | ok   | test_identical_call | s.strip() |
-| test_reference.py:56 | fail | test_class_attribute_access | c.foo |
-| test_reference.py:58 | ok   | test_class_attribute_access | c.foo |
-isSanitizer
-| TestTaintTrackingConfiguration | test.py:21:39:21:39 | ControlFlowNode for s |
-| TestTaintTrackingConfiguration | test.py:50:10:50:29 | ControlFlowNode for emulated_escaping() |
-isSanitizerGuard
-| TestTaintTrackingConfiguration | test.py:35:8:35:26 | ControlFlowNode for emulated_is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:29:8:29:17 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:44:8:44:17 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:50:12:50:21 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:66:8:66:17 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:72:12:72:21 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:92:8:92:17 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:115:12:115:21 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:120:16:120:25 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_logical.py:125:20:125:29 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_reference.py:30:8:30:17 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_reference.py:40:8:40:25 | ControlFlowNode for is_safe() |
-| TestTaintTrackingConfiguration | test_reference.py:55:8:55:21 | ControlFlowNode for is_safe() |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test.py b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test.py
index fcc32fc9b0f0..91c39cb73136 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test.py
@@ -35,9 +35,9 @@ def test_custom_sanitizer_guard():
     if emulated_is_safe(s):
         ensure_not_tainted(s)
         s = TAINTED_STRING
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
 
 
 def emulated_escaping(arg):
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_logical.py b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_logical.py
index 0b06aa3fef2f..df7b1c547e3f 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_logical.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_logical.py
@@ -29,12 +29,12 @@ def test_basic():
     if is_safe(s):
         ensure_not_tainted(s)
     else:
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
 
     if not is_safe(s):
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_not_tainted(s)
+        ensure_not_tainted(s) # $ SPURIOUS: tainted
 
 
 def test_or():
@@ -42,21 +42,27 @@ def test_or():
 
     # x or y
     if is_safe(s) or random_choice():
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_tainted(s) # must be tainted
+        # must be tainted
+        ensure_tainted(s) # $ tainted
 
     # not (x or y)
     if not(is_safe(s) or random_choice()):
-        ensure_tainted(s) # must be tainted
+        # must be tainted
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
 
     # not (x or y) == not x and not y   [de Morgan's laws]
     if not is_safe(s) and not random_choice():
-        ensure_tainted(s) # must be tainted
+        # must be tainted
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
 
 
 def test_and():
@@ -64,21 +70,27 @@ def test_and():
 
     # x and y
     if is_safe(s) and random_choice():
-        ensure_not_tainted(s) # must not be tainted
+        # cannot be tainted
+        ensure_not_tainted(s)
     else:
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
 
     # not (x and y)
     if not(is_safe(s) and random_choice()):
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
     else:
+        # cannot be tainted
         ensure_not_tainted(s)
 
     # not (x and y) == not x or not y   [de Morgan's laws]
     if not is_safe(s) or not random_choice():
-        ensure_tainted(s) # might be tainted
+        # might be tainted
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_not_tainted(s)
+        # cannot be tainted
+        ensure_not_tainted(s) # $ SPURIOUS: tainted
 
 
 def test_tricky():
@@ -86,25 +98,25 @@ def test_tricky():
 
     x = is_safe(s)
     if x:
-        ensure_not_tainted(s) # FP
+        ensure_not_tainted(s) # $ SPURIOUS: tainted
 
     s_ = s
     if is_safe(s):
-        ensure_not_tainted(s_) # FP
+        ensure_not_tainted(s_) # $ SPURIOUS: tainted
 
 
 def test_nesting_not():
     s = TAINTED_STRING
 
     if not(not(is_safe(s))):
-        ensure_not_tainted(s)
+        ensure_not_tainted(s) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
 
     if not(not(not(is_safe(s)))):
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
     else:
-        ensure_not_tainted(s)
+        ensure_not_tainted(s) # $ SPURIOUS: tainted
 
 
 # Adding `and True` makes the sanitizer trigger when it would otherwise not. See output in
@@ -113,17 +125,17 @@ def test_nesting_not_with_and_true():
     s = TAINTED_STRING
 
     if not(is_safe(s) and True):
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
     else:
         ensure_not_tainted(s)
 
     if not(not(is_safe(s) and True)):
         ensure_not_tainted(s)
     else:
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
 
     if not(not(not(is_safe(s) and True))):
-        ensure_tainted(s)
+        ensure_tainted(s) # $ tainted
     else:
         ensure_not_tainted(s)
 
@@ -134,7 +146,7 @@ def test_with_return():
     if not is_safe(s):
         return
 
-    ensure_not_tainted(s)
+    ensure_not_tainted(s) # $ SPURIOUS: tainted
 
 
 def test_with_exception():
@@ -143,7 +155,7 @@ def test_with_exception():
     if not is_safe(s):
         raise Exception("unsafe")
 
-    ensure_not_tainted(s)
+    ensure_not_tainted(s) # $ SPURIOUS: tainted
 
 # Make tests runable
 
diff --git a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_reference.py b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_reference.py
index 641f1171797b..83f8565286be 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_reference.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/customSanitizer/test_reference.py
@@ -28,9 +28,9 @@ def test_basic():
     s2 = s
 
     if is_safe(s):
-        ensure_not_tainted(s, s2)
+        ensure_not_tainted(s, s2) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(s, s2)
+        ensure_tainted(s, s2) # $ tainted
 
 
 def test_identical_call():
@@ -38,9 +38,9 @@ def test_identical_call():
     s = TAINTED_STRING
 
     if is_safe(s.strip()):
-        ensure_not_tainted(s.strip())
+        ensure_not_tainted(s.strip()) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(s.strip())
+        ensure_tainted(s.strip()) # $ tainted
 
 
 class C(object):
@@ -53,9 +53,9 @@ def test_class_attribute_access():
     c = C(s)
 
     if is_safe(c.foo):
-        ensure_not_tainted(c.foo)
+        ensure_not_tainted(c.foo) # $ SPURIOUS: tainted
     else:
-        ensure_tainted(c.foo)
+        ensure_tainted(c.foo) # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.expected b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.ql b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected
deleted file mode 100644
index 2a48c5b56042..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected
+++ /dev/null
@@ -1,34 +0,0 @@
-| test_collections.py:16 | ok   | test_access | tainted_list.copy() |
-| test_collections.py:24 | ok   | list_clear | tainted_list |
-| test_collections.py:27 | fail | list_clear | tainted_list |
-| test_pathlib.py:26 | fail | test_basic | tainted_path |
-| test_pathlib.py:28 | fail | test_basic | tainted_pure_path |
-| test_pathlib.py:29 | fail | test_basic | tainted_pure_posix_path |
-| test_pathlib.py:30 | fail | test_basic | tainted_pure_windows_path |
-| test_pathlib.py:32 | fail | test_basic | BinaryExpr |
-| test_pathlib.py:33 | fail | test_basic | BinaryExpr |
-| test_pathlib.py:35 | fail | test_basic | tainted_path.joinpath(..) |
-| test_pathlib.py:36 | fail | test_basic | pathlib.Path(..).joinpath(..) |
-| test_pathlib.py:37 | fail | test_basic | pathlib.Path(..).joinpath(..) |
-| test_pathlib.py:39 | fail | test_basic | str(..) |
-| test_pathlib.py:49 | fail | test_basic | tainted_posix_path |
-| test_pathlib.py:55 | fail | test_basic | tainted_windows_path |
-| test_string.py:17 | ok   | str_methods | ts.casefold() |
-| test_string.py:19 | ok   | str_methods | ts.format_map(..) |
-| test_string.py:20 | ok   | str_methods | "{unsafe}".format_map(..) |
-| test_string.py:31 | ok   | binary_decode_encode | base64.a85encode(..) |
-| test_string.py:32 | ok   | binary_decode_encode | base64.a85decode(..) |
-| test_string.py:35 | ok   | binary_decode_encode | base64.b85encode(..) |
-| test_string.py:36 | ok   | binary_decode_encode | base64.b85decode(..) |
-| test_string.py:39 | ok   | binary_decode_encode | base64.encodebytes(..) |
-| test_string.py:40 | ok   | binary_decode_encode | base64.decodebytes(..) |
-| test_string.py:48 | ok   | f_strings | Fstring |
-| test_unpacking.py:18 | ok   | extended_unpacking | first |
-| test_unpacking.py:18 | ok   | extended_unpacking | last |
-| test_unpacking.py:18 | ok   | extended_unpacking | rest |
-| test_unpacking.py:23 | ok   | also_allowed | a |
-| test_unpacking.py:31 | ok   | also_allowed | b |
-| test_unpacking.py:31 | ok   | also_allowed | c |
-| test_unpacking.py:39 | ok   | nested | x |
-| test_unpacking.py:39 | ok   | nested | xs |
-| test_unpacking.py:39 | ok   | nested | ys |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.ql
deleted file mode 100644
index 80625505fa24..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.ql
+++ /dev/null
@@ -1 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_collections.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_collections.py
index c2391f419d6b..9398ce1638f4 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_collections.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_collections.py
@@ -13,7 +13,7 @@ def test_access():
     tainted_list = TAINTED_LIST
 
     ensure_tainted(
-        tainted_list.copy(),
+        tainted_list.copy(), # $ tainted
     )
 
 
@@ -21,10 +21,10 @@ def list_clear():
     tainted_string = TAINTED_STRING
     tainted_list = [tainted_string]
 
-    ensure_tainted(tainted_list)
+    ensure_tainted(tainted_list) # $ tainted
 
     tainted_list.clear()
-    ensure_not_tainted(tainted_list)
+    ensure_not_tainted(tainted_list) # $ SPURIOUS: tainted
 
 # Make tests runable
 
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_pathlib.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_pathlib.py
index 802bfd98b12c..2d4133436e4e 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_pathlib.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_pathlib.py
@@ -23,20 +23,20 @@ def test_basic():
     tainted_pure_windows_path = pathlib.PureWindowsPath(ts)
 
     ensure_tainted(
-        tainted_path,
+        tainted_path, # $ MISSING: tainted
 
-        tainted_pure_path,
-        tainted_pure_posix_path,
-        tainted_pure_windows_path,
+        tainted_pure_path, # $ MISSING: tainted
+        tainted_pure_posix_path, # $ MISSING: tainted
+        tainted_pure_windows_path, # $ MISSING: tainted
 
-        pathlib.Path("foo") / ts,
-        ts / pathlib.Path("foo"),
+        pathlib.Path("foo") / ts, # $ MISSING: tainted
+        ts / pathlib.Path("foo"), # $ MISSING: tainted
 
-        tainted_path.joinpath("foo", "bar"),
-        pathlib.Path("foo").joinpath(tainted_path, "bar"),
-        pathlib.Path("foo").joinpath("bar", tainted_path),
+        tainted_path.joinpath("foo", "bar"), # $ MISSING: tainted
+        pathlib.Path("foo").joinpath(tainted_path, "bar"), # $ MISSING: tainted
+        pathlib.Path("foo").joinpath("bar", tainted_path), # $ MISSING: tainted
 
-        str(tainted_path),
+        str(tainted_path), # $ MISSING: tainted
 
         # TODO: Tainted methods and attributes
         # https://docs.python.org/3.8/library/pathlib.html#methods-and-properties
@@ -46,13 +46,13 @@ def test_basic():
         tainted_posix_path = pathlib.PosixPath(ts)
 
         ensure_tainted(
-            tainted_posix_path,
+            tainted_posix_path, # $ MISSING: tainted
         )
 
     if os.name == "nt":
         tainted_windows_path = pathlib.WindowsPath(ts)
         ensure_tainted(
-            tainted_windows_path,
+            tainted_windows_path, # $ MISSING: tainted
         )
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py
index 2f63f8af460b..41a14e73a272 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py
@@ -14,10 +14,10 @@ def str_methods():
     ts = TAINTED_STRING
     tb = TAINTED_BYTES
     ensure_tainted(
-        ts.casefold(),
+        ts.casefold(), # $ tainted
 
-        ts.format_map({}),
-        "{unsafe}".format_map({"unsafe": ts}),
+        ts.format_map({}), # $ tainted
+        "{unsafe}".format_map({"unsafe": ts}), # $ tainted
     )
 
 
@@ -28,16 +28,16 @@ def binary_decode_encode():
 
     ensure_tainted(
         # New in Python 3.4
-        base64.a85encode(tb),
-        base64.a85decode(base64.a85encode(tb)),
+        base64.a85encode(tb), # $ tainted
+        base64.a85decode(base64.a85encode(tb)), # $ tainted
 
         # New in Python 3.4
-        base64.b85encode(tb),
-        base64.b85decode(base64.b85encode(tb)),
+        base64.b85encode(tb), # $ tainted
+        base64.b85decode(base64.b85encode(tb)), # $ tainted
 
         # New in Python 3.1
-        base64.encodebytes(tb),
-        base64.decodebytes(base64.encodebytes(tb)),
+        base64.encodebytes(tb), # $ tainted
+        base64.decodebytes(base64.encodebytes(tb)), # $ tainted
     )
 
 
@@ -45,7 +45,7 @@ def f_strings():
     print("\n# f_strings")
     ts = TAINTED_STRING
 
-    ensure_tainted(f"foo {ts} bar")
+    ensure_tainted(f"foo {ts} bar") # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_unpacking.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_unpacking.py
index a9484bcfca61..c48448663043 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_unpacking.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_unpacking.py
@@ -15,12 +15,12 @@
 
 def extended_unpacking():
     first, *rest, last = TAINTED_LIST
-    ensure_tainted(first, rest, last)
+    ensure_tainted(first, rest, last) # $ tainted
 
 
 def also_allowed():
     *a, = TAINTED_LIST
-    ensure_tainted(a)
+    ensure_tainted(a) # $ tainted
 
     # for b, *c in [(1, 2, 3), (4, 5, 6, 7)]:
         # print(c)
@@ -28,7 +28,7 @@ def also_allowed():
         # i=1; c=[5,6,7]
 
     for b, *c in [TAINTED_LIST, TAINTED_LIST]:
-        ensure_tainted(b, c)
+        ensure_tainted(b, c) # $ tainted
 
 
 def nested():
@@ -36,7 +36,7 @@ def nested():
     ll = [l,l]
 
     [[x, *xs], ys] = ll
-    ensure_tainted(x, xs, ys)
+    ensure_tainted(x, xs, ys) # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.expected b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.ql b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
deleted file mode 100644
index c68e83b9784a..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
+++ /dev/null
@@ -1,176 +0,0 @@
-| test_collections.py:23 | ok   | test_construction | tainted_string |
-| test_collections.py:24 | ok   | test_construction | tainted_list |
-| test_collections.py:25 | ok   | test_construction | tainted_tuple |
-| test_collections.py:26 | ok   | test_construction | tainted_set |
-| test_collections.py:27 | ok   | test_construction | tainted_dict |
-| test_collections.py:31 | ok   | test_construction | list(..) |
-| test_collections.py:32 | ok   | test_construction | list(..) |
-| test_collections.py:33 | ok   | test_construction | list(..) |
-| test_collections.py:34 | ok   | test_construction | list(..) |
-| test_collections.py:35 | ok   | test_construction | list(..) |
-| test_collections.py:37 | ok   | test_construction | tuple(..) |
-| test_collections.py:38 | ok   | test_construction | set(..) |
-| test_collections.py:39 | ok   | test_construction | frozenset(..) |
-| test_collections.py:47 | ok   | test_access | tainted_list[0] |
-| test_collections.py:48 | ok   | test_access | tainted_list[x] |
-| test_collections.py:49 | ok   | test_access | tainted_list[Slice] |
-| test_collections.py:51 | ok   | test_access | sorted(..) |
-| test_collections.py:52 | ok   | test_access | reversed(..) |
-| test_collections.py:53 | ok   | test_access | iter(..) |
-| test_collections.py:54 | ok   | test_access | next(..) |
-| test_collections.py:58 | ok   | test_access | a |
-| test_collections.py:58 | ok   | test_access | b |
-| test_collections.py:58 | ok   | test_access | c |
-| test_collections.py:61 | ok   | test_access | h |
-| test_collections.py:63 | ok   | test_access | i |
-| test_collections.py:70 | ok   | test_dict_access | tainted_dict["name"] |
-| test_collections.py:71 | ok   | test_dict_access | tainted_dict.get(..) |
-| test_collections.py:72 | ok   | test_dict_access | tainted_dict[x] |
-| test_collections.py:73 | ok   | test_dict_access | tainted_dict.copy() |
-| test_collections.py:77 | ok   | test_dict_access | v |
-| test_collections.py:79 | ok   | test_dict_access | v |
-| test_collections.py:87 | fail | test_named_tuple | point[0] |
-| test_collections.py:88 | fail | test_named_tuple | point.x |
-| test_collections.py:92 | ok   | test_named_tuple | point[1] |
-| test_collections.py:93 | ok   | test_named_tuple | point.y |
-| test_collections.py:97 | fail | test_named_tuple | a |
-| test_collections.py:98 | ok   | test_named_tuple | b |
-| test_collections.py:106 | fail | test_defaultdict | tainted_default_dict["name"] |
-| test_collections.py:107 | fail | test_defaultdict | tainted_default_dict.get(..) |
-| test_collections.py:108 | fail | test_defaultdict | tainted_default_dict[x] |
-| test_collections.py:109 | fail | test_defaultdict | tainted_default_dict.copy() |
-| test_collections.py:112 | fail | test_defaultdict | v |
-| test_collections.py:114 | fail | test_defaultdict | v |
-| test_collections.py:121 | ok   | test_copy_1 | copy(..) |
-| test_collections.py:122 | ok   | test_copy_1 | deepcopy(..) |
-| test_collections.py:130 | ok   | test_copy_2 | copy.copy(..) |
-| test_collections.py:131 | ok   | test_copy_2 | copy.deepcopy(..) |
-| test_collections.py:139 | ok   | list_index_assign | my_list |
-| test_collections.py:142 | fail | list_index_assign | my_list |
-| test_collections.py:149 | ok   | list_index_aug_assign | my_list |
-| test_collections.py:152 | fail | list_index_aug_assign | my_list |
-| test_collections.py:159 | ok   | list_append | my_list |
-| test_collections.py:162 | ok   | list_append | my_list |
-| test_collections.py:169 | ok   | list_extend | my_list |
-| test_collections.py:172 | fail | list_extend | my_list |
-| test_collections.py:179 | ok   | dict_update_dict | my_dict |
-| test_collections.py:182 | fail | dict_update_dict | my_dict |
-| test_collections.py:189 | ok   | dict_update_kv_list | my_dict |
-| test_collections.py:192 | fail | dict_update_kv_list | my_dict |
-| test_collections.py:198 | ok   | dict_update_kv_arg | my_dict |
-| test_collections.py:201 | fail | dict_update_kv_arg | my_dict |
-| test_collections.py:208 | ok   | dict_manual_update | my_dict |
-| test_collections.py:212 | fail | dict_manual_update | my_dict |
-| test_collections.py:220 | fail | dict_merge | merged |
-| test_collections.py:227 | ok   | set_add | my_set |
-| test_collections.py:230 | ok   | set_add | my_set |
-| test_json.py:26 | ok   | test | json.dumps(..) |
-| test_json.py:27 | ok   | test | json.loads(..) |
-| test_json.py:34 | fail | test | tainted_filelike |
-| test_json.py:35 | fail | test | json.load(..) |
-| test_json.py:48 | ok   | non_syntacical | dumps(..) |
-| test_json.py:49 | ok   | non_syntacical | dumps_alias(..) |
-| test_json.py:50 | ok   | non_syntacical | loads(..) |
-| test_json.py:57 | fail | non_syntacical | tainted_filelike |
-| test_json.py:58 | fail | non_syntacical | load(..) |
-| test_string.py:25 | ok   | str_operations | ts |
-| test_string.py:26 | ok   | str_operations | BinaryExpr |
-| test_string.py:27 | ok   | str_operations | BinaryExpr |
-| test_string.py:28 | ok   | str_operations | BinaryExpr |
-| test_string.py:29 | ok   | str_operations | ts[Slice] |
-| test_string.py:30 | ok   | str_operations | ts[Slice] |
-| test_string.py:31 | ok   | str_operations | ts[Slice] |
-| test_string.py:32 | ok   | str_operations | ts[0] |
-| test_string.py:33 | ok   | str_operations | str(..) |
-| test_string.py:34 | ok   | str_operations | bytes(..) |
-| test_string.py:35 | ok   | str_operations | unicode(..) |
-| test_string.py:39 | ok   | str_operations | aug_assignment |
-| test_string.py:41 | ok   | str_operations | aug_assignment |
-| test_string.py:49 | ok   | str_methods | ts.capitalize() |
-| test_string.py:50 | ok   | str_methods | ts.center(..) |
-| test_string.py:51 | ok   | str_methods | ts.expandtabs() |
-| test_string.py:53 | ok   | str_methods | ts.format() |
-| test_string.py:54 | ok   | str_methods | "{}".format(..) |
-| test_string.py:55 | ok   | str_methods | "{unsafe}".format(..) |
-| test_string.py:57 | ok   | str_methods | ts.join(..) |
-| test_string.py:58 | ok   | str_methods | "".join(..) |
-| test_string.py:60 | ok   | str_methods | ts.ljust(..) |
-| test_string.py:61 | ok   | str_methods | ts.lstrip() |
-| test_string.py:62 | ok   | str_methods | ts.lower() |
-| test_string.py:64 | ok   | str_methods | ts.replace(..) |
-| test_string.py:65 | ok   | str_methods | "safe".replace(..) |
-| test_string.py:67 | ok   | str_methods | ts.rjust(..) |
-| test_string.py:68 | ok   | str_methods | ts.rstrip() |
-| test_string.py:69 | ok   | str_methods | ts.strip() |
-| test_string.py:70 | ok   | str_methods | ts.swapcase() |
-| test_string.py:71 | ok   | str_methods | ts.title() |
-| test_string.py:72 | ok   | str_methods | ts.upper() |
-| test_string.py:73 | ok   | str_methods | ts.zfill(..) |
-| test_string.py:75 | ok   | str_methods | ts.encode(..) |
-| test_string.py:76 | ok   | str_methods | ts.encode(..).decode(..) |
-| test_string.py:78 | ok   | str_methods | tb.decode(..) |
-| test_string.py:79 | ok   | str_methods | tb.decode(..).encode(..) |
-| test_string.py:82 | ok   | str_methods | ts.partition(..) |
-| test_string.py:83 | ok   | str_methods | ts.rpartition(..) |
-| test_string.py:84 | ok   | str_methods | ts.rsplit(..) |
-| test_string.py:85 | ok   | str_methods | ts.split(..) |
-| test_string.py:86 | ok   | str_methods | ts.splitlines() |
-| test_string.py:91 | ok   | str_methods | "safe".replace(..) |
-| test_string.py:93 | fail | str_methods | ts.join(..) |
-| test_string.py:94 | fail | str_methods | ts.join(..) |
-| test_string.py:104 | fail | non_syntactic | meth() |
-| test_string.py:105 | fail | non_syntactic | _str(..) |
-| test_string.py:114 | ok   | percent_fmt | BinaryExpr |
-| test_string.py:115 | ok   | percent_fmt | BinaryExpr |
-| test_string.py:116 | ok   | percent_fmt | BinaryExpr |
-| test_string.py:126 | ok   | binary_decode_encode | base64.b64encode(..) |
-| test_string.py:127 | ok   | binary_decode_encode | base64.b64decode(..) |
-| test_string.py:129 | ok   | binary_decode_encode | base64.standard_b64encode(..) |
-| test_string.py:130 | ok   | binary_decode_encode | base64.standard_b64decode(..) |
-| test_string.py:132 | ok   | binary_decode_encode | base64.urlsafe_b64encode(..) |
-| test_string.py:133 | ok   | binary_decode_encode | base64.urlsafe_b64decode(..) |
-| test_string.py:135 | ok   | binary_decode_encode | base64.b32encode(..) |
-| test_string.py:136 | ok   | binary_decode_encode | base64.b32decode(..) |
-| test_string.py:138 | ok   | binary_decode_encode | base64.b16encode(..) |
-| test_string.py:139 | ok   | binary_decode_encode | base64.b16decode(..) |
-| test_string.py:142 | ok   | binary_decode_encode | base64.encodestring(..) |
-| test_string.py:143 | ok   | binary_decode_encode | base64.decodestring(..) |
-| test_string.py:148 | fail | binary_decode_encode | quopri.encodestring(..) |
-| test_string.py:149 | fail | binary_decode_encode | quopri.decodestring(..) |
-| test_string.py:159 | ok   | test_os_path_join | os.path.join(..) |
-| test_string.py:160 | ok   | test_os_path_join | os.path.join(..) |
-| test_string.py:161 | ok   | test_os_path_join | os.path.join(..) |
-| test_string.py:162 | ok   | test_os_path_join | ospath_alias.join(..) |
-| test_unpacking.py:16 | ok   | unpacking | a |
-| test_unpacking.py:16 | ok   | unpacking | b |
-| test_unpacking.py:16 | ok   | unpacking | c |
-| test_unpacking.py:22 | ok   | unpacking_to_list | a |
-| test_unpacking.py:22 | ok   | unpacking_to_list | b |
-| test_unpacking.py:22 | ok   | unpacking_to_list | c |
-| test_unpacking.py:31 | ok   | nested | a1 |
-| test_unpacking.py:31 | ok   | nested | a2 |
-| test_unpacking.py:31 | ok   | nested | a3 |
-| test_unpacking.py:31 | ok   | nested | b |
-| test_unpacking.py:31 | ok   | nested | c |
-| test_unpacking.py:35 | ok   | nested | a1 |
-| test_unpacking.py:35 | ok   | nested | a2 |
-| test_unpacking.py:35 | ok   | nested | a3 |
-| test_unpacking.py:35 | ok   | nested | b |
-| test_unpacking.py:35 | ok   | nested | c |
-| test_unpacking.py:39 | ok   | nested | a1 |
-| test_unpacking.py:39 | ok   | nested | a2 |
-| test_unpacking.py:39 | ok   | nested | a3 |
-| test_unpacking.py:39 | ok   | nested | b |
-| test_unpacking.py:39 | ok   | nested | c |
-| test_unpacking.py:46 | ok   | unpack_from_set | a |
-| test_unpacking.py:46 | ok   | unpack_from_set | b |
-| test_unpacking.py:46 | ok   | unpack_from_set | c |
-| test_unpacking.py:55 | ok   | contrived_1 | a |
-| test_unpacking.py:55 | ok   | contrived_1 | b |
-| test_unpacking.py:55 | ok   | contrived_1 | c |
-| test_unpacking.py:56 | fail | contrived_1 | d |
-| test_unpacking.py:56 | fail | contrived_1 | e |
-| test_unpacking.py:56 | fail | contrived_1 | f |
-| test_unpacking.py:65 | ok   | contrived_2 | a |
-| test_unpacking.py:65 | ok   | contrived_2 | b |
-| test_unpacking.py:65 | ok   | contrived_2 | c |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.ql
deleted file mode 100644
index 80625505fa24..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.ql
+++ /dev/null
@@ -1 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_collections.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_collections.py
index e8ad3af05a85..f8a59ad37ead 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_collections.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_collections.py
@@ -20,23 +20,23 @@ def test_construction():
     tainted_dict = {'key': tainted_string}
 
     ensure_tainted(
-        tainted_string,
-        tainted_list,
-        tainted_tuple,
-        tainted_set,
-        tainted_dict,
+        tainted_string, # $ tainted
+        tainted_list, # $ tainted
+        tainted_tuple, # $ tainted
+        tainted_set, # $ tainted
+        tainted_dict, # $ tainted
     )
 
     ensure_tainted(
-        list(tainted_list),
-        list(tainted_tuple),
-        list(tainted_set),
-        list(tainted_dict.values()),
-        list(tainted_dict.items()),
-
-        tuple(tainted_list),
-        set(tainted_list),
-        frozenset(tainted_list),
+        list(tainted_list), # $ tainted
+        list(tainted_tuple), # $ tainted
+        list(tainted_set), # $ tainted
+        list(tainted_dict.values()), # $ tainted
+        list(tainted_dict.items()), # $ tainted
+
+        tuple(tainted_list), # $ tainted
+        set(tainted_list), # $ tainted
+        frozenset(tainted_list), # $ tainted
     )
 
 
@@ -44,39 +44,39 @@ def test_access(x, y, z):
     tainted_list = TAINTED_LIST
 
     ensure_tainted(
-        tainted_list[0],
-        tainted_list[x],
-        tainted_list[y:z],
-
-        sorted(tainted_list),
-        reversed(tainted_list),
-        iter(tainted_list),
-        next(iter(tainted_list)),
+        tainted_list[0], # $ tainted
+        tainted_list[x], # $ tainted
+        tainted_list[y:z], # $ tainted
+
+        sorted(tainted_list), # $ tainted
+        reversed(tainted_list), # $ tainted
+        iter(tainted_list), # $ tainted
+        next(iter(tainted_list)), # $ tainted
     )
 
     a, b, c = tainted_list[0:3]
-    ensure_tainted(a, b, c)
+    ensure_tainted(a, b, c) # $ tainted
 
     for h in tainted_list:
-        ensure_tainted(h)
+        ensure_tainted(h) # $ tainted
     for i in reversed(tainted_list):
-        ensure_tainted(i)
+        ensure_tainted(i) # $ tainted
 
 
 def test_dict_access(x):
     tainted_dict = TAINTED_DICT
 
     ensure_tainted(
-        tainted_dict["name"],
-        tainted_dict.get("name"),
-        tainted_dict[x],
-        tainted_dict.copy(),
+        tainted_dict["name"], # $ tainted
+        tainted_dict.get("name"), # $ tainted
+        tainted_dict[x], # $ tainted
+        tainted_dict.copy(), # $ tainted
     )
 
     for v in tainted_dict.values():
-        ensure_tainted(v)
+        ensure_tainted(v) # $ tainted
     for k, v in tainted_dict.items():
-        ensure_tainted(v)
+        ensure_tainted(v) # $ tainted
 
 
 def test_named_tuple(): # TODO: namedtuple currently not handled
@@ -84,8 +84,8 @@ def test_named_tuple(): # TODO: namedtuple currently not handled
     point = Point(TAINTED_STRING, 'safe')
 
     ensure_tainted(
-        point[0],
-        point.x,
+        point[0], # $ MISSING: tainted
+        point.x, # $ MISSING: tainted
     )
 
     ensure_not_tainted(
@@ -94,7 +94,7 @@ def test_named_tuple(): # TODO: namedtuple currently not handled
     )
 
     a, b = point
-    ensure_tainted(a)
+    ensure_tainted(a) # $ MISSING: tainted
     ensure_not_tainted(b)
 
 
@@ -103,23 +103,23 @@ def test_defaultdict(key, x): # TODO: defaultdict currently not handled
     tainted_default_dict[key] += TAINTED_STRING
 
     ensure_tainted(
-        tainted_default_dict["name"],
-        tainted_default_dict.get("name"),
-        tainted_default_dict[x],
-        tainted_default_dict.copy(),
+        tainted_default_dict["name"], # $ MISSING: tainted
+        tainted_default_dict.get("name"), # $ MISSING: tainted
+        tainted_default_dict[x], # $ MISSING: tainted
+        tainted_default_dict.copy(), # $ MISSING: tainted
     )
     for v in tainted_default_dict.values():
-        ensure_tainted(v)
+        ensure_tainted(v) # $ MISSING: tainted
     for k, v in tainted_default_dict.items():
-        ensure_tainted(v)
+        ensure_tainted(v) # $ MISSING: tainted
 
 
 def test_copy_1():
     from copy import copy, deepcopy
 
     ensure_tainted(
-        copy(TAINTED_LIST),
-        deepcopy(TAINTED_LIST),
+        copy(TAINTED_LIST), # $ tainted
+        deepcopy(TAINTED_LIST), # $ tainted
     )
 
 
@@ -127,8 +127,8 @@ def test_copy_2():
     import copy
 
     ensure_tainted(
-        copy.copy(TAINTED_LIST),
-        copy.deepcopy(TAINTED_LIST),
+        copy.copy(TAINTED_LIST), # $ tainted
+        copy.deepcopy(TAINTED_LIST), # $ tainted
     )
 
 
@@ -139,7 +139,7 @@ def list_index_assign():
     ensure_not_tainted(my_list)
 
     my_list[0] = tainted_string
-    ensure_tainted(my_list)
+    ensure_tainted(my_list) # $ MISSING: tainted
 
 
 def list_index_aug_assign():
@@ -149,7 +149,7 @@ def list_index_aug_assign():
     ensure_not_tainted(my_list)
 
     my_list[0] += tainted_string
-    ensure_tainted(my_list)
+    ensure_tainted(my_list) # $ MISSING: tainted
 
 
 def list_append():
@@ -159,7 +159,7 @@ def list_append():
     ensure_not_tainted(my_list)
 
     my_list.append(tainted_string)
-    ensure_tainted(my_list)
+    ensure_tainted(my_list) # $ tainted
 
 
 def list_extend():
@@ -169,7 +169,7 @@ def list_extend():
     ensure_not_tainted(my_list)
 
     my_list.extend(tainted_list)
-    ensure_tainted(my_list)
+    ensure_tainted(my_list) # $ MISSING: tainted
 
 
 def dict_update_dict():
@@ -179,7 +179,7 @@ def dict_update_dict():
     ensure_not_tainted(my_dict)
 
     my_dict.update(tainted_dict)
-    ensure_tainted(my_dict)
+    ensure_tainted(my_dict) # $ MISSING: tainted
 
 
 def dict_update_kv_list():
@@ -189,7 +189,7 @@ def dict_update_kv_list():
     ensure_not_tainted(my_dict)
 
     my_dict.update(tainted_kv_list)
-    ensure_tainted(my_dict)
+    ensure_tainted(my_dict) # $ MISSING: tainted
 
 
 def dict_update_kv_arg():
@@ -198,7 +198,7 @@ def dict_update_kv_arg():
     ensure_not_tainted(my_dict)
 
     my_dict.update(key2=TAINTED_STRING)
-    ensure_tainted(my_dict)
+    ensure_tainted(my_dict) # $ MISSING: tainted
 
 
 def dict_manual_update():
@@ -209,7 +209,7 @@ def dict_manual_update():
 
     for k in tainted_dict:
         my_dict[k] = tainted_dict[k]
-    ensure_tainted(my_dict)
+    ensure_tainted(my_dict) # $ MISSING: tainted
 
 
 def dict_merge():
@@ -217,7 +217,7 @@ def dict_merge():
     tainted_dict = {"key2": TAINTED_STRING}
 
     merged = {**my_dict, **tainted_dict}
-    ensure_tainted(merged)
+    ensure_tainted(merged) # $ MISSING: tainted
 
 
 def set_add():
@@ -227,7 +227,7 @@ def set_add():
     ensure_not_tainted(my_set)
 
     my_set.add(tainted_string)
-    ensure_tainted(my_set)
+    ensure_tainted(my_set) # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py
index dbf1b042e44d..a7398b4d0016 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py
@@ -23,16 +23,16 @@ def test():
     import json
 
     ensure_tainted(
-        json.dumps(ts),
-        json.loads(json.dumps(ts)),
+        json.dumps(ts), # $ tainted
+        json.loads(json.dumps(ts)), # $ tainted
     )
 
     # For Python2, need to convert to unicode for StringIO to work
     tainted_filelike = StringIO(unicode(json.dumps(ts)))
 
     ensure_tainted(
-        tainted_filelike,
-        json.load(tainted_filelike),
+        tainted_filelike, # $ MISSING: tainted
+        json.load(tainted_filelike), # $ MISSING: tainted
     )
 
 def non_syntacical():
@@ -45,17 +45,17 @@ def non_syntacical():
     dumps_alias = dumps
 
     ensure_tainted(
-        dumps(ts),
-        dumps_alias(ts),
-        loads(dumps(ts)),
+        dumps(ts), # $ tainted
+        dumps_alias(ts), # $ tainted
+        loads(dumps(ts)), # $ tainted
     )
 
     # For Python2, need to convert to unicode for StringIO to work
     tainted_filelike = StringIO(unicode(dumps(ts)))
 
     ensure_tainted(
-        tainted_filelike,
-        load(tainted_filelike),
+        tainted_filelike, # $ MISSING: tainted
+        load(tainted_filelike), # $ MISSING: tainted
     )
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py
index 5c80a8212f34..eed3543bc170 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py
@@ -22,23 +22,23 @@ def str_operations():
     tb = TAINTED_BYTES
 
     ensure_tainted(
-        ts,
-        ts + "foo",
-        "foo" + ts,
-        ts * 5,
-        ts[0 : len(ts)],
-        ts[:],
-        ts[0:1000],
-        ts[0],
-        str(ts),
-        bytes(tb),
-        unicode(ts),
+        ts, # $ tainted
+        ts + "foo", # $ tainted
+        "foo" + ts, # $ tainted
+        ts * 5, # $ tainted
+        ts[0 : len(ts)], # $ tainted
+        ts[:], # $ tainted
+        ts[0:1000], # $ tainted
+        ts[0], # $ tainted
+        str(ts), # $ tainted
+        bytes(tb), # $ tainted
+        unicode(ts), # $ tainted
     )
 
     aug_assignment = "safe"
     ensure_not_tainted(aug_assignment)
     aug_assignment += TAINTED_STRING
-    ensure_tainted(aug_assignment)
+    ensure_tainted(aug_assignment) # $ tainted
 
 
 def str_methods():
@@ -46,52 +46,54 @@ def str_methods():
     ts = TAINTED_STRING
     tb = TAINTED_BYTES
     ensure_tainted(
-        ts.capitalize(),
-        ts.center(100),
-        ts.expandtabs(),
+        ts.capitalize(), # $ tainted
+        ts.center(100), # $ tainted
+        ts.expandtabs(), # $ tainted
 
-        ts.format(),
-        "{}".format(ts),
-        "{unsafe}".format(unsafe=ts),
+        ts.format(), # $ tainted
+        "{}".format(ts), # $ tainted
+        "{unsafe}".format(unsafe=ts), # $ tainted
 
-        ts.join(["", ""]),
-        "".join([ts]),
+        ts.join(["", ""]), # $ tainted
+        "".join([ts]), # $ tainted
 
-        ts.ljust(100),
-        ts.lstrip(),
-        ts.lower(),
+        ts.ljust(100), # $ tainted
+        ts.lstrip(), # $ tainted
+        ts.lower(), # $ tainted
 
-        ts.replace("old", "new"),
-        "safe".replace("safe", ts),
+        ts.replace("old", "new"), # $ tainted
+        "safe".replace("safe", ts), # $ tainted
 
-        ts.rjust(100),
-        ts.rstrip(),
-        ts.strip(),
-        ts.swapcase(),
-        ts.title(),
-        ts.upper(),
-        ts.zfill(100),
+        ts.rjust(100), # $ tainted
+        ts.rstrip(), # $ tainted
+        ts.strip(), # $ tainted
+        ts.swapcase(), # $ tainted
+        ts.title(), # $ tainted
+        ts.upper(), # $ tainted
+        ts.zfill(100), # $ tainted
 
-        ts.encode("utf-8"),
-        ts.encode("utf-8").decode("utf-8"),
+        ts.encode("utf-8"), # $ tainted
+        ts.encode("utf-8").decode("utf-8"), # $ tainted
 
-        tb.decode("utf-8"),
-        tb.decode("utf-8").encode("utf-8"),
+        tb.decode("utf-8"), # $ tainted
+        tb.decode("utf-8").encode("utf-8"), # $ tainted
 
         # string methods that return a list
-        ts.partition("_"),
-        ts.rpartition("_"),
-        ts.rsplit("_"),
-        ts.split("_"),
-        ts.splitlines(),
+        ts.partition("_"), # $ tainted
+        ts.rpartition("_"), # $ tainted
+        ts.rsplit("_"), # $ tainted
+        ts.split("_"), # $ tainted
+        ts.splitlines(), # $ tainted
     )
 
     ensure_not_tainted(
         # Intuitively I think this should be safe, but better discuss it
         "safe".replace(ts, "also-safe"),
 
-        ts.join([]),  # FP due to separator not being used with zero/one elements
-        ts.join(["safe"]),  # FP due to separator not being used with zero/one elements
+        # FPs due to separator (`ts`) not ending up in result, when the list only has
+        # zero/one elements
+        ts.join([]), # $ SPURIOUS: tainted
+        ts.join(["safe"]),  # $ SPURIOUS: tainted
     )
 
 
@@ -101,8 +103,8 @@ def non_syntactic():
     meth = ts.upper
     _str = str
     ensure_tainted(
-        meth(),
-        _str(ts),
+        meth(), # $ MISSING: tainted
+        _str(ts), # $ MISSING: tainted
     )
 
 
@@ -111,9 +113,9 @@ def percent_fmt():
     ts = TAINTED_STRING
     tainted_fmt = ts + " %s %s"
     ensure_tainted(
-        tainted_fmt % (1, 2),
-        "%s foo bar" % ts,
-        "%s %s %s" % (1, 2, ts),
+        tainted_fmt % (1, 2), # $ tainted
+        "%s foo bar" % ts, # $ tainted
+        "%s %s %s" % (1, 2, ts), # $ tainted
     )
 
 
@@ -123,30 +125,30 @@ def binary_decode_encode():
     import base64
 
     ensure_tainted(
-        base64.b64encode(tb),
-        base64.b64decode(base64.b64encode(tb)),
+        base64.b64encode(tb), # $ tainted
+        base64.b64decode(base64.b64encode(tb)), # $ tainted
 
-        base64.standard_b64encode(tb),
-        base64.standard_b64decode(base64.standard_b64encode(tb)),
+        base64.standard_b64encode(tb), # $ tainted
+        base64.standard_b64decode(base64.standard_b64encode(tb)), # $ tainted
 
-        base64.urlsafe_b64encode(tb),
-        base64.urlsafe_b64decode(base64.urlsafe_b64encode(tb)),
+        base64.urlsafe_b64encode(tb), # $ tainted
+        base64.urlsafe_b64decode(base64.urlsafe_b64encode(tb)), # $ tainted
 
-        base64.b32encode(tb),
-        base64.b32decode(base64.b32encode(tb)),
+        base64.b32encode(tb), # $ tainted
+        base64.b32decode(base64.b32encode(tb)), # $ tainted
 
-        base64.b16encode(tb),
-        base64.b16decode(base64.b16encode(tb)),
+        base64.b16encode(tb), # $ tainted
+        base64.b16decode(base64.b16encode(tb)), # $ tainted
 
         # deprecated since Python 3.1, but still works
-        base64.encodestring(tb),
-        base64.decodestring(base64.encodestring(tb)),
+        base64.encodestring(tb), # $ tainted
+        base64.decodestring(base64.encodestring(tb)), # $ tainted
     )
 
     import quopri
     ensure_tainted(
-        quopri.encodestring(tb),
-        quopri.decodestring(quopri.encodestring(tb)),
+        quopri.encodestring(tb), # $ MISSING: tainted
+        quopri.decodestring(quopri.encodestring(tb)), # $ MISSING: tainted
     )
 
 
@@ -156,10 +158,10 @@ def test_os_path_join():
     print("\n# test_os_path_join")
     ts = TAINTED_STRING
     ensure_tainted(
-        os.path.join(ts, "foo", "bar"),
-        os.path.join(ts),
-        os.path.join("foo", "bar", ts),
-        ospath_alias.join("foo", "bar", ts),
+        os.path.join(ts, "foo", "bar"), # $ tainted
+        os.path.join(ts), # $ tainted
+        os.path.join("foo", "bar", ts), # $ tainted
+        ospath_alias.join("foo", "bar", ts), # $ tainted
     )
 
 
diff --git a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_unpacking.py b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_unpacking.py
index b6403a6e37a7..d8bfe71dbc44 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_unpacking.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_unpacking.py
@@ -13,13 +13,13 @@
 def unpacking():
     l = TAINTED_LIST[0:3]
     a, b, c = l
-    ensure_tainted(a, b, c)
+    ensure_tainted(a, b, c) # $ tainted
 
 
 def unpacking_to_list():
     l = TAINTED_LIST[0:3]
     [a, b, c] = l
-    ensure_tainted(a, b, c)
+    ensure_tainted(a, b, c) # $ tainted
 
 
 def nested():
@@ -28,22 +28,22 @@ def nested():
 
     # list
     [[a1, a2, a3], b, c] = ll
-    ensure_tainted(a1, a2, a3, b, c)
+    ensure_tainted(a1, a2, a3, b, c) # $ tainted
 
     # tuple
     ((a1, a2, a3), b, c) = ll
-    ensure_tainted(a1, a2, a3, b, c)
+    ensure_tainted(a1, a2, a3, b, c) # $ tainted
 
     # mixed
     [(a1, a2, a3), b, c] = ll
-    ensure_tainted(a1, a2, a3, b, c)
+    ensure_tainted(a1, a2, a3, b, c) # $ tainted
 
 
 def unpack_from_set():
     # no guarantee on ordering ... don't know why you would ever do this
     a, b, c = {"foo", "bar", TAINTED_STRING}
     # either all should be tainted, or none of them
-    ensure_tainted(a, b, c)
+    ensure_tainted(a, b, c) # $ tainted
 
 
 def contrived_1():
@@ -52,8 +52,8 @@ def contrived_1():
     no_taint_list = [1,2,3]
 
     (a, b, c), (d, e, f) = tainted_list, no_taint_list
-    ensure_tainted(a, b, c)
-    ensure_not_tainted(d, e, f) # FP: we mark `d`, `e` and `f` as tainted.
+    ensure_tainted(a, b, c) # $ tainted
+    ensure_not_tainted(d, e, f) # $ SPURIOUS: tainted
 
 
 def contrived_2():
@@ -62,7 +62,7 @@ def contrived_2():
     # Old taint tracking was only able to handle taint nested 2 levels in sequences,
     # so would not mark a, b, c as tainted
     [[[ (a, b, c) ]]] = [[[ TAINTED_LIST[0:3] ]]]
-    ensure_tainted(a, b, c)
+    ensure_tainted(a, b, c) # $ tainted
 
 
 # Make tests runable
diff --git a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.expected b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.ql b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/test.py b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/test.py
index 09fdaeb8c0b1..d4f9bda2eec3 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/test.py
+++ b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/test.py
@@ -25,14 +25,14 @@ def write_global():
 ensure_not_tainted(initially_tainted)
 
 def use_of_initially_tainted():
-    ensure_not_tainted(initially_tainted) # FP
+    ensure_not_tainted(initially_tainted) # $ SPURIOUS: tainted
 
 
 # A very similar case to the above, but here we _do_ want taint flow, because the initially tainted
-# value is actually used before it gets reassigned to an untainted value. 
+# value is actually used before it gets reassigned to an untainted value.
 
 def use_of_initially_tainted2():
-    ensure_tainted(initially_tainted2)
+    ensure_tainted(initially_tainted2) # $ tainted
 
 initially_tainted2 = TAINTED_STRING
 use_of_initially_tainted2()
@@ -47,7 +47,7 @@ def write_tainted():
     g = TAINTED_STRING
 
 def sink_global():
-    ensure_tainted(g)
+    ensure_tainted(g) # $ tainted
 
 write_global()
 write_tainted()
diff --git a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.expected b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.expected
deleted file mode 100644
index 275ca11f34b2..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.expected
+++ /dev/null
@@ -1,6 +0,0 @@
-| test.py:12 | ok   | test | tainted_later |
-| test.py:25 | ok   | test | initially_tainted |
-| test.py:28 | fail | use_of_initially_tainted | initially_tainted |
-| test.py:35 | ok   | use_of_initially_tainted2 | initially_tainted2 |
-| test.py:40 | ok   | test | initially_tainted2 |
-| test.py:50 | ok   | sink_global | g |
diff --git a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.ql
deleted file mode 100644
index 80625505fa24..000000000000
--- a/python/ql/test/experimental/dataflow/tainttracking/unwanted-global-flow/testTaint.ql
+++ /dev/null
@@ -1 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
diff --git a/python/ql/test/experimental/meta/InlineTaintTest.qll b/python/ql/test/experimental/meta/InlineTaintTest.qll
new file mode 100644
index 000000000000..b45029477d41
--- /dev/null
+++ b/python/ql/test/experimental/meta/InlineTaintTest.qll
@@ -0,0 +1,91 @@
+/**
+ * Defines a InlineExpectationsTest for checking whether any arguments in
+ * `ensure_tainted` and `ensure_not_tainted` calls are tainted.
+ *
+ * Also defines query predicates to ensure that:
+ * - if any arguments to `ensure_not_tainted` are tainted, their annotation is marked with `SPURIOUS`.
+ * - if any arguments to `ensure_tainted` are not tainted, their annotation is marked with `MISSING`.
+ *
+ * The functionality of this module is tested in `ql/test/experimental/meta/inline-taint-test-demo`.
+ */
+
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.RemoteFlowSources
+import TestUtilities.InlineExpectationsTest
+import experimental.dataflow.TestUtil.PrintNode
+
+DataFlow::Node shouldBeTainted() {
+  exists(DataFlow::CallCfgNode call |
+    call.getFunction().asCfgNode().(NameNode).getId() = "ensure_tainted" and
+    result in [call.getArg(_), call.getArgByName(_)]
+  )
+}
+
+DataFlow::Node shouldNotBeTainted() {
+  exists(DataFlow::CallCfgNode call |
+    call.getFunction().asCfgNode().(NameNode).getId() = "ensure_not_tainted" and
+    result in [call.getArg(_), call.getArgByName(_)]
+  )
+}
+
+class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
+  TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asCfgNode().(NameNode).getId() in [
+        "TAINTED_STRING", "TAINTED_BYTES", "TAINTED_LIST", "TAINTED_DICT"
+      ]
+    or
+    source instanceof RemoteFlowSource
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = shouldBeTainted()
+    or
+    sink = shouldNotBeTainted()
+  }
+}
+
+class InlineTaintTest extends InlineExpectationsTest {
+  InlineTaintTest() { this = "InlineTaintTest" }
+
+  override string getARelevantTag() { result = "tainted" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
+    exists(DataFlow::Node sink |
+      any(TestTaintTrackingConfiguration config).hasFlow(_, sink) and
+      location = sink.getLocation() and
+      element = prettyExp(sink.asExpr()) and
+      value = "" and
+      tag = "tainted"
+    )
+  }
+}
+
+query predicate argumentToEnsureNotTaintedNotMarkedAsSpurious(
+  string error, Location location, string element
+) {
+  error = "ERROR, you should add `SPURIOUS:` to this annotation" and
+  location = shouldNotBeTainted().getLocation() and
+  any(InlineTaintTest test).hasActualResult(location, element, "tainted", _) and
+  exists(GoodExpectation good, ActualResult actualResult |
+    good.matchesActualResult(actualResult) and
+    actualResult.getLocation() = location and
+    actualResult.toString() = element
+  )
+}
+
+query predicate untaintedArgumentToEnsureTaintedNotMarkedAsMissing(string error, Location location) {
+  error = "ERROR, you should add `# $ MISSING: tainted` annotation" and
+  exists(DataFlow::Node sink |
+    sink = shouldBeTainted() and
+    not any(TestTaintTrackingConfiguration config).hasFlow(_, sink) and
+    location = sink.getLocation() and
+    not exists(FalseNegativeExpectation missingResult |
+      missingResult.getLocation().getStartLine() = location.getStartLine()
+    )
+  )
+}
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
new file mode 100644
index 000000000000..1b9dcc764beb
--- /dev/null
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
@@ -0,0 +1,5 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+| ERROR, you should add `SPURIOUS:` to this annotation | taint_test.py:36:9:36:29 | taint_test.py:36 | should_not_be_tainted |
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:28:9:28:25 | taint_test.py:28 |
+failures
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.ql b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py b/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
new file mode 100644
index 000000000000..c5c64b05ff13
--- /dev/null
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
@@ -0,0 +1,37 @@
+def expected_usage():
+    ts = TAINTED_STRING
+
+    # simulating handling something we _want_ to treat at tainted, but we currently treat as untainted
+    should_be_tainted = "pretend this is unsafe"
+
+    ensure_tainted(
+        ts, # $ tainted
+        should_be_tainted, # $ MISSING: tainted
+    )
+
+    # simulating handling something we _want_ to treat at untainted, but we currently treat as tainted
+    should_not_be_tainted = "pretend this is now safe" + ts
+    ensure_not_tainted(
+        should_not_be_tainted, # $ SPURIOUS: tainted
+        "FOO"
+    )
+
+
+def bad_usage():
+    ts = TAINTED_STRING
+
+    # simulating handling something we _want_ to treat at tainted, but we currently treat as untainted
+    should_be_tainted = "pretend this is unsafe"
+
+    # This element _should_ have a `$ MISSING: tainted` annotation, which will be alerted in the .expected output
+    ensure_tainted(
+        should_be_tainted,
+    )
+
+    # simulating handling something we _want_ to treat at untainted, but we currently treat as tainted
+    should_not_be_tainted = "pretend this is now safe" + ts
+
+    # This annotation _should_ have used `SPURIOUS`, which will be alerted on in the .expected output
+    ensure_not_tainted(
+        should_not_be_tainted # $ tainted
+    )
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.expected b/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.ql b/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected b/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
deleted file mode 100644
index 0888473f41ce..000000000000
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
+++ /dev/null
@@ -1,100 +0,0 @@
-| response_test.py:61 | ok   | get_redirect_url | foo |
-| taint_forms.py:6 | ok   | to_python | value |
-| taint_forms.py:9 | ok   | validate | value |
-| taint_forms.py:12 | ok   | run_validators | value |
-| taint_forms.py:15 | ok   | clean | value |
-| taint_forms.py:33 | ok   | clean | cleaned_data |
-| taint_forms.py:34 | ok   | clean | cleaned_data["key"] |
-| taint_forms.py:35 | ok   | clean | cleaned_data.get(..) |
-| taint_forms.py:39 | ok   | clean | self.cleaned_data |
-| taint_forms.py:40 | ok   | clean | self.cleaned_data["key"] |
-| taint_forms.py:41 | ok   | clean | self.cleaned_data.get(..) |
-| taint_forms.py:46 | ok   | clean_foo | self.cleaned_data |
-| taint_test.py:8 | ok   | test_taint | bar |
-| taint_test.py:8 | ok   | test_taint | foo |
-| taint_test.py:9 | ok   | test_taint | baz |
-| taint_test.py:15 | ok   | test_taint | request |
-| taint_test.py:17 | ok   | test_taint | request.body |
-| taint_test.py:18 | ok   | test_taint | request.path |
-| taint_test.py:19 | ok   | test_taint | request.path_info |
-| taint_test.py:23 | ok   | test_taint | request.method |
-| taint_test.py:25 | ok   | test_taint | request.encoding |
-| taint_test.py:26 | ok   | test_taint | request.content_type |
-| taint_test.py:29 | ok   | test_taint | request.content_params |
-| taint_test.py:30 | ok   | test_taint | request.content_params["key"] |
-| taint_test.py:31 | ok   | test_taint | request.content_params.get(..) |
-| taint_test.py:35 | ok   | test_taint | request.GET |
-| taint_test.py:36 | ok   | test_taint | request.GET["key"] |
-| taint_test.py:37 | ok   | test_taint | request.GET.get(..) |
-| taint_test.py:38 | fail | test_taint | request.GET.getlist(..) |
-| taint_test.py:39 | fail | test_taint | request.GET.getlist(..)[0] |
-| taint_test.py:40 | ok   | test_taint | request.GET.pop(..) |
-| taint_test.py:41 | ok   | test_taint | request.GET.pop(..)[0] |
-| taint_test.py:42 | ok   | test_taint | request.GET.popitem()[0] |
-| taint_test.py:43 | ok   | test_taint | request.GET.popitem()[1] |
-| taint_test.py:44 | ok   | test_taint | request.GET.popitem()[1][0] |
-| taint_test.py:45 | fail | test_taint | request.GET.dict() |
-| taint_test.py:46 | fail | test_taint | request.GET.dict()["key"] |
-| taint_test.py:47 | fail | test_taint | request.GET.urlencode() |
-| taint_test.py:50 | ok   | test_taint | request.POST |
-| taint_test.py:53 | ok   | test_taint | request.COOKIES |
-| taint_test.py:54 | ok   | test_taint | request.COOKIES["key"] |
-| taint_test.py:55 | ok   | test_taint | request.COOKIES.get(..) |
-| taint_test.py:58 | ok   | test_taint | request.FILES |
-| taint_test.py:59 | ok   | test_taint | request.FILES["key"] |
-| taint_test.py:60 | fail | test_taint | request.FILES["key"].content_type |
-| taint_test.py:61 | fail | test_taint | request.FILES["key"].content_type_extra |
-| taint_test.py:62 | fail | test_taint | request.FILES["key"].content_type_extra["key"] |
-| taint_test.py:63 | fail | test_taint | request.FILES["key"].charset |
-| taint_test.py:64 | fail | test_taint | request.FILES["key"].name |
-| taint_test.py:65 | fail | test_taint | request.FILES["key"].file |
-| taint_test.py:66 | fail | test_taint | request.FILES["key"].file.read() |
-| taint_test.py:68 | ok   | test_taint | request.FILES.get(..) |
-| taint_test.py:69 | fail | test_taint | request.FILES.get(..).name |
-| taint_test.py:70 | fail | test_taint | request.FILES.getlist(..) |
-| taint_test.py:71 | fail | test_taint | request.FILES.getlist(..)[0] |
-| taint_test.py:72 | fail | test_taint | request.FILES.getlist(..)[0].name |
-| taint_test.py:73 | fail | test_taint | request.FILES.dict() |
-| taint_test.py:74 | fail | test_taint | request.FILES.dict()["key"] |
-| taint_test.py:75 | fail | test_taint | request.FILES.dict()["key"].name |
-| taint_test.py:78 | ok   | test_taint | request.META |
-| taint_test.py:79 | ok   | test_taint | request.META["HTTP_USER_AGENT"] |
-| taint_test.py:80 | ok   | test_taint | request.META.get(..) |
-| taint_test.py:83 | ok   | test_taint | request.headers |
-| taint_test.py:84 | ok   | test_taint | request.headers["user-agent"] |
-| taint_test.py:85 | ok   | test_taint | request.headers["USER_AGENT"] |
-| taint_test.py:88 | ok   | test_taint | request.resolver_match |
-| taint_test.py:89 | fail | test_taint | request.resolver_match.args |
-| taint_test.py:90 | fail | test_taint | request.resolver_match.args[0] |
-| taint_test.py:91 | fail | test_taint | request.resolver_match.kwargs |
-| taint_test.py:92 | fail | test_taint | request.resolver_match.kwargs["key"] |
-| taint_test.py:94 | fail | test_taint | request.get_full_path() |
-| taint_test.py:95 | fail | test_taint | request.get_full_path_info() |
-| taint_test.py:99 | fail | test_taint | request.read() |
-| taint_test.py:100 | fail | test_taint | request.readline() |
-| taint_test.py:101 | fail | test_taint | request.readlines() |
-| taint_test.py:102 | fail | test_taint | request.readlines()[0] |
-| taint_test.py:103 | fail | test_taint | ListComp |
-| taint_test.py:109 | ok   | test_taint | args |
-| taint_test.py:110 | ok   | test_taint | args[0] |
-| taint_test.py:111 | ok   | test_taint | kwargs |
-| taint_test.py:112 | ok   | test_taint | kwargs["key"] |
-| taint_test.py:116 | ok   | test_taint | request.current_app |
-| taint_test.py:121 | ok   | test_taint | request.get_host() |
-| taint_test.py:122 | ok   | test_taint | request.get_port() |
-| taint_test.py:129 | fail | test_taint | request.build_absolute_uri() |
-| taint_test.py:130 | fail | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:131 | fail | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:134 | ok   | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:135 | ok   | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:143 | ok   | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:144 | ok   | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:145 | ok   | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:149 | fail | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:150 | fail | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:157 | ok   | some_method | self.request |
-| taint_test.py:158 | ok   | some_method | self.request.GET["key"] |
-| taint_test.py:160 | ok   | some_method | self.args |
-| taint_test.py:161 | ok   | some_method | self.args[0] |
-| taint_test.py:163 | ok   | some_method | self.kwargs |
-| taint_test.py:164 | ok   | some_method | self.kwargs["key"] |
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql b/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql
deleted file mode 100644
index 08783404ddd1..000000000000
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql
+++ /dev/null
@@ -1,6 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
-import semmle.python.dataflow.new.RemoteFlowSources
-
-class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-}
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
index 912523786777..1b98a735465f 100644
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
@@ -58,7 +58,7 @@ def redirect_shortcut(request):
 class CustomRedirectView(RedirectView):
 
     def get_redirect_url(self, foo): # $ requestHandler routedParameter=foo
-        ensure_tainted(foo)
+        ensure_tainted(foo) # $ tainted
         next = "https://example.com/{}".format(foo)
         return next # $ HttpResponse HttpRedirectResponse redirectLocation=next
 
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
index 5cc9c830e7c6..66021b64d293 100644
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
@@ -3,16 +3,16 @@
 
 class MyField(django.forms.Field):
     def to_python(self, value):
-        ensure_tainted(value)
+        ensure_tainted(value) # $ tainted
 
     def validate(self, value):
-        ensure_tainted(value)
+        ensure_tainted(value) # $ tainted
 
     def run_validators(self, value):
-        ensure_tainted(value)
+        ensure_tainted(value) # $ tainted
 
     def clean(self, value):
-        ensure_tainted(value)
+        ensure_tainted(value) # $ tainted
 
         # # Base definition of `clean` looks like the following, so there is actually
         # # _data flow_ from the methods, but we will ignore for simplicity.
@@ -30,17 +30,17 @@ def clean(self):
         cleaned_data = super().clean()
 
         ensure_tainted(
-            cleaned_data,
-            cleaned_data["key"],
-            cleaned_data.get("key"),
+            cleaned_data, # $ tainted
+            cleaned_data["key"], # $ tainted
+            cleaned_data.get("key"), # $ tainted
         )
 
         ensure_tainted(
-            self.cleaned_data,
-            self.cleaned_data["key"],
-            self.cleaned_data.get("key"),
+            self.cleaned_data, # $ tainted
+            self.cleaned_data["key"], # $ tainted
+            self.cleaned_data.get("key"), # $ tainted
         )
 
     def clean_foo(self):
         # This method is supposed to clean the `foo` field in context of this form.
-        ensure_tainted(self.cleaned_data)
+        ensure_tainted(self.cleaned_data) # $ tainted
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
index 9c21e59e2e3a..a2999ce63b9f 100644
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
@@ -5,111 +5,114 @@
 
 
 def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler routedParameter=foo routedParameter=bar
-    ensure_tainted(foo, bar)
+    ensure_tainted(foo, bar) # $ tainted
     ensure_not_tainted(baz)
 
     # Manually inspected all fields of the HttpRequest object
     # https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects
 
     ensure_tainted(
-        request,
+        request, # $ tainted
 
-        request.body,
-        request.path,
-        request.path_info,
+        request.body, # $ tainted
+        request.path, # $ tainted
+        request.path_info, # $ tainted
 
         # With CSRF middleware disabled, it's possible to use custom methods,
         # for example by `curl -X FOO <url>`
-        request.method,
+        request.method, # $ tainted
 
-        request.encoding,
-        request.content_type,
+        request.encoding, # $ tainted
+        request.content_type, # $ tainted
 
         # Dict[str, str]
-        request.content_params,
-        request.content_params["key"],
-        request.content_params.get("key"),
+        request.content_params, # $ tainted
+        request.content_params["key"], # $ tainted
+        request.content_params.get("key"), # $ tainted
 
         # django.http.QueryDict
         # see https://docs.djangoproject.com/en/3.0/ref/request-response/#querydict-objects
-        request.GET,
-        request.GET["key"],
-        request.GET.get("key"),
-        request.GET.getlist("key"),
-        request.GET.getlist("key")[0],
-        request.GET.pop("key"),
-        request.GET.pop("key")[0],
-        request.GET.popitem()[0], # key
-        request.GET.popitem()[1], # values
-        request.GET.popitem()[1][0], # values[0]
-        request.GET.dict(),
-        request.GET.dict()["key"],
-        request.GET.urlencode(),
+        request.GET, # $ tainted
+        request.GET["key"], # $ tainted
+        request.GET.get("key"), # $ tainted
+        request.GET.getlist("key"), # $ MISSING: tainted
+        request.GET.getlist("key")[0], # $ MISSING: tainted
+        request.GET.pop("key"), # $ tainted
+        request.GET.pop("key")[0], # $ tainted
+        # key
+        request.GET.popitem()[0], # $ tainted
+        # values
+        request.GET.popitem()[1], # $ tainted
+        # values[0]
+        request.GET.popitem()[1][0], # $ tainted
+        request.GET.dict(), # $ MISSING: tainted
+        request.GET.dict()["key"], # $ MISSING: tainted
+        request.GET.urlencode(), # $ MISSING: tainted
 
         # django.http.QueryDict (same as above, did not duplicate tests)
-        request.POST,
+        request.POST, # $ tainted
 
         # Dict[str, str]
-        request.COOKIES,
-        request.COOKIES["key"],
-        request.COOKIES.get("key"),
+        request.COOKIES, # $ tainted
+        request.COOKIES["key"], # $ tainted
+        request.COOKIES.get("key"), # $ tainted
 
         # MultiValueDict[str, UploadedFile]
-        request.FILES,
-        request.FILES["key"],
-        request.FILES["key"].content_type,
-        request.FILES["key"].content_type_extra,
-        request.FILES["key"].content_type_extra["key"],
-        request.FILES["key"].charset,
-        request.FILES["key"].name,
-        request.FILES["key"].file,
-        request.FILES["key"].file.read(),
-
-        request.FILES.get("key"),
-        request.FILES.get("key").name,
-        request.FILES.getlist("key"),
-        request.FILES.getlist("key")[0],
-        request.FILES.getlist("key")[0].name,
-        request.FILES.dict(),
-        request.FILES.dict()["key"],
-        request.FILES.dict()["key"].name,
+        request.FILES, # $ tainted
+        request.FILES["key"], # $ tainted
+        request.FILES["key"].content_type, # $ MISSING: tainted
+        request.FILES["key"].content_type_extra, # $ MISSING: tainted
+        request.FILES["key"].content_type_extra["key"], # $ MISSING: tainted
+        request.FILES["key"].charset, # $ MISSING: tainted
+        request.FILES["key"].name, # $ MISSING: tainted
+        request.FILES["key"].file, # $ MISSING: tainted
+        request.FILES["key"].file.read(), # $ MISSING: tainted
+
+        request.FILES.get("key"), # $ tainted
+        request.FILES.get("key").name, # $ MISSING: tainted
+        request.FILES.getlist("key"), # $ MISSING: tainted
+        request.FILES.getlist("key")[0], # $ MISSING: tainted
+        request.FILES.getlist("key")[0].name, # $ MISSING: tainted
+        request.FILES.dict(), # $ MISSING: tainted
+        request.FILES.dict()["key"], # $ MISSING: tainted
+        request.FILES.dict()["key"].name, # $ MISSING: tainted
 
         # Dict[str, Any]
-        request.META,
-        request.META["HTTP_USER_AGENT"],
-        request.META.get("HTTP_USER_AGENT"),
+        request.META, # $ tainted
+        request.META["HTTP_USER_AGENT"], # $ tainted
+        request.META.get("HTTP_USER_AGENT"), # $ tainted
 
         # HttpHeaders (case insensitive dict-like)
-        request.headers,
-        request.headers["user-agent"],
-        request.headers["USER_AGENT"],
+        request.headers, # $ tainted
+        request.headers["user-agent"], # $ tainted
+        request.headers["USER_AGENT"], # $ tainted
 
         # django.urls.ResolverMatch
-        request.resolver_match,
-        request.resolver_match.args,
-        request.resolver_match.args[0],
-        request.resolver_match.kwargs,
-        request.resolver_match.kwargs["key"],
-
-        request.get_full_path(),
-        request.get_full_path_info(),
+        request.resolver_match, # $ tainted
+        request.resolver_match.args, # $ MISSING: tainted
+        request.resolver_match.args[0], # $ MISSING: tainted
+        request.resolver_match.kwargs, # $ MISSING: tainted
+        request.resolver_match.kwargs["key"], # $ MISSING: tainted
+
+        request.get_full_path(), # $ MISSING: tainted
+        request.get_full_path_info(), # $ MISSING: tainted
         # build_absolute_uri handled below
         # get_signed_cookie handled below
 
-        request.read(),
-        request.readline(),
-        request.readlines(),
-        request.readlines()[0],
-        [line for line in request],
+        request.read(), # $ MISSING: tainted
+        request.readline(), # $ MISSING: tainted
+        request.readlines(), # $ MISSING: tainted
+        request.readlines()[0], # $ MISSING: tainted
+        [line for line in request], # $ MISSING: tainted
     )
 
     # django.urls.ResolverMatch also supports iterable unpacking
     _view, args, kwargs = request.resolver_match
     ensure_tainted(
-        args,
-        args[0],
-        kwargs,
-        kwargs["key"],
+        args, # $ tainted
+        args[0], # $ tainted
+        kwargs, # $ tainted
+        kwargs["key"], # $ tainted
     )
 
     ensure_not_tainted(
@@ -126,9 +129,9 @@ def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler rou
     # build_absolute_uri
     ####################################
     ensure_tainted(
-        request.build_absolute_uri(),
-        request.build_absolute_uri(request.GET["key"]),
-        request.build_absolute_uri(location=request.GET["key"]),
+        request.build_absolute_uri(), # $ MISSING: tainted
+        request.build_absolute_uri(request.GET["key"]), # $ MISSING: tainted
+        request.build_absolute_uri(location=request.GET["key"]), # $ MISSING: tainted
     )
     ensure_not_tainted(
         request.build_absolute_uri("/hardcoded/"),
@@ -146,22 +149,22 @@ def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler rou
     )
     # However, providing tainted default value might result in taint
     ensure_tainted(
-        request.get_signed_cookie("key", request.COOKIES["key"]),
-        request.get_signed_cookie("key", default=request.COOKIES["key"]),
+        request.get_signed_cookie("key", request.COOKIES["key"]), # $ MISSING: tainted
+        request.get_signed_cookie("key", default=request.COOKIES["key"]), # $ MISSING: tainted
     )
 
 
 class ClassView(View):
     def some_method(self):
         ensure_tainted(
-            self.request,
-            self.request.GET["key"],
+            self.request, # $ tainted
+            self.request.GET["key"], # $ tainted
 
-            self.args,
-            self.args[0],
+            self.args, # $ tainted
+            self.args[0], # $ tainted
 
-            self.kwargs,
-            self.kwargs["key"],
+            self.kwargs, # $ tainted
+            self.kwargs["key"], # $ tainted
         )
 
 
diff --git a/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.expected b/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.ql b/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/fabric/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/library-tests/frameworks/fabric/TestTaint.expected b/python/ql/test/library-tests/frameworks/fabric/TestTaint.expected
deleted file mode 100644
index d9e8db9dd5e8..000000000000
--- a/python/ql/test/library-tests/frameworks/fabric/TestTaint.expected
+++ /dev/null
@@ -1,10 +0,0 @@
-| fabric_v1_execute.py:7 | fail | unsafe | cmd |
-| fabric_v1_execute.py:7 | fail | unsafe | cmd2 |
-| fabric_v1_execute.py:8 | ok   | unsafe | safe_arg |
-| fabric_v1_execute.py:8 | ok   | unsafe | safe_optional |
-| fabric_v1_execute.py:14 | fail | unsafe | cmd |
-| fabric_v1_execute.py:14 | fail | unsafe | cmd2 |
-| fabric_v1_execute.py:15 | ok   | unsafe | safe_arg |
-| fabric_v1_execute.py:15 | ok   | unsafe | safe_optional |
-| fabric_v1_execute.py:21 | ok   | some_http_handler | cmd |
-| fabric_v1_execute.py:21 | ok   | some_http_handler | cmd2 |
diff --git a/python/ql/test/library-tests/frameworks/fabric/TestTaint.ql b/python/ql/test/library-tests/frameworks/fabric/TestTaint.ql
deleted file mode 100644
index 80625505fa24..000000000000
--- a/python/ql/test/library-tests/frameworks/fabric/TestTaint.ql
+++ /dev/null
@@ -1 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
diff --git a/python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py b/python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py
index 165a873b6311..8750fff17030 100644
--- a/python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py
+++ b/python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py
@@ -4,21 +4,21 @@
 
 
 def unsafe(cmd, safe_arg, cmd2=None, safe_optional=5):
-    ensure_tainted(cmd, cmd2)
+    ensure_tainted(cmd, cmd2)  # $ MISSING: tainted
     ensure_not_tainted(safe_arg, safe_optional)
 
 
 class Foo(object):
 
     def unsafe(self, cmd, safe_arg, cmd2=None, safe_optional=5):
-        ensure_tainted(cmd, cmd2)
+        ensure_tainted(cmd, cmd2)  # $ MISSING: tainted
         ensure_not_tainted(safe_arg, safe_optional)
 
 
 def some_http_handler():
     cmd = TAINTED_STRING
     cmd2 = TAINTED_STRING
-    ensure_tainted(cmd, cmd2)
+    ensure_tainted(cmd, cmd2) # $ tainted
 
     execute(unsafe, cmd=cmd, safe_arg='safe_arg', cmd2=cmd2)
 
diff --git a/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.expected b/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.ql b/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/flask/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/library-tests/frameworks/flask/TestTaint.expected b/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
deleted file mode 100644
index 8c3b4ea57c9d..000000000000
--- a/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
+++ /dev/null
@@ -1,98 +0,0 @@
-| taint_test.py:6 | ok   | test_taint | name |
-| taint_test.py:6 | ok   | test_taint | number |
-| taint_test.py:7 | ok   | test_taint | foo |
-| taint_test.py:14 | ok   | test_taint | request.environ |
-| taint_test.py:15 | ok   | test_taint | request.environ.get(..) |
-| taint_test.py:17 | ok   | test_taint | request.path |
-| taint_test.py:18 | ok   | test_taint | request.full_path |
-| taint_test.py:19 | ok   | test_taint | request.base_url |
-| taint_test.py:20 | ok   | test_taint | request.url |
-| taint_test.py:23 | fail | test_taint | request.accept_charsets.best |
-| taint_test.py:24 | fail | test_taint | request.accept_charsets.best_match(..) |
-| taint_test.py:25 | ok   | test_taint | request.accept_charsets[0] |
-| taint_test.py:26 | ok   | test_taint | request.accept_encodings |
-| taint_test.py:27 | ok   | test_taint | request.accept_languages |
-| taint_test.py:28 | ok   | test_taint | request.accept_mimetypes |
-| taint_test.py:31 | ok   | test_taint | request.access_control_request_headers |
-| taint_test.py:33 | ok   | test_taint | request.access_control_request_method |
-| taint_test.py:35 | ok   | test_taint | request.access_route |
-| taint_test.py:36 | ok   | test_taint | request.access_route[0] |
-| taint_test.py:39 | ok   | test_taint | request.args |
-| taint_test.py:40 | ok   | test_taint | request.args['key'] |
-| taint_test.py:41 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:44 | ok   | test_taint | request.authorization |
-| taint_test.py:45 | ok   | test_taint | request.authorization['username'] |
-| taint_test.py:46 | fail | test_taint | request.authorization.username |
-| taint_test.py:49 | ok   | test_taint | request.cache_control |
-| taint_test.py:51 | fail | test_taint | request.cache_control.max_age |
-| taint_test.py:52 | fail | test_taint | request.cache_control.max_stale |
-| taint_test.py:53 | fail | test_taint | request.cache_control.min_fresh |
-| taint_test.py:55 | ok   | test_taint | request.content_encoding |
-| taint_test.py:57 | ok   | test_taint | request.content_md5 |
-| taint_test.py:59 | ok   | test_taint | request.content_type |
-| taint_test.py:62 | ok   | test_taint | request.cookies |
-| taint_test.py:63 | ok   | test_taint | request.cookies['key'] |
-| taint_test.py:65 | ok   | test_taint | request.data |
-| taint_test.py:68 | ok   | test_taint | request.files |
-| taint_test.py:69 | ok   | test_taint | request.files['key'] |
-| taint_test.py:70 | fail | test_taint | request.files['key'].filename |
-| taint_test.py:71 | fail | test_taint | request.files['key'].stream |
-| taint_test.py:72 | ok   | test_taint | request.files.getlist(..) |
-| taint_test.py:73 | fail | test_taint | request.files.getlist(..)[0].filename |
-| taint_test.py:74 | fail | test_taint | request.files.getlist(..)[0].stream |
-| taint_test.py:77 | ok   | test_taint | request.form |
-| taint_test.py:78 | ok   | test_taint | request.form['key'] |
-| taint_test.py:79 | ok   | test_taint | request.form.getlist(..) |
-| taint_test.py:81 | ok   | test_taint | request.get_data() |
-| taint_test.py:83 | ok   | test_taint | request.get_json() |
-| taint_test.py:84 | ok   | test_taint | request.get_json()['foo'] |
-| taint_test.py:85 | ok   | test_taint | request.get_json()['foo']['bar'] |
-| taint_test.py:89 | ok   | test_taint | request.headers |
-| taint_test.py:90 | ok   | test_taint | request.headers['key'] |
-| taint_test.py:91 | fail | test_taint | request.headers.get_all(..) |
-| taint_test.py:92 | fail | test_taint | request.headers.getlist(..) |
-| taint_test.py:93 | ok   | test_taint | list(..) |
-| taint_test.py:94 | fail | test_taint | request.headers.to_wsgi_list() |
-| taint_test.py:96 | ok   | test_taint | request.json |
-| taint_test.py:97 | ok   | test_taint | request.json['foo'] |
-| taint_test.py:98 | ok   | test_taint | request.json['foo']['bar'] |
-| taint_test.py:100 | ok   | test_taint | request.method |
-| taint_test.py:102 | ok   | test_taint | request.mimetype |
-| taint_test.py:104 | ok   | test_taint | request.mimetype_params |
-| taint_test.py:106 | ok   | test_taint | request.origin |
-| taint_test.py:109 | ok   | test_taint | request.pragma |
-| taint_test.py:111 | ok   | test_taint | request.query_string |
-| taint_test.py:113 | ok   | test_taint | request.referrer |
-| taint_test.py:115 | ok   | test_taint | request.remote_addr |
-| taint_test.py:117 | ok   | test_taint | request.remote_user |
-| taint_test.py:120 | ok   | test_taint | request.stream |
-| taint_test.py:121 | ok   | test_taint | request.input_stream |
-| taint_test.py:123 | ok   | test_taint | request.url |
-| taint_test.py:125 | ok   | test_taint | request.user_agent |
-| taint_test.py:128 | ok   | test_taint | request.values |
-| taint_test.py:129 | ok   | test_taint | request.values['key'] |
-| taint_test.py:130 | ok   | test_taint | request.values.getlist(..) |
-| taint_test.py:133 | ok   | test_taint | request.view_args |
-| taint_test.py:134 | ok   | test_taint | request.view_args['key'] |
-| taint_test.py:138 | ok   | test_taint | request.script_root |
-| taint_test.py:139 | ok   | test_taint | request.url_root |
-| taint_test.py:143 | ok   | test_taint | request.charset |
-| taint_test.py:144 | ok   | test_taint | request.url_charset |
-| taint_test.py:148 | ok   | test_taint | request.date |
-| taint_test.py:151 | ok   | test_taint | request.endpoint |
-| taint_test.py:156 | ok   | test_taint | request.host |
-| taint_test.py:157 | ok   | test_taint | request.host_url |
-| taint_test.py:159 | ok   | test_taint | request.scheme |
-| taint_test.py:161 | ok   | test_taint | request.script_root |
-| taint_test.py:169 | ok   | test_taint | request.args |
-| taint_test.py:170 | ok   | test_taint | a |
-| taint_test.py:171 | ok   | test_taint | b |
-| taint_test.py:173 | ok   | test_taint | request.args['key'] |
-| taint_test.py:174 | ok   | test_taint | a['key'] |
-| taint_test.py:175 | ok   | test_taint | b['key'] |
-| taint_test.py:177 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:178 | ok   | test_taint | a.getlist(..) |
-| taint_test.py:179 | ok   | test_taint | b.getlist(..) |
-| taint_test.py:180 | ok   | test_taint | gl(..) |
-| taint_test.py:187 | ok   | test_taint | req.path |
-| taint_test.py:188 | ok   | test_taint | gd() |
diff --git a/python/ql/test/library-tests/frameworks/flask/TestTaint.ql b/python/ql/test/library-tests/frameworks/flask/TestTaint.ql
deleted file mode 100644
index 08783404ddd1..000000000000
--- a/python/ql/test/library-tests/frameworks/flask/TestTaint.ql
+++ /dev/null
@@ -1,6 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
-import semmle.python.dataflow.new.RemoteFlowSources
-
-class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-}
diff --git a/python/ql/test/library-tests/frameworks/flask/taint_test.py b/python/ql/test/library-tests/frameworks/flask/taint_test.py
index 31c0c7e6121b..74b0738fc1bb 100644
--- a/python/ql/test/library-tests/frameworks/flask/taint_test.py
+++ b/python/ql/test/library-tests/frameworks/flask/taint_test.py
@@ -3,7 +3,7 @@
 
 @app.route("/test_taint/<name>/<int:number>")  # $routeSetup="/test_taint/<name>/<int:number>"
 def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler routedParameter=name routedParameter=number
-    ensure_tainted(name, number)
+    ensure_tainted(name, number) # $ tainted
     ensure_not_tainted(foo)
 
     # Manually inspected all fields of the Request object
@@ -11,127 +11,128 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
 
     ensure_tainted(
 
-        request.environ,
-        request.environ.get('HTTP_AUTHORIZATION'),
+        request.environ, # $ tainted
+        request.environ.get('HTTP_AUTHORIZATION'), # $ tainted
 
-        request.path,
-        request.full_path,
-        request.base_url,
-        request.url,
+        request.path, # $ tainted
+        request.full_path, # $ tainted
+        request.base_url, # $ tainted
+        request.url, # $ tainted
 
         # These request.accept_* properties are instances of subclasses of werkzeug.datastructures.Accept
-        request.accept_charsets.best,
-        request.accept_charsets.best_match(["utf-8", "utf-16"]),
-        request.accept_charsets[0],
-        request.accept_encodings,
-        request.accept_languages,
-        request.accept_mimetypes,
+        request.accept_charsets.best, # $ MISSING: tainted
+        request.accept_charsets.best_match(["utf-8", "utf-16"]), # $ MISSING: tainted
+        request.accept_charsets[0], # $ tainted
+        request.accept_encodings, # $ tainted
+        request.accept_languages, # $ tainted
+        request.accept_mimetypes, # $ tainted
 
         # werkzeug.datastructures.HeaderSet (subclass of collections_abc.MutableSet)
-        request.access_control_request_headers,
+        request.access_control_request_headers, # $ tainted
 
-        request.access_control_request_method,
+        request.access_control_request_method, # $ tainted
 
-        request.access_route,
-        request.access_route[0],
+        request.access_route, # $ tainted
+        request.access_route[0], # $ tainted
 
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
-        request.args,
-        request.args['key'],
-        request.args.getlist('key'),
+        request.args, # $ tainted
+        request.args['key'], # $ tainted
+        request.args.getlist('key'), # $ tainted
 
         # werkzeug.datastructures.Authorization (a dict, with some properties)
-        request.authorization,
-        request.authorization['username'],
-        request.authorization.username,
+        request.authorization, # $ tainted
+        request.authorization['username'], # $ tainted
+        request.authorization.username, # $ MISSING: tainted
 
         # werkzeug.datastructures.RequestCacheControl
-        request.cache_control,
+        request.cache_control, # $ tainted
         # These should be `int`s, but can be strings... see debug method below
-        request.cache_control.max_age,
-        request.cache_control.max_stale,
-        request.cache_control.min_fresh,
+        request.cache_control.max_age, # $ MISSING: tainted
+        request.cache_control.max_stale, # $ MISSING: tainted
+        request.cache_control.min_fresh, # $ MISSING: tainted
 
-        request.content_encoding,
+        request.content_encoding, # $ tainted
 
-        request.content_md5,
+        request.content_md5, # $ tainted
 
-        request.content_type,
+        request.content_type, # $ tainted
 
         # werkzeug.datastructures.ImmutableTypeConversionDict (which is basically just a dict)
-        request.cookies,
-        request.cookies['key'],
+        request.cookies, # $ tainted
+        request.cookies['key'], # $ tainted
 
-        request.data,
+        request.data, # $ tainted
 
         # a werkzeug.datastructures.MultiDict, mapping [str, werkzeug.datastructures.FileStorage]
-        request.files,
-        request.files['key'],
-        request.files['key'].filename,
-        request.files['key'].stream,
-        request.files.getlist('key'),
-        request.files.getlist('key')[0].filename,
-        request.files.getlist('key')[0].stream,
+        request.files, # $ tainted
+        request.files['key'], # $ tainted
+        request.files['key'].filename, # $ MISSING: tainted
+        request.files['key'].stream, # $ MISSING: tainted
+        request.files.getlist('key'), # $ tainted
+        request.files.getlist('key')[0].filename, # $ MISSING: tainted
+        request.files.getlist('key')[0].stream, # $ MISSING: tainted
 
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
-        request.form,
-        request.form['key'],
-        request.form.getlist('key'),
+        request.form, # $ tainted
+        request.form['key'], # $ tainted
+        request.form.getlist('key'), # $ tainted
 
-        request.get_data(),
+        request.get_data(), # $ tainted
 
-        request.get_json(),
-        request.get_json()['foo'],
-        request.get_json()['foo']['bar'],
+        request.get_json(), # $ tainted
+        request.get_json()['foo'], # $ tainted
+        request.get_json()['foo']['bar'], # $ tainted
 
         # werkzeug.datastructures.EnvironHeaders,
         # which has same interface as werkzeug.datastructures.Headers
-        request.headers,
-        request.headers['key'],
-        request.headers.get_all('key'),
-        request.headers.getlist('key'),
-        list(request.headers), # (k, v) list
-        request.headers.to_wsgi_list(), # (k, v) list
+        request.headers, # $ tainted
+        request.headers['key'], # $ tainted
+        request.headers.get_all('key'), # $ MISSING: tainted
+        request.headers.getlist('key'), # $ MISSING: tainted
+        # two ways to get (k, v) lists
+        list(request.headers), # $ tainted
+        request.headers.to_wsgi_list(), # $ MISSING: tainted
 
-        request.json,
-        request.json['foo'],
-        request.json['foo']['bar'],
+        request.json, # $ tainted
+        request.json['foo'], # $ tainted
+        request.json['foo']['bar'], # $ tainted
 
-        request.method,
+        request.method, # $ tainted
 
-        request.mimetype,
+        request.mimetype, # $ tainted
 
-        request.mimetype_params,
+        request.mimetype_params, # $ tainted
 
-        request.origin,
+        request.origin, # $ tainted
 
         # werkzeug.datastructures.HeaderSet (subclass of collections_abc.MutableSet)
-        request.pragma,
+        request.pragma, # $ tainted
 
-        request.query_string,
+        request.query_string, # $ tainted
 
-        request.referrer,
+        request.referrer, # $ tainted
 
-        request.remote_addr,
+        request.remote_addr, # $ tainted
 
-        request.remote_user,
+        request.remote_user, # $ tainted
 
         # file-like object
-        request.stream,
-        request.input_stream,
+        request.stream, # $ tainted
+        request.input_stream, # $ tainted
 
-        request.url,
+        request.url, # $ tainted
 
-        request.user_agent,
+        request.user_agent, # $ tainted
 
         # werkzeug.datastructures.CombinedMultiDict, which is basically just a werkzeug.datastructures.MultiDict
-        request.values,
-        request.values['key'],
-        request.values.getlist('key'),
+        request.values, # $ tainted
+        request.values['key'], # $ tainted
+        request.values.getlist('key'), # $ tainted
 
         # dict
-        request.view_args,
-        request.view_args['key'],
+        request.view_args, # $ tainted
+        request.view_args['key'], # $ tainted
     )
 
     ensure_not_tainted(
@@ -166,26 +167,26 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
     b = a
     gl = b.getlist
     ensure_tainted(
-        request.args,
-        a,
-        b,
-
-        request.args['key'],
-        a['key'],
-        b['key'],
-
-        request.args.getlist('key'),
-        a.getlist('key'),
-        b.getlist('key'),
-        gl('key'),
+        request.args, # $ tainted
+        a, # $ tainted
+        b, # $ tainted
+
+        request.args['key'], # $ tainted
+        a['key'], # $ tainted
+        b['key'], # $ tainted
+
+        request.args.getlist('key'), # $ tainted
+        a.getlist('key'), # $ tainted
+        b.getlist('key'), # $ tainted
+        gl('key'), # $ tainted
     )
 
     # aliasing tests
     req = request
     gd = request.get_data
     ensure_tainted(
-        req.path,
-        gd(),
+        req.path, # $ tainted
+        gd(), # $ tainted
     )
 
 
diff --git a/python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py b/python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py
index 0e996e001dc6..771978cb1c89 100644
--- a/python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py
+++ b/python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py
@@ -32,8 +32,8 @@ def test_additional_taint():
     cmd3 = builtins.compile(src, "<filename>", "exec")
 
     ensure_tainted(
-        src,
-        cmd1,
-        cmd2,
-        cmd3,
+        src, # $ tainted
+        cmd1, # $ tainted
+        cmd2, # $ tainted
+        cmd3, # $ tainted
     )
diff --git a/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.expected b/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.ql b/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/stdlib/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected b/python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected
deleted file mode 100644
index 6fa636753174..000000000000
--- a/python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected
+++ /dev/null
@@ -1,37 +0,0 @@
-| CodeExecution.py:35 | ok   | test_additional_taint | src |
-| CodeExecution.py:36 | ok   | test_additional_taint | cmd1 |
-| CodeExecution.py:37 | ok   | test_additional_taint | cmd2 |
-| CodeExecution.py:38 | ok   | test_additional_taint | cmd3 |
-| http_server.py:22 | ok   | test_cgi_FieldStorage_taint | form |
-| http_server.py:24 | ok   | test_cgi_FieldStorage_taint | form['key'] |
-| http_server.py:25 | ok   | test_cgi_FieldStorage_taint | form['key'].value |
-| http_server.py:26 | ok   | test_cgi_FieldStorage_taint | form['key'].file |
-| http_server.py:27 | ok   | test_cgi_FieldStorage_taint | form['key'].filename |
-| http_server.py:28 | ok   | test_cgi_FieldStorage_taint | form['key'][0] |
-| http_server.py:29 | ok   | test_cgi_FieldStorage_taint | form['key'][0].value |
-| http_server.py:30 | ok   | test_cgi_FieldStorage_taint | form['key'][0].file |
-| http_server.py:31 | ok   | test_cgi_FieldStorage_taint | form['key'][0].filename |
-| http_server.py:32 | fail | test_cgi_FieldStorage_taint | ListComp |
-| http_server.py:34 | ok   | test_cgi_FieldStorage_taint | form.getvalue(..) |
-| http_server.py:35 | ok   | test_cgi_FieldStorage_taint | form.getvalue(..)[0] |
-| http_server.py:37 | ok   | test_cgi_FieldStorage_taint | form.getfirst(..) |
-| http_server.py:39 | ok   | test_cgi_FieldStorage_taint | form.getlist(..) |
-| http_server.py:40 | ok   | test_cgi_FieldStorage_taint | form.getlist(..)[0] |
-| http_server.py:41 | fail | test_cgi_FieldStorage_taint | ListComp |
-| http_server.py:50 | ok   | taint_sources | self |
-| http_server.py:52 | ok   | taint_sources | self.requestline |
-| http_server.py:54 | ok   | taint_sources | self.path |
-| http_server.py:56 | ok   | taint_sources | self.headers |
-| http_server.py:57 | ok   | taint_sources | self.headers['Foo'] |
-| http_server.py:58 | ok   | taint_sources | self.headers.get(..) |
-| http_server.py:59 | fail | taint_sources | self.headers.get_all(..) |
-| http_server.py:60 | fail | taint_sources | self.headers.keys() |
-| http_server.py:61 | ok   | taint_sources | self.headers.values() |
-| http_server.py:62 | ok   | taint_sources | self.headers.items() |
-| http_server.py:63 | fail | taint_sources | self.headers.as_bytes() |
-| http_server.py:64 | fail | taint_sources | self.headers.as_string() |
-| http_server.py:65 | ok   | taint_sources | str(..) |
-| http_server.py:66 | ok   | taint_sources | bytes(..) |
-| http_server.py:68 | ok   | taint_sources | self.rfile |
-| http_server.py:69 | fail | taint_sources | self.rfile.read() |
-| http_server.py:78 | ok   | taint_sources | form |
diff --git a/python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql b/python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql
deleted file mode 100644
index 37faa83aa2d2..000000000000
--- a/python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql
+++ /dev/null
@@ -1,9 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
-import semmle.python.dataflow.new.RemoteFlowSources
-
-class WithRemoteFlowSources extends TestTaintTrackingConfiguration {
-  override predicate isSource(DataFlow::Node source) {
-    super.isSource(source) or
-    source instanceof RemoteFlowSource
-  }
-}
diff --git a/python/ql/test/library-tests/frameworks/stdlib/http_server.py b/python/ql/test/library-tests/frameworks/stdlib/http_server.py
index 8d996acb41d0..f91bf8fb9570 100644
--- a/python/ql/test/library-tests/frameworks/stdlib/http_server.py
+++ b/python/ql/test/library-tests/frameworks/stdlib/http_server.py
@@ -19,26 +19,28 @@ def test_cgi_FieldStorage_taint():
     form = cgi.FieldStorage()
 
     ensure_tainted(
-        form,
-
-        form['key'], # will be a list, if multiple fields named "key" are provided
-        form['key'].value,
-        form['key'].file,
-        form['key'].filename,
-        form['key'][0],
-        form['key'][0].value,
-        form['key'][0].file,
-        form['key'][0].filename,
-        [field.value for field in form['key']],
-
-        form.getvalue('key'), # will be a list, if multiple fields named "key" are provided
-        form.getvalue('key')[0],
-
-        form.getfirst('key'),
-
-        form.getlist('key'),
-        form.getlist('key')[0],
-        [field.value for field in form.getlist('key')],
+        form, # $ tainted
+
+        # `form['key']` will be a list, if multiple fields named "key" are provided
+        form['key'], # $ tainted
+        form['key'].value, # $ tainted
+        form['key'].file, # $ tainted
+        form['key'].filename, # $ tainted
+        form['key'][0], # $ tainted
+        form['key'][0].value, # $ tainted
+        form['key'][0].file, # $ tainted
+        form['key'][0].filename, # $ tainted
+        [field.value for field in form['key']], # $ MISSING: tainted
+
+        # `form.getvalue('key')` will be a list, if multiple fields named "key" are provided
+        form.getvalue('key'), # $ tainted
+        form.getvalue('key')[0], # $ tainted
+
+        form.getfirst('key'), # $ tainted
+
+        form.getlist('key'), # $ tainted
+        form.getlist('key')[0], # $ tainted
+        [field.value for field in form.getlist('key')], # $ MISSING: tainted
     )
 
 
@@ -47,26 +49,26 @@ class MyHandler(BaseHTTPRequestHandler):
     def taint_sources(self):
 
         ensure_tainted(
-            self,
-
-            self.requestline,
-
-            self.path,
-
-            self.headers,
-            self.headers['Foo'],
-            self.headers.get('Foo'),
-            self.headers.get_all('Foo'),
-            self.headers.keys(),
-            self.headers.values(),
-            self.headers.items(),
-            self.headers.as_bytes(),
-            self.headers.as_string(),
-            str(self.headers),
-            bytes(self.headers),
-
-            self.rfile,
-            self.rfile.read(),
+            self, # $ tainted
+
+            self.requestline, # $ tainted
+
+            self.path, # $ tainted
+
+            self.headers, # $ tainted
+            self.headers['Foo'], # $ tainted
+            self.headers.get('Foo'), # $ tainted
+            self.headers.get_all('Foo'), # $ MISSING: tainted
+            self.headers.keys(), # $ MISSING: tainted
+            self.headers.values(), # $ tainted
+            self.headers.items(), # $ tainted
+            self.headers.as_bytes(), # $ MISSING: tainted
+            self.headers.as_string(), # $ MISSING: tainted
+            str(self.headers), # $ tainted
+            bytes(self.headers), # $ tainted
+
+            self.rfile, # $ tainted
+            self.rfile.read(), # $ MISSING: tainted
         )
 
         form = cgi.FieldStorage(
@@ -75,7 +77,7 @@ def taint_sources(self):
             environ={'REQUEST_METHOD': 'POST', 'CONTENT_TYPE': self.headers.get('content-type')},
         )
 
-        ensure_tainted(form)
+        ensure_tainted(form) # $ tainted
 
 
     def do_GET(self): # $ requestHandler
diff --git a/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.expected b/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.expected
new file mode 100644
index 000000000000..79d760d87f42
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.expected
@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures
diff --git a/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.ql b/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.ql
new file mode 100644
index 000000000000..027ad8667be6
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/tornado/InlineTaintTest.ql
@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest
diff --git a/python/ql/test/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/library-tests/frameworks/tornado/TestTaint.expected
deleted file mode 100644
index 2952218d16ff..000000000000
--- a/python/ql/test/library-tests/frameworks/tornado/TestTaint.expected
+++ /dev/null
@@ -1,41 +0,0 @@
-| taint_test.py:6 | ok   | get | name |
-| taint_test.py:6 | ok   | get | number |
-| taint_test.py:7 | ok   | get | foo |
-| taint_test.py:11 | ok   | get | self.get_argument(..) |
-| taint_test.py:12 | ok   | get | self.get_arguments(..) |
-| taint_test.py:13 | ok   | get | self.get_arguments(..)[0] |
-| taint_test.py:15 | ok   | get | self.get_body_argument(..) |
-| taint_test.py:16 | ok   | get | self.get_body_arguments(..) |
-| taint_test.py:17 | ok   | get | self.get_body_arguments(..)[0] |
-| taint_test.py:19 | ok   | get | self.get_query_argument(..) |
-| taint_test.py:20 | ok   | get | self.get_query_arguments(..) |
-| taint_test.py:21 | ok   | get | self.get_query_arguments(..)[0] |
-| taint_test.py:23 | ok   | get | self.path_args |
-| taint_test.py:24 | ok   | get | self.path_args[0] |
-| taint_test.py:26 | ok   | get | self.path_kwargs |
-| taint_test.py:27 | ok   | get | self.path_kwargs["name"] |
-| taint_test.py:34 | ok   | get | request |
-| taint_test.py:40 | ok   | get | request.uri |
-| taint_test.py:41 | ok   | get | request.path |
-| taint_test.py:42 | ok   | get | request.query |
-| taint_test.py:43 | ok   | get | request.full_url() |
-| taint_test.py:45 | ok   | get | request.remote_ip |
-| taint_test.py:47 | ok   | get | request.body |
-| taint_test.py:49 | ok   | get | request.arguments |
-| taint_test.py:50 | ok   | get | request.arguments["name"] |
-| taint_test.py:51 | ok   | get | request.arguments["name"][0] |
-| taint_test.py:53 | ok   | get | request.query_arguments |
-| taint_test.py:54 | ok   | get | request.query_arguments["name"] |
-| taint_test.py:55 | ok   | get | request.query_arguments["name"][0] |
-| taint_test.py:57 | ok   | get | request.body_arguments |
-| taint_test.py:58 | ok   | get | request.body_arguments["name"] |
-| taint_test.py:59 | ok   | get | request.body_arguments["name"][0] |
-| taint_test.py:62 | ok   | get | request.headers |
-| taint_test.py:63 | ok   | get | request.headers["header-name"] |
-| taint_test.py:64 | fail | get | request.headers.get_list(..) |
-| taint_test.py:65 | fail | get | request.headers.get_all() |
-| taint_test.py:66 | fail | get | ListComp |
-| taint_test.py:69 | ok   | get | request.cookies |
-| taint_test.py:70 | ok   | get | request.cookies["cookie-name"] |
-| taint_test.py:71 | fail | get | request.cookies["cookie-name"].key |
-| taint_test.py:72 | fail | get | request.cookies["cookie-name"].value |
diff --git a/python/ql/test/library-tests/frameworks/tornado/TestTaint.ql b/python/ql/test/library-tests/frameworks/tornado/TestTaint.ql
deleted file mode 100644
index 08783404ddd1..000000000000
--- a/python/ql/test/library-tests/frameworks/tornado/TestTaint.ql
+++ /dev/null
@@ -1,6 +0,0 @@
-import experimental.dataflow.tainttracking.TestTaintLib
-import semmle.python.dataflow.new.RemoteFlowSources
-
-class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-}
diff --git a/python/ql/test/library-tests/frameworks/tornado/taint_test.py b/python/ql/test/library-tests/frameworks/tornado/taint_test.py
index e3297a1d2f95..1153b6d92bca 100644
--- a/python/ql/test/library-tests/frameworks/tornado/taint_test.py
+++ b/python/ql/test/library-tests/frameworks/tornado/taint_test.py
@@ -3,73 +3,73 @@
 
 class TaintTest(tornado.web.RequestHandler):
     def get(self, name = "World!", number="0", foo="foo"):  # $ requestHandler routedParameter=name routedParameter=number
-        ensure_tainted(name, number)
+        ensure_tainted(name, number) # $ tainted
         ensure_not_tainted(foo)
 
         ensure_tainted(
             # see https://www.tornadoweb.org/en/stable/web.html#input
-            self.get_argument("name"),
-            self.get_arguments("name"),
-            self.get_arguments("name")[0],
+            self.get_argument("name"), # $ tainted
+            self.get_arguments("name"), # $ tainted
+            self.get_arguments("name")[0], # $ tainted
 
-            self.get_body_argument("name"),
-            self.get_body_arguments("name"),
-            self.get_body_arguments("name")[0],
+            self.get_body_argument("name"), # $ tainted
+            self.get_body_arguments("name"), # $ tainted
+            self.get_body_arguments("name")[0], # $ tainted
 
-            self.get_query_argument("name"),
-            self.get_query_arguments("name"),
-            self.get_query_arguments("name")[0],
+            self.get_query_argument("name"), # $ tainted
+            self.get_query_arguments("name"), # $ tainted
+            self.get_query_arguments("name")[0], # $ tainted
 
-            self.path_args,
-            self.path_args[0],
+            self.path_args, # $ tainted
+            self.path_args[0], # $ tainted
 
-            self.path_kwargs,
-            self.path_kwargs["name"],
+            self.path_kwargs, # $ tainted
+            self.path_kwargs["name"], # $ tainted
         )
 
         request = self.request
 
         ensure_tainted(
             # see https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPServerRequest
-            request,
+            request, # $ tainted
 
             # For the URL https:://example.com/foo/bar?baz=42
             # request.uri="/foo/bar?baz=42"
             # request.path="/foo/bar"
             # request.query="baz=42"
-            request.uri,
-            request.path,
-            request.query,
-            request.full_url(),
+            request.uri, # $ tainted
+            request.path, # $ tainted
+            request.query, # $ tainted
+            request.full_url(), # $ tainted
 
-            request.remote_ip,
+            request.remote_ip, # $ tainted
 
-            request.body,
+            request.body, # $ tainted
 
-            request.arguments,
-            request.arguments["name"],
-            request.arguments["name"][0],
+            request.arguments, # $ tainted
+            request.arguments["name"], # $ tainted
+            request.arguments["name"][0], # $ tainted
 
-            request.query_arguments,
-            request.query_arguments["name"],
-            request.query_arguments["name"][0],
+            request.query_arguments, # $ tainted
+            request.query_arguments["name"], # $ tainted
+            request.query_arguments["name"][0], # $ tainted
 
-            request.body_arguments,
-            request.body_arguments["name"],
-            request.body_arguments["name"][0],
+            request.body_arguments, # $ tainted
+            request.body_arguments["name"], # $ tainted
+            request.body_arguments["name"][0], # $ tainted
 
             # dict-like, see https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPHeaders
-            request.headers,
-            request.headers["header-name"],
-            request.headers.get_list("header-name"),
-            request.headers.get_all(),
-            [(k, v) for (k, v) in request.headers.get_all()],
+            request.headers, # $ tainted
+            request.headers["header-name"], # $ tainted
+            request.headers.get_list("header-name"), # $ MISSING: tainted
+            request.headers.get_all(), # $ MISSING: tainted
+            [(k, v) for (k, v) in request.headers.get_all()], # $ MISSING: tainted
 
             # Dict[str, http.cookies.Morsel]
-            request.cookies,
-            request.cookies["cookie-name"],
-            request.cookies["cookie-name"].key,
-            request.cookies["cookie-name"].value,
+            request.cookies, # $ tainted
+            request.cookies["cookie-name"], # $ tainted
+            request.cookies["cookie-name"].key, # $ MISSING: tainted
+            request.cookies["cookie-name"].value, # $ MISSING: tainted
         )
 
 

From 5d827b6fc80e378dc3f6cbf6195999ae0cb527ef Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Thu, 15 Apr 2021 09:31:42 -0700
Subject: [PATCH 288/433] Actions: Change staleness calculation

Calculate staleness on issues that have the
`Stale` label. Leave all other issues untouched.
---
 .github/workflows/close-stale.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/close-stale.yml b/.github/workflows/close-stale.yml
index 746a13317b22..c63a6be690c2 100644
--- a/.github/workflows/close-stale.yml
+++ b/.github/workflows/close-stale.yml
@@ -15,16 +15,16 @@ jobs:
     - uses: actions/stale@v3
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `stale` label in order to avoid having this issue closed in 7 days.'
+        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
         close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
         days-before-stale: 14
         days-before-close: 7
-        only-labels: question
-        
+        only-labels: awaiting-response
+
         # do not mark PRs as stale
         days-before-pr-stale: -1
         days-before-pr-close: -1
-        
+
         # Uncomment for dry-run
         # debug-only: true
         # operations-per-run: 1000

From c9c8259ed0adf666cc4906e90bd73c2297bc9102 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Thu, 15 Apr 2021 17:56:14 +0000
Subject: [PATCH 289/433] Python: Disallow `PostUpdateNode` as
 `LocalSourceNode`

Previously, in cases like

```python
def foo(x):
    x.bar()
    x.baz()
    x.quux()
```

we would have flow from the first `x` to each use _and_ flow from the
post-update node for each method call to each subsequent use, and all
of these would be `LocalSourceNode`s. For large functions with the above
pattern, this would lead to a quadratic blowup in `hasLocalSource`.

With this commit, only the first of these will count as a
`LocalSourceNode`, and the blowup disappears.
---
 .../src/semmle/python/dataflow/new/internal/LocalSources.qll   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index 26e04aaaefb4..2bd822c298c4 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -26,7 +26,8 @@ class LocalSourceNode extends Node {
   cached
   LocalSourceNode() {
     not comes_from_cfgnode(this) and
-    not this instanceof ModuleVariableNode
+    not this instanceof ModuleVariableNode and
+    not this instanceof PostUpdateNode
     or
     this = any(ModuleVariableNode mvn).getARead()
   }

From 451d36dc97ba24c057c0584dfb783c8ab5635e6e Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Thu, 15 Apr 2021 21:26:12 +0000
Subject: [PATCH 290/433] Python: Allow _some_ `PostUpdateNode`s

Specifically, allow the ones arising from calls, but not reads or
writes. This should fix the tests.
---
 .../src/semmle/python/dataflow/new/internal/LocalSources.qll  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index 2bd822c298c4..ae7d3fabb7fd 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -27,7 +27,9 @@ class LocalSourceNode extends Node {
   LocalSourceNode() {
     not comes_from_cfgnode(this) and
     not this instanceof ModuleVariableNode and
-    not this instanceof PostUpdateNode
+    not this.(PostUpdateNode).getPreUpdateNode() in [
+        syntheticPostUpdateNode::storePreUpdateNode(), syntheticPostUpdateNode::readPreUpdateNode()
+      ]
     or
     this = any(ModuleVariableNode mvn).getARead()
   }

From b0975bb3ea6e514704205bb538eb5f9fe63cbcae Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 16 Apr 2021 09:15:43 +0200
Subject: [PATCH 291/433] Update supported C#/.NET versions

---
 docs/codeql/support/reusables/versions-compilers.rst | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/docs/codeql/support/reusables/versions-compilers.rst b/docs/codeql/support/reusables/versions-compilers.rst
index a338791953b1..ff49b01a4412 100644
--- a/docs/codeql/support/reusables/versions-compilers.rst
+++ b/docs/codeql/support/reusables/versions-compilers.rst
@@ -11,9 +11,11 @@
    Microsoft extensions (up to VS 2019),
 
    Arm Compiler 5 [2]_","``.cpp``, ``.c++``, ``.cxx``, ``.hpp``, ``.hh``, ``.h++``, ``.hxx``, ``.c``, ``.cc``, ``.h``"
-   C#,C# up to 8.0,"Microsoft Visual Studio up to 2019 with .NET up to 4.8,
+   C#,C# up to 9.0,"Microsoft Visual Studio up to 2019 with .NET up to 4.8,
 
-   .NET Core up to 3.1","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
+   .NET Core up to 3.1
+
+   .NET 5","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
    Go (aka Golang), "Go up to 1.16", "Go 1.11 or more recent", ``.go``
    Java,"Java 7 to 15 [3]_","javac (OpenJDK and Oracle JDK),
 
@@ -28,5 +30,5 @@
     .. [2] Support for the Arm Compiler (armcc) is preliminary.
     .. [3] Builds that execute on Java 7 to 15 can be analyzed. The analysis understands Java 15 standard language features.
     .. [4] ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
-    .. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files. 
-    .. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.   
+    .. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
+    .. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.

From 946fcf1c82e5314f2da7e86420b2eefee8786f9d Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Wed, 14 Apr 2021 15:17:34 +0200
Subject: [PATCH 292/433] C#: Speedup
 `DispatchMethodOrAccessorCall::getAViableOverrider()`

In addition to improved performance, the analysis no longer applies a closed-world
assumption to type parameters. That is, if the type of a receiver is a type parameter,
then the call may target any method of a compatible receiver type, not just the
types that actually instantiate the type parameter.
---
 .../semmle/code/csharp/dispatch/Dispatch.qll  | 185 +++++++++++-------
 1 file changed, 110 insertions(+), 75 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
index e436fb2b99af..cca858d69baf 100644
--- a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
+++ b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
@@ -233,71 +233,61 @@ private module Internal {
   }
 
   pragma[noinline]
-  private predicate hasOverrider(OverridableCallable oc, ValueOrRefType t) {
-    exists(oc.getAnOverrider(t))
+  private predicate hasOverrider(OverridableCallable oc, Gvn::GvnType t) {
+    exists(oc.getAnOverrider(any(ValueOrRefType t0 | Gvn::getGlobalValueNumber(t0) = t)))
   }
 
   pragma[noinline]
-  private predicate hasCallable(OverridableCallable source, ValueOrRefType t, OverridableCallable c) {
+  private predicate hasCallable(OverridableCallable source, Gvn::GvnType t, OverridableCallable c) {
     c.getUnboundDeclaration() = source and
-    t.hasCallable(c) and
+    any(ValueOrRefType t0 | Gvn::getGlobalValueNumber(t0) = t).hasCallable(c) and
     hasOverrider(c, t) and
-    hasQualifierTypeOverridden0(t, _) and
-    hasQualifierTypeOverridden1(source, _)
+    source = any(DispatchMethodOrAccessorCall call).getAStaticTargetExt()
   }
 
-  pragma[noinline]
-  private Unification::ConstrainedTypeParameter getAConstrainedTypeParameterQualifierType(
-    DispatchMethodOrAccessorCall call
-  ) {
-    result = getAPossibleType(call.getQualifier(), false)
-  }
+  abstract private class DispatchMethodOrAccessorCall extends DispatchCallImpl {
+    pragma[noinline]
+    OverridableCallable getAStaticTargetExt() {
+      exists(OverridableCallable target | this.getAStaticTarget() = target |
+        result = target.getUnboundDeclaration()
+        or
+        result = target.getAnUltimateImplementor().getUnboundDeclaration()
+      )
+    }
 
-  pragma[noinline]
-  private predicate constrainedTypeParameterQualifierTypeSubsumes(
-    ValueOrRefType t, Unification::ConstrainedTypeParameter tp
-  ) {
-    tp = getAConstrainedTypeParameterQualifierType(_) and
-    tp.subsumes(t)
-  }
+    pragma[nomagic]
+    predicate hasQualifierTypeInherited(Type t) { t = getAPossibleType(this.getQualifier(), _) }
 
-  pragma[noinline]
-  private predicate hasQualifierTypeOverridden0(ValueOrRefType t, DispatchMethodOrAccessorCall call) {
-    hasOverrider(_, t) and
-    (
-      exists(Type t0, Type t1 |
-        t0 = getAPossibleType(call.getQualifier(), false) and
-        t1 = [t0, t0.(Unification::UnconstrainedTypeParameter).getAnUltimatelySuppliedType()]
+    pragma[noinline]
+    private predicate hasSubsumedQualifierType(Gvn::GvnType t) {
+      hasOverrider(_, t) and
+      exists(Type t0 |
+        t0 = getAPossibleType(this.getQualifier(), false) and
+        not t0 instanceof TypeParameter
       |
-        t = t1
+        t = Gvn::getGlobalValueNumber(t0)
         or
-        Unification::subsumes(t1, t)
+        Gvn::subsumes(Gvn::getGlobalValueNumber(t0), t)
       )
-      or
-      constrainedTypeParameterQualifierTypeSubsumes(t,
-        getAConstrainedTypeParameterQualifierType(call))
-    )
-  }
+    }
 
-  pragma[noinline]
-  private predicate hasQualifierTypeOverridden1(
-    OverridableCallable c, DispatchMethodOrAccessorCall call
-  ) {
-    exists(OverridableCallable target | call.getAStaticTarget() = target |
-      c = target.getUnboundDeclaration()
-      or
-      c = target.getAnUltimateImplementor().getUnboundDeclaration()
-    )
-  }
+    pragma[noinline]
+    private predicate hasConstrainedTypeParameterQualifierType(
+      Unification::ConstrainedTypeParameter tp
+    ) {
+      tp = getAPossibleType(this.getQualifier(), false)
+    }
 
-  abstract private class DispatchMethodOrAccessorCall extends DispatchCallImpl {
-    pragma[nomagic]
-    predicate hasQualifierTypeInherited(Type t) { t = getAPossibleType(this.getQualifier(), _) }
+    pragma[noinline]
+    private predicate hasUnconstrainedTypeParameterQualifierType() {
+      getAPossibleType(this.getQualifier(), false) instanceof
+        Unification::UnconstrainedTypeParameter
+    }
 
     pragma[nomagic]
-    predicate hasQualifierTypeOverridden(ValueOrRefType t, OverridableCallable c) {
-      hasQualifierTypeOverridden0(t, this) and
-      hasCallable(any(OverridableCallable oc | hasQualifierTypeOverridden1(oc, this)), t, c)
+    predicate hasSubsumedQualifierTypeOverridden(Gvn::GvnType t, OverridableCallable c) {
+      this.hasSubsumedQualifierType(t) and
+      hasCallable(any(OverridableCallable oc | oc = this.getAStaticTargetExt()), t, c)
     }
 
     /**
@@ -357,12 +347,33 @@ private module Internal {
     }
 
     pragma[nomagic]
-    private Callable getASubsumedStaticTarget0(Type t) {
+    private predicate contextArgHasConstrainedTypeParameterType(
+      DispatchCall ctx, Unification::ConstrainedTypeParameter tp
+    ) {
+      this.contextArgHasType(ctx, tp, false)
+    }
+
+    pragma[nomagic]
+    private predicate contextArgHasUnconstrainedTypeParameterType(DispatchCall ctx) {
+      this.contextArgHasType(ctx, any(Unification::UnconstrainedTypeParameter t), false)
+    }
+
+    pragma[nomagic]
+    private predicate contextArgHasNonTypeParameterType(DispatchCall ctx, Gvn::GvnType t) {
+      exists(Type t0 |
+        this.contextArgHasType(ctx, t0, false) and
+        not t0 instanceof TypeParameter and
+        t = Gvn::getGlobalValueNumber(t0)
+      )
+    }
+
+    pragma[nomagic]
+    private Callable getASubsumedStaticTarget0(Gvn::GvnType t) {
       exists(Callable staticTarget, Type declType |
         staticTarget = this.getAStaticTarget() and
         declType = staticTarget.getDeclaringType() and
         result = staticTarget.getUnboundDeclaration() and
-        Unification::subsumes(declType, t)
+        Gvn::subsumes(Gvn::getGlobalValueNumber(declType), t)
       )
     }
 
@@ -375,7 +386,8 @@ private module Internal {
     private Callable getASubsumedStaticTarget() {
       result = this.getAStaticTarget()
       or
-      result.getUnboundDeclaration() = this.getASubsumedStaticTarget0(result.getDeclaringType())
+      result.getUnboundDeclaration() =
+        this.getASubsumedStaticTarget0(Gvn::getGlobalValueNumber(result.getDeclaringType()))
     }
 
     /**
@@ -426,6 +438,12 @@ private module Internal {
       )
     }
 
+    pragma[noinline]
+    NonConstructedOverridableCallable getAViableOverrider0() {
+      getAPossibleType(this.getQualifier(), false) instanceof TypeParameter and
+      result.getAConstructingCallableOrSelf() = this.getAStaticTargetExt()
+    }
+
     /**
      * Gets a callable that is defined in a subtype of the qualifier type of this
      * call, and which overrides a static target of this call.
@@ -468,9 +486,22 @@ private module Internal {
      */
     private RuntimeCallable getAViableOverrider() {
       exists(ValueOrRefType t, NonConstructedOverridableCallable c |
-        this.hasQualifierTypeOverridden(t, c.getAConstructingCallableOrSelf()) and
+        this.hasSubsumedQualifierTypeOverridden(Gvn::getGlobalValueNumber(t),
+          c.getAConstructingCallableOrSelf()) and
         result = c.getAnOverrider(t)
       )
+      or
+      exists(NonConstructedOverridableCallable c |
+        c = this.getAViableOverrider0() and
+        result = c.getAnOverrider(_)
+      |
+        this.hasUnconstrainedTypeParameterQualifierType()
+        or
+        exists(Unification::ConstrainedTypeParameter tp |
+          this.hasConstrainedTypeParameterQualifierType(tp) and
+          tp.subsumes(result.getDeclaringType())
+        )
+      )
     }
 
     override RuntimeCallable getADynamicTarget() {
@@ -510,36 +541,40 @@ private module Internal {
     }
 
     pragma[nomagic]
-    private RuntimeCallable getAViableOverriderInCallContext0(
-      NonConstructedOverridableCallable c, ValueOrRefType t
-    ) {
-      result = this.getAViableOverrider() and
-      this.contextArgHasType(_, _, false) and
-      result = c.getAnOverrider(t)
+    private RuntimeCallable getAViableOverriderInCallContext0(Gvn::GvnType t) {
+      exists(NonConstructedOverridableCallable c |
+        result = this.getAViableOverrider() and
+        this.contextArgHasType(_, _, false) and
+        result = c.getAnOverrider(any(Type t0 | t = Gvn::getGlobalValueNumber(t0))) and
+        this.getAStaticTarget() = c.getAConstructingCallableOrSelf()
+      )
     }
 
     pragma[nomagic]
-    private RuntimeCallable getAViableOverriderInCallContext1(
-      NonConstructedOverridableCallable c, DispatchCall ctx
-    ) {
-      exists(ValueOrRefType t |
-        result = this.getAViableOverriderInCallContext0(c, t) and
-        exists(Type t0, Type t1 |
-          this.contextArgHasType(ctx, t0, false) and
-          t1 = [t0, t0.(Unification::UnconstrainedTypeParameter).getAnUltimatelySuppliedType()]
-        |
-          t = t1
-          or
-          Unification::subsumes(t1, t)
-        )
+    private predicate contextArgHasSubsumedType(DispatchCall ctx, Gvn::GvnType t) {
+      hasOverrider(_, t) and
+      exists(Gvn::GvnType t0 | this.contextArgHasNonTypeParameterType(ctx, t0) |
+        t = t0
+        or
+        Gvn::subsumes(t0, t)
       )
     }
 
     pragma[nomagic]
     private RuntimeCallable getAViableOverriderInCallContext(DispatchCall ctx) {
-      exists(NonConstructedOverridableCallable c |
-        result = this.getAViableOverriderInCallContext1(c, ctx) and
-        this.getAStaticTarget() = c.getAConstructingCallableOrSelf()
+      exists(Gvn::GvnType t |
+        result = this.getAViableOverriderInCallContext0(t) and
+        this.contextArgHasSubsumedType(ctx, t)
+      )
+      or
+      result = this.getAViableOverrider() and
+      (
+        this.contextArgHasUnconstrainedTypeParameterType(ctx)
+        or
+        exists(Unification::ConstrainedTypeParameter tp |
+          this.contextArgHasConstrainedTypeParameterType(ctx, tp) and
+          tp.subsumes(result.getDeclaringType())
+        )
       )
     }
 

From af0c32c01d630f607d4a737b2f3e8b89faf371f3 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Fri, 16 Apr 2021 11:35:12 +0200
Subject: [PATCH 293/433] Python: Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/semmle/python/frameworks/Fabric.qll | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Fabric.qll b/python/ql/src/semmle/python/frameworks/Fabric.qll
index 177f5592f665..2319b9e1d709 100644
--- a/python/ql/src/semmle/python/frameworks/Fabric.qll
+++ b/python/ql/src/semmle/python/frameworks/Fabric.qll
@@ -83,7 +83,9 @@ private module FabricV2 {
       module Connection {
         /** Gets a reference to the `fabric.connection.Connection` class. */
         API::Node classRef() {
-          result in [fabric().getMember("Connection"), connection().getMember("Connection")]
+          result = fabric().getMember("Connection")
+          or
+          result = connection().getMember("Connection")
         }
 
         /**
@@ -110,7 +112,7 @@ private module FabricV2 {
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        DataFlow::LocalSourceNode instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /**
          * Gets a reference to either `run`, `sudo`, or `local` method on a
@@ -249,7 +251,9 @@ private module FabricV2 {
       module SerialGroup {
         private class ClassInstantiation extends Group::ModeledSubclass {
           ClassInstantiation() {
-            this in [group().getMember("SerialGroup"), fabric().getMember("SerialGroup")]
+            this = group().getMember("SerialGroup")
+            or
+            this = fabric().getMember("SerialGroup")
           }
         }
       }
@@ -262,7 +266,9 @@ private module FabricV2 {
       module ThreadingGroup {
         private class ClassInstantiation extends Group::ModeledSubclass {
           ClassInstantiation() {
-            this in [group().getMember("ThreadingGroup"), fabric().getMember("ThreadingGroup")]
+            this = group().getMember("ThreadingGroup")
+            or
+            this = fabric().getMember("ThreadingGroup")
           }
         }
       }

From 5c79ad2412e7f588408dba9c9c16bce4dfba3cd0 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Fri, 16 Apr 2021 11:38:29 +0200
Subject: [PATCH 294/433] Python: Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/semmle/python/frameworks/Invoke.qll | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Invoke.qll b/python/ql/src/semmle/python/frameworks/Invoke.qll
index 5b5a5e6e7f06..6330d0c631f0 100644
--- a/python/ql/src/semmle/python/frameworks/Invoke.qll
+++ b/python/ql/src/semmle/python/frameworks/Invoke.qll
@@ -30,9 +30,9 @@ private module Invoke {
       module Context {
         /** Gets a reference to the `invoke.context.Context` class. */
         API::Node classRef() {
-          result =
-            [API::moduleImport("invoke").getMember("context"), API::moduleImport("invoke")]
-                .getMember("Context")
+          result = API::moduleImport("invoke").getMember("context").getMember("Context")
+          or
+          result = API::moduleImport("invoke").getMember("Context")
         }
 
         /** Gets a reference to an instance of `invoke.context.Context`. */
@@ -51,7 +51,7 @@ private module Invoke {
         }
 
         /** Gets a reference to an instance of `invoke.context.Context`. */
-        DataFlow::LocalSourceNode instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to the `run` or `sudo` methods on a `invoke.context.Context` instance. */
         private DataFlow::LocalSourceNode instanceRunMethods(DataFlow::TypeTracker t) {

From 92b4eb7f02b23066cbffd2b351a79e28ed138495 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Fri, 16 Apr 2021 11:54:20 +0000
Subject: [PATCH 295/433] Python: Cleanup and more explanation

Goes into some detail about the intended semantics of local source nodes
and `flowsTo`.
---
 .../dataflow/new/internal/LocalSources.qll    | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index ae7d3fabb7fd..7aa311df76b1 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -21,15 +21,34 @@ private predicate comes_from_cfgnode(Node node) {
  * A data flow node that is a source of local flow. This includes things like
  * - Expressions
  * - Function parameters
+ *
+ *
+ * Local source nodes and the `flowsTo` relation should be thought of in terms of the reference
+ * semantics of the underlying object. For instance, in the following snippet of code
+ *
+ * ```python
+ *     x = []
+ *     x.append(1)
+ *     x.append(2)
+ * ```
+ *
+ * the local source node corresponding to the occurrences of `x` is the empty list that is assigned to `x`
+ * originally. Even though the two `append` calls modify the value of `x`, they do not change the fact that
+ * `x` still points to the same object. If, however, we next do `x = x + [3]`, then the expression `x + [3]`
+ * will be the new local source of what `x` now points to.
  */
 class LocalSourceNode extends Node {
   cached
   LocalSourceNode() {
     not comes_from_cfgnode(this) and
     not this instanceof ModuleVariableNode and
-    not this.(PostUpdateNode).getPreUpdateNode() in [
-        syntheticPostUpdateNode::storePreUpdateNode(), syntheticPostUpdateNode::readPreUpdateNode()
-      ]
+    // Currently, we create synthetic post-update nodes for
+    // - arguments to calls that may modify said argument
+    // - direct reads a writes of object attributes
+    // Both of these preserve the identity of the underlying pointer, and hence we exclude these as
+    // local source nodes.
+    // We do, however, allow the post-update nodes that arise from object creation (which are non-synthetic).
+    not this instanceof SyntheticPostUpdateNode
     or
     this = any(ModuleVariableNode mvn).getARead()
   }

From 40b74167e073326319195473f2968d64083392f8 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 16 Apr 2021 14:34:16 +0200
Subject: [PATCH 296/433] C#: Improve performance of
 `DisposeNotCalledOnException.ql`

---
 .../API Abuse/DisposeNotCalledOnException.ql  | 107 ++++++++++++------
 1 file changed, 71 insertions(+), 36 deletions(-)

diff --git a/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql b/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql
index 7469cbc59e72..abb962449b9f 100644
--- a/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql	
+++ b/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql	
@@ -18,36 +18,6 @@ import csharp
 import Dispose
 import semmle.code.csharp.frameworks.System
 
-/**
- * Gets an exception type that may be thrown during the execution of method `m`.
- * Assumes any exception may be thrown by library types.
- */
-Class getAThrownException(Method m) {
-  m.fromLibrary() and
-  result = any(SystemExceptionClass sc)
-  or
-  exists(ControlFlowElement cfe |
-    cfe = any(ThrowElement te | result = te.getExpr().getType()) or
-    cfe = any(MethodCall mc | result = getAThrownException(mc.getARuntimeTarget()))
-  |
-    cfe.getEnclosingCallable() = m and
-    not isTriedAgainstException(cfe, result)
-  )
-}
-
-/**
- * Holds if control flow element is tried against throwing an exception of type
- * `ec`.
- */
-pragma[noinline]
-predicate isTriedAgainstException(ControlFlowElement cfe, ExceptionClass ec) {
-  (cfe instanceof ThrowElement or cfe instanceof MethodCall) and
-  exists(TryStmt ts |
-    ts.getATriedElement() = cfe and
-    exists(ts.getAnExceptionHandler(ec))
-  )
-}
-
 private class DisposeCall extends MethodCall {
   DisposeCall() { this.getTarget() instanceof DisposeMethod }
 }
@@ -78,8 +48,17 @@ predicate disposeReachableFromDisposableCreation(DisposeCall disposeCall, Expr d
   reachesDisposeCall(disposeCall, DataFlow::exprNode(disposableCreation))
 }
 
-class MethodCallThatMayThrow extends MethodCall {
-  MethodCallThatMayThrow() { exists(getAThrownException(this.getARuntimeTarget())) }
+/**
+ * Holds if control flow element is tried against throwing an exception of type
+ * `ec`.
+ */
+pragma[noinline]
+predicate isTriedAgainstException(ControlFlowElement cfe, ExceptionClass ec) {
+  (cfe instanceof ThrowElement or cfe instanceof MethodCall) and
+  exists(TryStmt ts |
+    ts.getATriedElement() = cfe and
+    exists(ts.getAnExceptionHandler(ec))
+  )
 }
 
 ControlFlowElement getACatchOrFinallyClauseChild() {
@@ -88,15 +67,71 @@ ControlFlowElement getACatchOrFinallyClauseChild() {
   result = getACatchOrFinallyClauseChild().getAChild()
 }
 
-from DisposeCall disposeCall, Expr disposableCreation, MethodCallThatMayThrow callThatThrows
-where
+private predicate candidate(DisposeCall disposeCall, Call call, Expr disposableCreation) {
   disposeReachableFromDisposableCreation(disposeCall, disposableCreation) and
   // The dispose call is not, itself, within a dispose method.
   not disposeCall.getEnclosingCallable() instanceof DisposeMethod and
   // Dispose call not within a finally or catch block
   not getACatchOrFinallyClauseChild() = disposeCall and
   // At least one method call exists between the allocation and disposal that could throw
-  disposableCreation.getAReachableElement() = callThatThrows and
-  callThatThrows.getAReachableElement() = disposeCall
+  disposableCreation.getAReachableElement() = call and
+  call.getAReachableElement() = disposeCall
+}
+
+private class RelevantMethod extends Method {
+  RelevantMethod() {
+    exists(Call call |
+      candidate(_, call, _) and
+      this = call.getARuntimeTarget()
+    )
+    or
+    exists(RelevantMethod other | other.calls(this))
+  }
+
+  pragma[noinline]
+  private RelevantMethod callsNoTry() {
+    exists(MethodCall mc |
+      result = mc.getARuntimeTarget() and
+      not isTriedAgainstException(mc, _) and
+      mc.getEnclosingCallable() = this
+    )
+  }
+
+  pragma[noinline]
+  private RelevantMethod callsInTry(MethodCall mc) {
+    result = mc.getARuntimeTarget() and
+    isTriedAgainstException(mc, _) and
+    mc.getEnclosingCallable() = this
+  }
+
+  /**
+   * Gets an exception type that may be thrown during the execution of this method.
+   * Assumes any exception may be thrown by library types.
+   */
+  Class getAThrownException() {
+    this.fromLibrary() and
+    result instanceof SystemExceptionClass
+    or
+    exists(ControlFlowElement cfe |
+      result = cfe.(ThrowElement).getExpr().getType() and
+      cfe.getEnclosingCallable() = this
+      or
+      result = this.callsInTry(cfe).getAThrownException()
+    |
+      not isTriedAgainstException(cfe, result)
+    )
+    or
+    result = this.callsNoTry().getAThrownException()
+  }
+}
+
+class MethodCallThatMayThrow extends MethodCall {
+  MethodCallThatMayThrow() {
+    exists(this.getARuntimeTarget().(RelevantMethod).getAThrownException())
+  }
+}
+
+from DisposeCall disposeCall, Expr disposableCreation, MethodCallThatMayThrow callThatThrows
+where candidate(disposeCall, callThatThrows, disposableCreation)
 select disposeCall, "Dispose missed if exception is thrown by $@.", callThatThrows,
   callThatThrows.toString()

From f8d45f04edd76bbfe22f371ca2280e74afa09b2a Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Fri, 16 Apr 2021 16:44:58 +0200
Subject: [PATCH 297/433] Revert "Revert "C++: Work around extractor issue
 CPP-383""

**Revert the revert** of the workaround for CFG issues when a
`FunctionCall` has a `getTarget` that does not exist. While we've fixed
the main cause of the problem, it can apparently still happen in rare
cases as a result of extractor crashes.

This reverts commit ee5eaef5e48ba3802fb118c56bd9aae0ef2ac805.
---
 .../controlflow/internal/ConstantExprs.qll    | 35 ++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
index 77e0f05ed020..dc08f588e43d 100644
--- a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
@@ -104,9 +104,42 @@ private predicate loopConditionAlwaysUponEntry(ControlFlowNode loop, Expr condit
   )
 }
 
+/**
+ * This relation is the same as the `el instanceof Function`, only obfuscated
+ * so the optimizer will not understand that any `FunctionCall.getTarget()`
+ * should be in this relation.
+ */
+pragma[noinline]
+private predicate isFunction(Element el) {
+  el instanceof Function
+  or
+  el.(Expr).getParent() = el
+}
+
+/**
+ * Holds if `fc` is a `FunctionCall` with no return value for `getTarget`. This
+ * can happen due to extractor issue CPP-383.
+ */
+pragma[noopt]
+private predicate callHasNoTarget(@funbindexpr fc) {
+  exists(Function f |
+    funbind(fc, f) and
+    not isFunction(f)
+  )
+}
+
+// This base case is pulled out to work around QL-796
+private predicate potentiallyReturningFunctionCall_base(FunctionCall fc) {
+  fc.isVirtual()
+  or
+  callHasNoTarget(fc)
+}
+
 /** A function call that *may* return; if in doubt, we assume it may. */
 private predicate potentiallyReturningFunctionCall(FunctionCall fc) {
-  potentiallyReturningFunction(fc.getTarget()) or fc.isVirtual()
+  potentiallyReturningFunctionCall_base(fc)
+  or
+  potentiallyReturningFunction(fc.getTarget())
 }
 
 /** A function that *may* return; if in doubt, we assume it may. */

From 50abb6e3a118415c23d29427868674633a822428 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 16 Apr 2021 17:32:44 +0200
Subject: [PATCH 298/433] C++: Cleanup test.c

---
 ...ationAfterEndOfBufferUsingStrncat.expected |  6 +-
 .../Security/CWE/CWE-788/semmle/tests/test.c  | 93 ++++++++++---------
 2 files changed, 53 insertions(+), 46 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
index af52dac01447..c332bd1422fa 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
@@ -1,3 +1,3 @@
-| test.c:4:3:4:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:11:3:11:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:19:3:19:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:8:3:8:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:17:3:17:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:25:3:25:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index d986bb3b13c6..145501d5c16d 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -1,70 +1,77 @@
-void workFunction_0(char *s) {
+char * strncat(char*, const char*, unsigned);
+unsigned strlen(const char*);
+void* malloc(unsigned);
+
+void strncat_test1(char *s) {
   char buf[80];
-  strncat(buf, s, sizeof(buf)-strlen(buf)-1); // GOOD
-  strncat(buf, s, sizeof(buf)-strlen(buf));  // BAD
-  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD [NOT DETECTED] 
+  strncat(buf, s, sizeof(buf) - strlen(buf) - 1); // GOOD
+  strncat(buf, s, sizeof(buf) - strlen(buf));  // BAD
+  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD [NOT DETECTED]
 }
-void workFunction_1(char *s) {
+
 #define MAX_SIZE 80
+
+void strncat_test2(char *s) {
   char buf[MAX_SIZE];
-  strncat(buf, s, MAX_SIZE-strlen(buf)-1); // GOOD
-  strncat(buf, s, MAX_SIZE-strlen(buf));  // BAD
-  strncat(buf, "fix", MAX_SIZE-strlen(buf)); // BAD [NOT DETECTED]
+  strncat(buf, s, MAX_SIZE - strlen(buf) - 1); // GOOD
+  strncat(buf, s, MAX_SIZE - strlen(buf));  // BAD
+  strncat(buf, "fix", MAX_SIZE - strlen(buf)); // BAD [NOT DETECTED]
 }
-void workFunction_2_0(char *s) {
-  char * buf;
-  int len=80;
-  buf = (char *) malloc(len);
-  strncat(buf, s, len-strlen(buf)-1); // GOOD
-  strncat(buf, s, len-strlen(buf));  // BAD
-  strncat(buf, "fix", len-strlen(buf)); // BAD [NOT DETECTED]
+
+void strncat_test3(char *s) {
+  int len = 80;
+  char* buf = (char *) malloc(len);
+  strncat(buf, s, len - strlen(buf) - 1); // GOOD
+  strncat(buf, s, len - strlen(buf));  // BAD
+  strncat(buf, "fix", len - strlen(buf)); // BAD [NOT DETECTED]
 }
-void workFunction_2_1(char *s) {
-  char * buf;
-  int len=80;
-  buf = (char *) malloc(len+1);
-  strncat(buf, s, len-strlen(buf)-1); // GOOD
-  strncat(buf, s, len-strlen(buf));  // GOOD
+
+void strncat_test4(char *s) {
+  int len = 80;
+  char* buf = (char *) malloc(len + 1);
+  strncat(buf, s, len - strlen(buf) - 1); // GOOD
+  strncat(buf, s, len - strlen(buf)); // GOOD
 }
 
 struct buffers
 {
-    unsigned char buff1[50];
-    unsigned char *buff2;
+    unsigned char array[50];
+    unsigned char *pointer;
 } globalBuff1,*globalBuff2,globalBuff1_c,*globalBuff2_c;
 
-
-void badFunc0(){
+void strlen_test1(){
   unsigned char buff1[12];
   struct buffers buffAll;
   struct buffers * buffAll1;
   
   buff1[strlen(buff1)]=0; // BAD
-  buffAll.buff1[strlen(buffAll.buff1)]=0; // BAD
-  buffAll.buff2[strlen(buffAll.buff2)]=0; // BAD
-  buffAll1->buff1[strlen(buffAll1->buff1)]=0; // BAD
-  buffAll1->buff2[strlen(buffAll1->buff2)]=0; // BAD
-  globalBuff1.buff1[strlen(globalBuff1.buff1)]=0; // BAD
-  globalBuff1.buff2[strlen(globalBuff1.buff2)]=0; // BAD
-  globalBuff2->buff1[strlen(globalBuff2->buff1)]=0; // BAD
-  globalBuff2->buff2[strlen(globalBuff2->buff2)]=0; // BAD
+  buffAll.array[strlen(buffAll.array)]=0; // BAD
+  buffAll.pointer[strlen(buffAll.pointer)]=0; // BAD
+  buffAll1->array[strlen(buffAll1->array)]=0; // BAD
+  buffAll1->pointer[strlen(buffAll1->pointer)]=0; // BAD
+  globalBuff1.array[strlen(globalBuff1.array)]=0; // BAD
+  globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // BAD
+  globalBuff2->array[strlen(globalBuff2->array)]=0; // BAD
+  globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // BAD
 }
-void noBadFunc0(){
+
+void strlen_test2(){
   unsigned char buff1[12],buff1_c[12];
   struct buffers buffAll,buffAll_c;
   struct buffers * buffAll1,*buffAll1_c;
   
   buff1[strlen(buff1_c)]=0; // GOOD
-  buffAll.buff1[strlen(buffAll_c.buff1)]=0; // GOOD
-  buffAll.buff2[strlen(buffAll.buff1)]=0; // GOOD
-  buffAll1->buff1[strlen(buffAll1_c->buff1)]=0; // GOOD
-  buffAll1->buff2[strlen(buffAll1->buff1)]=0; // GOOD
-  globalBuff1.buff1[strlen(globalBuff1_c.buff1)]=0; // GOOD
-  globalBuff1.buff2[strlen(globalBuff1.buff1)]=0; // GOOD
-  globalBuff2->buff1[strlen(globalBuff2_c->buff1)]=0; // GOOD
-  globalBuff2->buff2[strlen(globalBuff2->buff1)]=0; // GOOD
+  buffAll.array[strlen(buffAll_c.array)]=0; // GOOD
+  buffAll.pointer[strlen(buffAll.array)]=0; // GOOD
+  buffAll1->array[strlen(buffAll1_c->array)]=0; // GOOD
+  buffAll1->pointer[strlen(buffAll1->array)]=0; // GOOD
+  globalBuff1.array[strlen(globalBuff1_c.array)]=0; // GOOD
+  globalBuff1.pointer[strlen(globalBuff1.array)]=0; // GOOD
+  globalBuff2->array[strlen(globalBuff2_c->array)]=0; // GOOD
+  globalBuff2->pointer[strlen(globalBuff2->array)]=0; // GOOD
 }
-void goodFunc0(){
+
+void strlen_test3(){
   unsigned char buffer[12];
   int i;
   for(i = 0; i < 6; i++)

From 1e327289b2e43e4f9afa103e5161f3a6c1e450a8 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 16 Apr 2021 17:34:12 +0200
Subject: [PATCH 299/433] C++: Add false negative test.

---
 .../query-tests/Security/CWE/CWE-788/semmle/tests/test.c   | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index 145501d5c16d..5557daf54ca9 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -39,6 +39,13 @@ struct buffers
     unsigned char *pointer;
 } globalBuff1,*globalBuff2,globalBuff1_c,*globalBuff2_c;
 
+void strncat_test5(char* s, struct buffers* buffers) {
+  unsigned len_array = strlen(buffers->array);
+  unsigned max_size = sizeof(buffers->array);
+  unsigned free_size = max_size - len_array;
+  strncat(buffers->array, s, free_size); // BAD [NOT DETECTED]
+}
+
 void strlen_test1(){
   unsigned char buff1[12];
   struct buffers buffAll;

From 64f8316a6dfbad88939b7c9f0b69d91c6713c032 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 16 Apr 2021 18:45:08 +0200
Subject: [PATCH 300/433] C++: Tidy up the ql file and accept test changes.

---
 ...oryLocationAfterEndOfBufferUsingStrncat.ql | 66 +++++++------------
 ...ationAfterEndOfBufferUsingStrncat.expected |  8 ++-
 .../Security/CWE/CWE-788/semmle/tests/test.c  |  8 +--
 3 files changed, 31 insertions(+), 51 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index e7021bda1ceb..f68395f29bff 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -11,54 +11,32 @@
  */
 
 import cpp
+import semmle.code.cpp.models.implementations.Strcat
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
- * A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
+ * Holds if `call` is a call to `strncat` such that `sizeArg` and `destArg` are the size and
+ * destination arguments, respectively.
  */
-class WrongCallStrncat extends FunctionCall {
-  Expr leftsomeExpr;
-
-  WrongCallStrncat() {
-    this.getTarget().hasGlobalOrStdName("strncat") and
-    // the expression of the first argument in `strncat` and `strnlen` is identical
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
-    // using a string constant often speaks of manually calculating the length of the required buffer.
-    (
-      not this.getArgument(1) instanceof StringLiteral and
-      not this.getArgument(1) instanceof CharLiteral
-    ) and
-    // for use in predicates
-    leftsomeExpr = this.getArgument(2).(SubExpr).getLeftOperand()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to `sizeof(buf)`.
-   */
-  predicate isExpressionEqualSizeof() {
-    // the left side of the expression `someExpr` is `sizeof(buf)`.
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
-    or
-    // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
-    leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to variable containing the length of the memory allocated for the buffer.
-   */
-  predicate isVariableEqualValueSizegBuffer() {
-    // the left side of expression `someExpr` is the variable that was used in the function of allocating memory for the buffer`.
-    exists(AllocationExpr alc |
-      leftsomeExpr.(VariableAccess).getTarget() =
-        alc.(FunctionCall).getArgument(0).(VariableAccess).getTarget()
-    )
-  }
+predicate interestringCallWithArgs(Call call, Expr sizeArg, Expr destArg) {
+  exists(StrcatFunction strcat |
+    strcat = call.getTarget() and
+    sizeArg = call.getArgument(strcat.getParamSize()) and
+    destArg = call.getArgument(strcat.getParamDest())
+  )
 }
 
-from WrongCallStrncat sc
+from FunctionCall call, Expr sizeArg, Expr destArg, SubExpr sub, int n
 where
-  sc.isExpressionEqualSizeof() or
-  sc.isVariableEqualValueSizegBuffer()
-select sc, "if the used buffer is full, writing out of the buffer is possible"
+  interestringCallWithArgs(call, sizeArg, destArg) and
+  // The destination buffer is an array of size n
+  destArg.getUnspecifiedType().(ArrayType).getSize() = n and
+  // The size argument is equivalent to a subtraction
+  globalValueNumber(sizeArg).getAnExpr() = sub and
+  // ... where the left side of the subtraction is the constant n
+  globalValueNumber(sub.getLeftOperand()).getAnExpr().getValue().toInt() = n and
+  // ... and the right side of the subtraction is a call to `strlen` where the argument is the
+  // destination buffer.
+  globalValueNumber(sub.getRightOperand()).getAnExpr().(StrlenCall).getStringExpr() =
+    globalValueNumber(destArg).getAnExpr()
+select call, "Possible out-of-bounds write due to incorrect size argument."
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
index c332bd1422fa..3e9791e10247 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
@@ -1,3 +1,5 @@
-| test.c:8:3:8:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:17:3:17:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:25:3:25:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:8:3:8:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:9:3:9:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:17:3:17:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:18:3:18:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:46:3:46:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index 5557daf54ca9..6d3108756307 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -6,7 +6,7 @@ void strncat_test1(char *s) {
   char buf[80];
   strncat(buf, s, sizeof(buf) - strlen(buf) - 1); // GOOD
   strncat(buf, s, sizeof(buf) - strlen(buf));  // BAD
-  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD [NOT DETECTED]
+  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD
 }
 
 #define MAX_SIZE 80
@@ -15,14 +15,14 @@ void strncat_test2(char *s) {
   char buf[MAX_SIZE];
   strncat(buf, s, MAX_SIZE - strlen(buf) - 1); // GOOD
   strncat(buf, s, MAX_SIZE - strlen(buf));  // BAD
-  strncat(buf, "fix", MAX_SIZE - strlen(buf)); // BAD [NOT DETECTED]
+  strncat(buf, "fix", MAX_SIZE - strlen(buf)); // BAD
 }
 
 void strncat_test3(char *s) {
   int len = 80;
   char* buf = (char *) malloc(len);
   strncat(buf, s, len - strlen(buf) - 1); // GOOD
-  strncat(buf, s, len - strlen(buf));  // BAD
+  strncat(buf, s, len - strlen(buf));  // BAD [NOT DETECTED]
   strncat(buf, "fix", len - strlen(buf)); // BAD [NOT DETECTED]
 }
 
@@ -43,7 +43,7 @@ void strncat_test5(char* s, struct buffers* buffers) {
   unsigned len_array = strlen(buffers->array);
   unsigned max_size = sizeof(buffers->array);
   unsigned free_size = max_size - len_array;
-  strncat(buffers->array, s, free_size); // BAD [NOT DETECTED]
+  strncat(buffers->array, s, free_size); // BAD
 }
 
 void strlen_test1(){

From 95742aec693be629542aa176ff5bad2deba4212a Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 16 Apr 2021 21:29:17 +0200
Subject: [PATCH 301/433] C++: Accept test changes for the other experimental
 query in the directory. This is only a change in line numbers.

---
 ...ocationAfterEndOfBufferUsingStrlen.expected | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
index 103afd8ffd94..cd160a70638c 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
@@ -1,9 +1,9 @@
-| test.c:42:3:42:24 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:43:3:43:40 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:44:3:44:40 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:45:3:45:44 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:46:3:46:44 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:47:3:47:48 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:48:3:48:48 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:49:3:49:50 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:50:3:50:50 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:54:3:54:24 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:55:3:55:40 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:56:3:56:44 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:57:3:57:44 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:58:3:58:48 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:59:3:59:48 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:60:3:60:52 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:61:3:61:50 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:62:3:62:54 | ... = ... | potential unsafe or redundant assignment. |

From f3661c34eee2a565c3affe34d3376a56eb5664b2 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Fri, 16 Apr 2021 19:49:55 +0000
Subject: [PATCH 302/433] Python: Clean up Django models using API graphs

First sweep. Takes care of most of the models.
---
 .../src/semmle/python/frameworks/Django.qll   | 713 ++++--------------
 1 file changed, 143 insertions(+), 570 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 0566eab8651d..b2dd77642d5b 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -298,54 +298,13 @@ private module PrivateDjango {
   // django
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `django` module. */
-  private DataFlow::Node django(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("django")
-    or
-    exists(DataFlow::TypeTracker t2 | result = django(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `django` module. */
-  DataFlow::Node django() { result = django(DataFlow::TypeTracker::end()) }
+  API::Node django() { result = API::moduleImport("django") }
 
   /**
    * Gets a reference to the attribute `attr_name` of the `django` module.
    * WARNING: Only holds for a few predefined attributes.
    */
-  private DataFlow::Node django_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["db", "urls", "http", "conf", "views", "shortcuts"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("django" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("django")
-    )
-    or
-    // Due to bad performance when using normal setup with `django_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        django_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate django_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(django_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `django` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node django_attr(string attr_name) {
-    result = django_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  private API::Node django_attr(string attr_name) { result = django().getMember(attr_name) }
 
   /** Provides models for the `django` module. */
   module django {
@@ -353,7 +312,7 @@ private module PrivateDjango {
     // django.db
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.db` module. */
-    DataFlow::Node db() { result = django_attr("db") }
+    API::Node db() { result = django_attr("db") }
 
     /**
      * `django.db` implements PEP249, providing ways to execute SQL statements against a database.
@@ -365,39 +324,17 @@ private module PrivateDjango {
     /** Provides models for the `django.db` module. */
     module db {
       /** Gets a reference to the `django.db.connection` object. */
-      private DataFlow::Node connection(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.db.connection")
-        or
-        t.startInAttr("connection") and
-        result = db()
-        or
-        exists(DataFlow::TypeTracker t2 | result = connection(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `django.db.connection` object. */
-      DataFlow::Node connection() { result = connection(DataFlow::TypeTracker::end()) }
+      API::Node connection() { result = db().getMember("connection") }
 
       class DjangoDbConnection extends Connection::InstanceSource {
-        DjangoDbConnection() { this = connection() }
+        DjangoDbConnection() { this = connection().getAUse() }
       }
 
       // -------------------------------------------------------------------------
       // django.db.models
       // -------------------------------------------------------------------------
       /** Gets a reference to the `django.db.models` module. */
-      private DataFlow::Node models(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.db.models")
-        or
-        t.startInAttr("models") and
-        result = django()
-        or
-        exists(DataFlow::TypeTracker t2 | result = models(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `django.db.models` module. */
-      DataFlow::Node models() { result = models(DataFlow::TypeTracker::end()) }
+      API::Node models() { result = db().getMember("models") }
 
       /** Provides models for the `django.db.models` module. */
       module models {
@@ -448,48 +385,28 @@ private module PrivateDjango {
         API::Node querySet() { result = querySetReturningMethod(_).getReturn() }
 
         /** Gets a reference to the `django.db.models.expressions` module. */
-        private DataFlow::Node expressions(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("django.db.models.expressions")
-          or
-          t.startInAttr("expressions") and
-          result = models()
-          or
-          exists(DataFlow::TypeTracker t2 | result = expressions(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `django.db.models.expressions` module. */
-        DataFlow::Node expressions() { result = expressions(DataFlow::TypeTracker::end()) }
+        API::Node expressions() { result = models().getMember("expressions") }
 
         /** Provides models for the `django.db.models.expressions` module. */
         module expressions {
           /** Provides models for the `django.db.models.expressions.RawSQL` class. */
           module RawSQL {
-            /** Gets a reference to the `django.db.models.expressions.RawSQL` class. */
-            private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-              t.start() and
-              result = DataFlow::importNode("django.db.models.expressions.RawSQL")
-              or
-              t.start() and
-              result = DataFlow::importNode("django.db.models.RawSQL") // Commonly used alias
-              or
-              t.startInAttr("RawSQL") and
-              result = expressions()
-              or
-              exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-            }
-
             /**
              * Gets a reference to the `django.db.models.expressions.RawSQL` class.
              */
-            DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+            API::Node classRef() {
+              result = expressions().getMember("RawSQL")
+              or
+              // Commonly used alias
+              result = models().getMember("RawSQL")
+            }
 
             /** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
-            private DataFlow::Node instance(DataFlow::TypeTracker t, ControlFlowNode sql) {
+            private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t, ControlFlowNode sql) {
               t.start() and
-              exists(CallNode c | result.asCfgNode() = c |
-                c.getFunction() = classRef().asCfgNode() and
-                c.getArg(0) = sql
+              exists(DataFlow::CallCfgNode c | result = c |
+                c = classRef().getACall() and
+                c.getArg(0).asCfgNode() = sql
               )
               or
               exists(DataFlow::TypeTracker t2 | result = instance(t2, sql).track(t2, t))
@@ -497,7 +414,7 @@ private module PrivateDjango {
 
             /** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
             DataFlow::Node instance(ControlFlowNode sql) {
-              result = instance(DataFlow::TypeTracker::end(), sql)
+              instance(DataFlow::TypeTracker::end(), sql).flowsTo(result)
             }
           }
         }
@@ -556,7 +473,7 @@ private module PrivateDjango {
     // django.urls
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.urls` module. */
-    DataFlow::Node urls() { result = django_attr("urls") }
+    API::Node urls() { result = django_attr("urls") }
 
     /** Provides models for the `django.urls` module */
     module urls {
@@ -564,104 +481,43 @@ private module PrivateDjango {
        * Gets a reference to the attribute `attr_name` of the `urls` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node urls_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["path", "re_path"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.urls" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = DataFlow::importNode("django.urls")
-          or
-          t.startInAttr(attr_name) and
-          result = django::urls()
-        )
-        or
-        // Due to bad performance when using normal setup with `urls_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            urls_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate urls_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(urls_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `urls` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node urls_attr(string attr_name) {
-        result = urls_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node urls_attr(string attr_name) { result = urls().getMember(attr_name) }
 
       /**
        * Gets a reference to the `django.urls.path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#path
        */
-      DataFlow::Node path() { result = urls_attr("path") }
+      API::Node path() { result = urls_attr("path") }
 
       /**
        * Gets a reference to the `django.urls.re_path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
        */
-      DataFlow::Node re_path() { result = urls_attr("re_path") }
+      API::Node re_path() { result = urls_attr("re_path") }
     }
 
     // -------------------------------------------------------------------------
     // django.conf
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.conf` module. */
-    DataFlow::Node conf() { result = django_attr("conf") }
+    API::Node conf() { result = django_attr("conf") }
 
     /** Provides models for the `django.conf` module */
     module conf {
-      // -------------------------------------------------------------------------
-      // django.conf.urls
-      // -------------------------------------------------------------------------
-      /** Gets a reference to the `django.conf.urls` module. */
-      private DataFlow::Node urls(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.conf.urls")
-        or
-        t.startInAttr("urls") and
-        result = conf()
-        or
-        exists(DataFlow::TypeTracker t2 | result = urls(t2).track(t2, t))
-      }
-
-      // NOTE: had to rename due to shadowing rules in QL
-      /** Gets a reference to the `django.conf.urls` module. */
-      DataFlow::Node conf_urls() { result = urls(DataFlow::TypeTracker::end()) }
-
-      // NOTE: had to rename due to shadowing rules in QL
-      /** Provides models for the `django.conf.urls` module */
       module conf_urls {
-        /** Gets a reference to the `django.conf.urls.url` function. */
-        private DataFlow::Node url(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("django.conf.urls.url")
-          or
-          t.startInAttr("url") and
-          result = conf_urls()
-          or
-          exists(DataFlow::TypeTracker t2 | result = url(t2).track(t2, t))
-        }
+        // -------------------------------------------------------------------------
+        // django.conf.urls
+        // -------------------------------------------------------------------------
+        // NOTE: had to rename due to shadowing rules in QL
+        /** Gets a reference to the `django.conf.urls` module. */
+        API::Node conf_urls() { result = conf().getMember("urls") }
 
         /**
          * Gets a reference to the `django.conf.urls.url` function.
          *
          * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
          */
-        DataFlow::Node url() { result = url(DataFlow::TypeTracker::end()) }
+        API::Node url() { result = conf_urls().getMember("url") }
       }
     }
 
@@ -669,7 +525,7 @@ private module PrivateDjango {
     // django.http
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.http` module. */
-    DataFlow::Node http() { result = django_attr("http") }
+    API::Node http() { result = django_attr("http") }
 
     /** Provides models for the `django.http` module */
     module http {
@@ -677,58 +533,13 @@ private module PrivateDjango {
        * Gets a reference to the attribute `attr_name` of the `django.http` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in [
-            // request
-            "request", "HttpRequest",
-            // response
-            "response", "HttpResponse",
-            // HttpResponse subclasses
-            "HttpResponseRedirect", "HttpResponsePermanentRedirect", "HttpResponseNotModified",
-            "HttpResponseBadRequest", "HttpResponseNotFound", "HttpResponseForbidden",
-            "HttpResponseNotAllowed", "HttpResponseGone", "HttpResponseServerError", "JsonResponse",
-            // HttpResponse-like classes
-            "StreamingHttpResponse", "FileResponse"
-          ] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.http" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = django::http()
-        )
-        or
-        // Due to bad performance when using normal setup with `http_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            http_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate http_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(http_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.http` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node http_attr(string attr_name) {
-        result = http_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
+      private API::Node http_attr(string attr_name) { result = http().getMember(attr_name) }
 
       // ---------------------------------------------------------------------------
       // django.http.request
       // ---------------------------------------------------------------------------
       /** Gets a reference to the `django.http.request` module. */
-      DataFlow::Node request() { result = http_attr("request") }
+      API::Node request() { result = http_attr("request") }
 
       /** Provides models for the `django.http.request` module. */
       module request {
@@ -736,41 +547,7 @@ private module PrivateDjango {
          * Gets a reference to the attribute `attr_name` of the `django.http.request` module.
          * WARNING: Only holds for a few predefined attributes.
          */
-        private DataFlow::Node request_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["HttpRequest"] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.http.request" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = django::http::request()
-          )
-          or
-          // Due to bad performance when using normal setup with `request_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              request_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate request_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(request_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.request` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node request_attr(string attr_name) {
-          result = request_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
+        private API::Node request_attr(string attr_name) { result = request().getMember(attr_name) }
 
         /**
          * Provides models for the `django.http.request.HttpRequest` class
@@ -779,20 +556,13 @@ private module PrivateDjango {
          */
         module HttpRequest {
           /** Gets a reference to the `django.http.request.HttpRequest` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node classRef() {
             result = request_attr("HttpRequest")
             or
             // handle django.http.HttpRequest alias
-            t.start() and
             result = http_attr("HttpRequest")
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
-          /** Gets a reference to the `django.http.request.HttpRequest` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
           /**
            * A source of instances of `django.http.request.HttpRequest`, extend this class to model new instances.
            *
@@ -806,7 +576,7 @@ private module PrivateDjango {
           abstract class InstanceSource extends DataFlow::Node { }
 
           /** Gets a reference to an instance of `django.http.request.HttpRequest`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -814,7 +584,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.request.HttpRequest`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
       }
 
@@ -822,7 +592,7 @@ private module PrivateDjango {
       // django.http.response
       // -------------------------------------------------------------------------
       /** Gets a reference to the `django.http.response` module. */
-      DataFlow::Node response() { result = http_attr("response") }
+      API::Node response() { result = http_attr("response") }
 
       /** Provides models for the `django.http.response` module */
       module response {
@@ -830,49 +600,8 @@ private module PrivateDjango {
          * Gets a reference to the attribute `attr_name` of the `django.http.response` module.
          * WARNING: Only holds for a few predefined attributes.
          */
-        private DataFlow::Node response_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in [
-              "HttpResponse",
-              // HttpResponse subclasses
-              "HttpResponseRedirect", "HttpResponsePermanentRedirect", "HttpResponseNotModified",
-              "HttpResponseBadRequest", "HttpResponseNotFound", "HttpResponseForbidden",
-              "HttpResponseNotAllowed", "HttpResponseGone", "HttpResponseServerError",
-              "JsonResponse",
-              // HttpResponse-like classes
-              "StreamingHttpResponse", "FileResponse"
-            ] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.http.response" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = response()
-          )
-          or
-          // Due to bad performance when using normal setup with `response_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              response_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate response_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(response_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.response` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node response_attr(string attr_name) {
-          result = response_attr(DataFlow::TypeTracker::end(), attr_name)
+        private API::Node response_attr(string attr_name) {
+          result = response().getMember(attr_name)
         }
 
         /**
@@ -881,23 +610,15 @@ private module PrivateDjango {
          * See https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpResponse.
          */
         module HttpResponse {
-          /** Gets a reference to the `django.http.response.HttpResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponse")
             or
             // Handle `django.http.HttpResponse` alias
-            t.start() and
             result = http_attr("HttpResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponse`, extend this class to model new instances.
@@ -912,10 +633,8 @@ private module PrivateDjango {
           }
 
           /** A direct instantiation of `django.http.response.HttpResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -930,7 +649,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -938,7 +657,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         // ---------------------------------------------------------------------------
@@ -952,22 +671,15 @@ private module PrivateDjango {
          */
         module HttpResponseRedirect {
           /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseRedirect")
             or
             // Handle `django.http.HttpResponseRedirect` alias
-            t.start() and
             result = http_attr("HttpResponseRedirect")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
-          /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          /** Gets a reference a subclass of the `django.http.response.HttpResponseRedirect` class. */
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseRedirect`, extend this class to model new instances.
@@ -982,10 +694,8 @@ private module PrivateDjango {
             HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseRedirect`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // note that even though browsers like Chrome usually doesn't fetch the
@@ -1005,7 +715,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1013,7 +723,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1023,22 +733,15 @@ private module PrivateDjango {
          */
         module HttpResponsePermanentRedirect {
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponsePermanentRedirect")
             or
             // Handle `django.http.HttpResponsePermanentRedirect` alias
-            t.start() and
             result = http_attr("HttpResponsePermanentRedirect")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponsePermanentRedirect`, extend this class to model new instances.
@@ -1053,10 +756,8 @@ private module PrivateDjango {
             HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponsePermanentRedirect`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // note that even though browsers like Chrome usually doesn't fetch the
@@ -1076,7 +777,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponsePermanentRedirect`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1084,7 +785,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponsePermanentRedirect`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1094,23 +795,16 @@ private module PrivateDjango {
          */
         module HttpResponseNotModified {
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseNotModified")
             or
             // TODO: remove/expand this part of the template as needed
             // Handle `django.http.HttpResponseNotModified` alias
-            t.start() and
             result = http_attr("HttpResponseNotModified")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotModified`, extend this class to model new instances.
@@ -1124,10 +818,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotModified`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() { none() }
 
@@ -1138,7 +830,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotModified`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1146,7 +838,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotModified`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1156,22 +848,15 @@ private module PrivateDjango {
          */
         module HttpResponseBadRequest {
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseBadRequest")
             or
             // Handle `django.http.HttpResponseBadRequest` alias
-            t.start() and
             result = http_attr("HttpResponseBadRequest")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseBadRequest`, extend this class to model new instances.
@@ -1185,10 +870,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseBadRequest`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1201,7 +884,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseBadRequest`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1209,7 +892,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseBadRequest`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1219,22 +902,15 @@ private module PrivateDjango {
          */
         module HttpResponseNotFound {
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseNotFound")
             or
             // Handle `django.http.HttpResponseNotFound` alias
-            t.start() and
             result = http_attr("HttpResponseNotFound")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotFound`, extend this class to model new instances.
@@ -1248,10 +924,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotFound`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1264,7 +938,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotFound`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1272,7 +946,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotFound`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1282,22 +956,15 @@ private module PrivateDjango {
          */
         module HttpResponseForbidden {
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseForbidden")
             or
             // Handle `django.http.HttpResponseForbidden` alias
-            t.start() and
             result = http_attr("HttpResponseForbidden")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseForbidden`, extend this class to model new instances.
@@ -1311,10 +978,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseForbidden`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1327,7 +992,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseForbidden`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1335,7 +1000,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseForbidden`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1345,22 +1010,15 @@ private module PrivateDjango {
          */
         module HttpResponseNotAllowed {
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseNotAllowed")
             or
             // Handle `django.http.HttpResponseNotAllowed` alias
-            t.start() and
             result = http_attr("HttpResponseNotAllowed")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotAllowed`, extend this class to model new instances.
@@ -1374,10 +1032,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotAllowed`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // First argument is permitted methods
@@ -1391,7 +1047,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotAllowed`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1399,7 +1055,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotAllowed`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1409,22 +1065,15 @@ private module PrivateDjango {
          */
         module HttpResponseGone {
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseGone")
             or
             // Handle `django.http.HttpResponseGone` alias
-            t.start() and
             result = http_attr("HttpResponseGone")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseGone`, extend this class to model new instances.
@@ -1438,10 +1087,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseGone`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1454,7 +1101,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseGone`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1462,7 +1109,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseGone`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1472,22 +1119,15 @@ private module PrivateDjango {
          */
         module HttpResponseServerError {
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("HttpResponseServerError")
             or
             // Handle `django.http.HttpResponseServerError` alias
-            t.start() and
             result = http_attr("HttpResponseServerError")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseServerError`, extend this class to model new instances.
@@ -1501,10 +1141,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseServerError`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1517,7 +1155,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseServerError`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1525,7 +1163,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseServerError`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1535,22 +1173,15 @@ private module PrivateDjango {
          */
         module JsonResponse {
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("JsonResponse")
             or
             // Handle `django.http.JsonResponse` alias
-            t.start() and
             result = http_attr("JsonResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.JsonResponse`, extend this class to model new instances.
@@ -1564,10 +1195,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.JsonResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("data")]
@@ -1580,7 +1209,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1588,7 +1217,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         // ---------------------------------------------------------------------------
@@ -1601,22 +1230,15 @@ private module PrivateDjango {
          */
         module StreamingHttpResponse {
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("StreamingHttpResponse")
             or
             // Handle `django.http.StreamingHttpResponse` alias
-            t.start() and
             result = http_attr("StreamingHttpResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.StreamingHttpResponse`, extend this class to model new instances.
@@ -1630,10 +1252,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.StreamingHttpResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("streaming_content")]
@@ -1646,7 +1266,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.StreamingHttpResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1654,7 +1274,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.StreamingHttpResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1664,22 +1284,15 @@ private module PrivateDjango {
          */
         module FileResponse {
           /** Gets a reference to the `django.http.response.FileResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
+          API::Node baseClassRef() {
             result = response_attr("FileResponse")
             or
             // Handle `django.http.FileResponse` alias
-            t.start() and
             result = http_attr("FileResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
           /** Gets a reference to the `django.http.response.FileResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.FileResponse`, extend this class to model new instances.
@@ -1693,10 +1306,8 @@ private module PrivateDjango {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.FileResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("streaming_content")]
@@ -1712,7 +1323,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.FileResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1720,7 +1331,7 @@ private module PrivateDjango {
           }
 
           /** Gets a reference to an instance of `django.http.response.FileResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
@@ -1767,7 +1378,7 @@ private module PrivateDjango {
     // django.shortcuts
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.shortcuts` module. */
-    DataFlow::Node shortcuts() { result = django_attr("shortcuts") }
+    API::Node shortcuts() { result = django_attr("shortcuts") }
 
     /** Provides models for the `django.shortcuts` module */
     module shortcuts {
@@ -1775,40 +1386,8 @@ private module PrivateDjango {
        * Gets a reference to the attribute `attr_name` of the `django.shortcuts` module.
        * WARNING: Only holds for a few predefined attributes.
        */
-      private DataFlow::Node shortcuts_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["redirect"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.shortcuts" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = shortcuts()
-        )
-        or
-        // Due to bad performance when using normal setup with `shortcuts_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            shortcuts_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate shortcuts_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(shortcuts_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.shortcuts` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node shortcuts_attr(string attr_name) {
-        result = shortcuts_attr(DataFlow::TypeTracker::end(), attr_name)
+      private API::Node shortcuts_attr(string attr_name) {
+        result = shortcuts().getMember(attr_name)
       }
 
       /**
@@ -1816,7 +1395,7 @@ private module PrivateDjango {
        *
        * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
        */
-      DataFlow::Node redirect() { result = shortcuts_attr("redirect") }
+      API::Node redirect() { result = shortcuts_attr("redirect") }
     }
   }
 
@@ -1840,7 +1419,7 @@ private module PrivateDjango {
      * Note: TODO: This doesn't take MRO into account
      * Note: TODO: This doesn't take staticmethod/classmethod into account
      */
-    private DataFlow::Node getASelfRef(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode getASelfRef(DataFlow::TypeTracker t) {
       t.start() and
       result.(DataFlow::ParameterNode).getParameter() = this.getAMethod().getArg(0)
       or
@@ -1854,7 +1433,7 @@ private module PrivateDjango {
      * Note: TODO: This doesn't take MRO into account
      * Note: TODO: This doesn't take staticmethod/classmethod into account
      */
-    DataFlow::Node getASelfRef() { result = this.getASelfRef(DataFlow::TypeTracker::end()) }
+    DataFlow::Node getASelfRef() { this.getASelfRef(DataFlow::TypeTracker::end()).flowsTo(result) }
   }
 
   // ---------------------------------------------------------------------------
@@ -1931,7 +1510,9 @@ private module PrivateDjango {
    * route, but currently it just tracks all functions, since we can't do type-tracking
    * backwards yet (TODO).
    */
-  private DataFlow::Node djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker t, Function func) {
+  private DataFlow::LocalSourceNode djangoRouteHandlerFunctionTracker(
+    DataFlow::TypeTracker t, Function func
+  ) {
     t.start() and
     (
       not exists(func.getADecorator()) and
@@ -1959,7 +1540,7 @@ private module PrivateDjango {
    * backwards yet (TODO).
    */
   private DataFlow::Node djangoRouteHandlerFunctionTracker(Function func) {
-    result = djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker::end(), func)
+    djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker::end(), func).flowsTo(result)
   }
 
   /**
@@ -1972,7 +1553,7 @@ private module PrivateDjango {
    */
   class DjangoViewClassHelper extends Class {
     /** Gets a reference to this class. */
-    private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode getARef(DataFlow::TypeTracker t) {
       t.start() and
       result.asExpr().(ClassExpr) = this.getParent()
       or
@@ -1980,10 +1561,10 @@ private module PrivateDjango {
     }
 
     /** Gets a reference to this class. */
-    DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
+    DataFlow::Node getARef() { this.getARef(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     /** Gets a reference to the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewRef(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode asViewRef(DataFlow::TypeTracker t) {
       t.startInAttr("as_view") and
       result = this.getARef()
       or
@@ -1991,10 +1572,10 @@ private module PrivateDjango {
     }
 
     /** Gets a reference to the `as_view` classmethod of this class. */
-    DataFlow::Node asViewRef() { result = this.asViewRef(DataFlow::TypeTracker::end()) }
+    DataFlow::Node asViewRef() { this.asViewRef(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewResult(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode asViewResult(DataFlow::TypeTracker t) {
       t.start() and
       result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
       or
@@ -2002,7 +1583,7 @@ private module PrivateDjango {
     }
 
     /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
+    DataFlow::Node asViewResult() { asViewResult(DataFlow::TypeTracker::end()).flowsTo(result) }
   }
 
   /** A class that we consider a django View class. */
@@ -2142,10 +1723,8 @@ private module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/3.0/ref/urls/#path
    */
-  private class DjangoUrlsPathCall extends DjangoRouteSetup {
-    override CallNode node;
-
-    DjangoUrlsPathCall() { node.getFunction() = django::urls::path().asCfgNode() }
+  private class DjangoUrlsPathCall extends DjangoRouteSetup, DataFlow::CallCfgNode {
+    DjangoUrlsPathCall() { this = django::urls::path().getACall() }
 
     override DataFlow::Node getUrlPatternArg() {
       result.asCfgNode() = [node.getArg(0), node.getArgByName("route")]
@@ -2228,11 +1807,9 @@ private module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
    */
-  private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup {
-    override CallNode node;
-
+  private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup, DataFlow::CallCfgNode {
     DjangoUrlsRePathCall() {
-      node.getFunction() = django::urls::re_path().asCfgNode() and
+      this = django::urls::re_path().getACall() and
       // `django.conf.urls.url` (which we support directly with
       // `DjangoConfUrlsUrlCall`), is implemented in Django 2+ as backward compatibility
       // using `django.urls.re_path`. See
@@ -2263,10 +1840,8 @@ private module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
    */
-  private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup {
-    override CallNode node;
-
-    DjangoConfUrlsUrlCall() { node.getFunction() = django::conf::conf_urls::url().asCfgNode() }
+  private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup, DataFlow::CallCfgNode {
+    DjangoConfUrlsUrlCall() { this = django::conf::conf_urls::url().getACall() }
 
     override DataFlow::Node getUrlPatternArg() {
       result.asCfgNode() = [node.getArg(0), node.getArgByName("regex")]
@@ -2374,10 +1949,8 @@ private module PrivateDjango {
    * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
    */
   private class DjangoShortcutsRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
-    DjangoShortcutsRedirectCall() { node.getFunction() = django::shortcuts::redirect().asCfgNode() }
+    DataFlow::CallCfgNode {
+    DjangoShortcutsRedirectCall() { this = django::shortcuts::redirect().getACall() }
 
     /**
      * Gets the data-flow node that specifies the location of this HTTP redirect response.

From e36b42a03f3cd7797b548d94ebb5736957804340 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 17 Apr 2021 09:47:15 +0200
Subject: [PATCH 303/433] Java: Fix invalid id in experimental query

The invalid id broke CI here: https://github.com/github/codeql/pull/5703 (see https://github.slack.com/archives/CPSEA0G22/p1618602834224600)
---
 java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
index c28af8aaa152..71ee842f1627 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -5,7 +5,7 @@
  * @kind path-problem
  * @problem.severity error
  * @precision high
- * @id java/JSONP-Injection
+ * @id java/jsonp-injection
  * @tags security
  *       external/cwe/cwe-352
  */

From daad62c4e0d996cc463dd69ac55192989f42836d Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Fri, 16 Apr 2021 14:52:00 +0200
Subject: [PATCH 304/433] Java: Add TaintedPath test.

---
 .../CWE-022/semmle/tests/TaintedPath.expected |  7 +++++++
 .../security/CWE-022/semmle/tests/Test.java   | 19 ++++++++++++++++---
 .../security/CWE-022/semmle/tests/options     |  1 +
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 java/ql/test/query-tests/security/CWE-022/semmle/tests/options

diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
index 2f761c646ea9..1586ee698243 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
@@ -2,12 +2,19 @@ edges
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp |
+| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:81:67:81:81 | ... + ... |
 nodes
 | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:24:20:24:23 | temp | semmle.label | temp |
 | Test.java:27:21:27:24 | temp | semmle.label | temp |
 | Test.java:30:44:30:47 | temp | semmle.label | temp |
+| Test.java:34:21:34:24 | temp | semmle.label | temp |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| Test.java:81:67:81:81 | ... + ... | semmle.label | ... + ... |
 #select
 | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:27:11:27:25 | get(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:30:11:30:48 | getPath(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
+| Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
+| Test.java:81:52:81:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:81:67:81:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
index 21f218eca05f..72926a61df54 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
@@ -3,10 +3,10 @@
 package test.cwe22.semmle.tests;
 
 
+import javax.servlet.http.*;
+import javax.servlet.ServletException;
 
-
-import java.io.IOException;
-import java.io.File;
+import java.io.*;
 import java.net.InetAddress;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -28,6 +28,11 @@ void doGet1(InetAddress address)
 					
 			// BAD: construct a path with user input
 			path = FileSystems.getDefault().getPath(temp);
+
+			// BAD: insufficient check
+			if (temp.startsWith("/some_safe_dir/")) {
+				file = new File(temp);
+			}
 	}
 	
 	void doGet2(InetAddress address)
@@ -68,4 +73,12 @@ boolean isSortOfSafe(String pathSpec) {
 			return false;
 		return true;
 	}
+
+    public class MyServlet extends HttpServlet {
+        public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+            BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
+            String filename = br.readLine();
+            BufferedWriter bw = new BufferedWriter(new FileWriter("dir/"+filename, true));
+        }
+    }
 }
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options
new file mode 100644
index 000000000000..a41b28dc2459
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4

From 06514159be9624539659b0960e727c4092434cb7 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Mon, 19 Apr 2021 10:58:21 +0200
Subject: [PATCH 305/433] Java: Add XXE tests.

---
 .../security/CWE-611/SAXSourceTests.java      | 41 ++++++++++
 .../security/CWE-611/UnmarshallerTests.java   | 30 ++++++++
 .../query-tests/security/CWE-611/XXE.expected |  6 ++
 .../test/query-tests/security/CWE-611/options |  2 +-
 .../javax/xml/bind/JAXBContext.java           | 33 ++++++++
 .../javax/xml/bind/Unmarshaller.java          | 76 +++++++++++++++++++
 6 files changed, 187 insertions(+), 1 deletion(-)
 create mode 100644 java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
 create mode 100644 java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
 create mode 100644 java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java
 create mode 100644 java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java

diff --git a/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
new file mode 100644
index 000000000000..f4a361c518b2
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
@@ -0,0 +1,41 @@
+import java.net.Socket;
+
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.sax.SAXSource;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Unmarshaller;
+
+import org.xml.sax.InputSource;
+import org.xml.sax.XMLReader;
+import org.xml.sax.helpers.XMLReaderFactory;
+
+public class SAXSourceTests {
+
+  public void unsafeSource(Socket sock) throws Exception {
+    XMLReader reader = XMLReaderFactory.createXMLReader();
+    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(source); //unsafe
+  }
+
+  public void explicitlySafeSource1(Socket sock) throws Exception {
+    XMLReader reader = XMLReaderFactory.createXMLReader();
+    reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
+    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
+  }
+
+  public void createdSafeSource(Socket sock) throws Exception {
+    SAXParserFactory factory = SAXParserFactory.newInstance();
+    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    SAXParser parser = factory.newSAXParser();
+    XMLReader reader = parser.getXMLReader();
+    SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); //safe
+    SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java b/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
new file mode 100644
index 000000000000..f29018d599a7
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
@@ -0,0 +1,30 @@
+import java.net.Socket;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.sax.SAXSource;
+
+import org.xml.sax.InputSource;
+
+public class UnmarshallerTests {
+
+  public void safeUnmarshal(Socket sock) throws Exception {
+    SAXParserFactory spf = SAXParserFactory.newInstance();
+    spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(xmlSource); //safe
+  }
+
+  public void unsafeUnmarshal(Socket sock) throws Exception {
+    SAXParserFactory spf = SAXParserFactory.newInstance();
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(sock.getInputStream()); //unsafe
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-611/XXE.expected b/java/ql/test/query-tests/security/CWE-611/XXE.expected
index 4cdedb8d0aab..5a73087602f7 100644
--- a/java/ql/test/query-tests/security/CWE-611/XXE.expected
+++ b/java/ql/test/query-tests/security/CWE-611/XXE.expected
@@ -2,6 +2,7 @@ edges
 | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
 | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
 | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
+| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source |
 | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) |
 | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) |
 | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) |
@@ -78,6 +79,8 @@ nodes
 | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | semmle.label | getInputStream(...) |
+| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SAXSourceTests.java:20:18:20:23 | source | semmle.label | source |
 | SchemaTests.java:12:39:12:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SchemaTests.java:25:39:25:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
@@ -163,6 +166,7 @@ nodes
 | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | TransformerTests.java:141:18:141:70 | new SAXSource(...) | semmle.label | new SAXSource(...) |
 | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | semmle.label | getInputStream(...) |
 | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | semmle.label | new InputSource(...) |
 | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | semmle.label | new InputSource(...) |
@@ -220,6 +224,7 @@ nodes
 | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user input |
 | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user input |
 | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user input |
+| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | Unsafe parsing of XML file from $@. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user input |
 | SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user input |
 | SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user input |
 | SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user input |
@@ -267,6 +272,7 @@ nodes
 | TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user input |
 | TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user input |
 | TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user input |
+| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user input |
 | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user input |
 | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user input |
 | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user input |
diff --git a/java/ql/test/query-tests/security/CWE-611/options b/java/ql/test/query-tests/security/CWE-611/options
index 6bfedccfc254..89b9a39f7cec 100644
--- a/java/ql/test/query-tests/security/CWE-611/options
+++ b/java/ql/test/query-tests/security/CWE-611/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1
diff --git a/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java
new file mode 100644
index 000000000000..b588264557d2
--- /dev/null
+++ b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java
@@ -0,0 +1,33 @@
+package javax.xml.bind;
+
+import java.util.Map;
+
+abstract public class JAXBContext {
+  protected JAXBContext() { }
+
+//  public static final String JAXB_CONTEXT_FACTORY;
+//
+//  public Binder<Node> createBinder() { return null; }
+//
+//  public Binder<T> createBinder(Class<T> p0) { return null; }
+//
+//  public JAXBIntrospector createJAXBIntrospector() { return null; }
+//
+//  abstract public Marshaller createMarshaller();
+
+  abstract public Unmarshaller createUnmarshaller();
+
+//  abstract public Validator createValidator();
+//
+//  public void generateSchema(SchemaOutputResolver p0) { }
+
+  public static JAXBContext newInstance(Class... p0) { return null; }
+
+  public static JAXBContext newInstance(Class<?>[] p0, Map<String,?> p1) { return null; }
+
+  public static JAXBContext newInstance(String p0) { return null; }
+
+  public static JAXBContext newInstance(String p0, ClassLoader p1) { return null; }
+
+  public static JAXBContext newInstance(String p0, ClassLoader p1, Map<String,?> p2) { return null; }
+}
diff --git a/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java
new file mode 100644
index 000000000000..6781205fe896
--- /dev/null
+++ b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java
@@ -0,0 +1,76 @@
+package javax.xml.bind;
+
+import java.net.URL;
+import java.io.Reader;
+import java.io.InputStream;
+import java.io.File;
+import javax.xml.transform.Source;
+
+abstract public interface Unmarshaller {
+  abstract public static class Listener {
+    public Listener() { }
+  
+    public void afterUnmarshal(Object p0, Object p1) { }
+  
+    public void beforeUnmarshal(Object p0, Object p1) { }
+  }
+
+//  abstract public A getAdapter(Class<A> p0);
+//
+//  abstract public AttachmentUnmarshaller getAttachmentUnmarshaller();
+//
+//  abstract public ValidationEventHandler getEventHandler();
+//
+//  abstract public Listener getListener();
+
+  abstract public Object getProperty(String p0);
+
+//  abstract public Schema getSchema();
+//
+//  abstract public UnmarshallerHandler getUnmarshallerHandler();
+
+  abstract public boolean isValidating();
+
+//  abstract public void setAdapter(Class<A> p0, A p1);
+//
+//  abstract public void setAdapter(XmlAdapter p0);
+//
+//  abstract public void setAttachmentUnmarshaller(AttachmentUnmarshaller p0);
+//
+//  abstract public void setEventHandler(ValidationEventHandler p0);
+//
+//  abstract public void setListener(Listener p0);
+//
+//  abstract public void setProperty(String p0, Object p1);
+//
+//  abstract public void setSchema(Schema p0);
+
+  abstract public void setValidating(boolean p0);
+
+  abstract public Object unmarshal(File p0);
+
+  abstract public Object unmarshal(InputStream p0);
+
+  abstract public Object unmarshal(Reader p0);
+
+  abstract public Object unmarshal(URL p0);
+
+//  abstract public Object unmarshal(XMLEventReader p0);
+//
+//  abstract public JAXBElement<T> unmarshal(XMLEventReader p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(XMLStreamReader p0);
+//
+//  abstract public JAXBElement<T> unmarshal(XMLStreamReader p0, Class<T> p1);
+
+  abstract public Object unmarshal(Source p0);
+
+//  abstract public JAXBElement<T> unmarshal(Source p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(Node p0);
+//
+//  abstract public JAXBElement<T> unmarshal(Node p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(InputSource p0);
+}
+

From c5193cf03f1824d2a8af82394b2839c5e6ef314e Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
Date: Mon, 19 Apr 2021 13:14:56 +0200
Subject: [PATCH 306/433] Apply suggestions from code review

---
 .../query-tests/security/CWE-022/semmle/tests/Test.java   | 1 +
 .../test/query-tests/security/CWE-611/SAXSourceTests.java | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
index 72926a61df54..a0a6694c0619 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
@@ -78,6 +78,7 @@ public class MyServlet extends HttpServlet {
         public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
             BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
             String filename = br.readLine();
+            // BAD: construct a file path with user input
             BufferedWriter bw = new BufferedWriter(new FileWriter("dir/"+filename, true));
         }
     }
diff --git a/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
index f4a361c518b2..06a4b5a43f3b 100644
--- a/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
+++ b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
@@ -17,7 +17,7 @@ public void unsafeSource(Socket sock) throws Exception {
     SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
     JAXBContext jc = JAXBContext.newInstance(Object.class);
     Unmarshaller um = jc.createUnmarshaller();
-    um.unmarshal(source); //unsafe
+    um.unmarshal(source); // BAD
   }
 
   public void explicitlySafeSource1(Socket sock) throws Exception {
@@ -25,7 +25,7 @@ public void explicitlySafeSource1(Socket sock) throws Exception {
     reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
     reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
     reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
-    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
+    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
   }
 
   public void createdSafeSource(Socket sock) throws Exception {
@@ -35,7 +35,7 @@ public void createdSafeSource(Socket sock) throws Exception {
     factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
     SAXParser parser = factory.newSAXParser();
     XMLReader reader = parser.getXMLReader();
-    SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); //safe
-    SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
+    SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); // GOOD
+    SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
   }
 }

From 29aec0d770b3a28682d95f9044e724b123b86140 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Mon, 19 Apr 2021 13:16:46 +0200
Subject: [PATCH 307/433] Java: Adjust expected output.

---
 .../security/CWE-022/semmle/tests/TaintedPath.expected      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
index 1586ee698243..bf3e3f665f9d 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
@@ -3,7 +3,7 @@ edges
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp |
-| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:81:67:81:81 | ... + ... |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... |
 nodes
 | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -11,10 +11,10 @@ nodes
 | Test.java:30:44:30:47 | temp | semmle.label | temp |
 | Test.java:34:21:34:24 | temp | semmle.label | temp |
 | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
-| Test.java:81:67:81:81 | ... + ... | semmle.label | ... + ... |
+| Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
 #select
 | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:27:11:27:25 | get(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:30:11:30:48 | getPath(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
-| Test.java:81:52:81:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:81:67:81:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
+| Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |

From 9e6f28e335bc0561ee079ef5488b1f580cfa7255 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 19 Apr 2021 13:17:49 +0200
Subject: [PATCH 308/433] fix bad join order in Xss.qll

---
 javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
index bf8ad71ec994..6a7bd111a9fe 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -211,7 +211,7 @@ module DomBasedXss {
       exists(JQuery::MethodCall call |
         call.interpretsArgumentAsHtml(this) and
         call.interpretsArgumentAsSelector(this) and
-        analyze().getAType() = TTString()
+        pragma[only_bind_out](analyze()).getAType() = TTString()
       )
     }
 

From 9acc71a7cba716c59444357b857c4151ba0352fd Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Mon, 19 Apr 2021 11:54:10 +0000
Subject: [PATCH 309/433] Python: Get rid of all `_attr` methods in
 `Django.qll`

---
 .../src/semmle/python/frameworks/Django.qll   | 116 ++++++------------
 1 file changed, 38 insertions(+), 78 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index b2dd77642d5b..4c9bbddd4744 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -300,19 +300,13 @@ private module PrivateDjango {
   /** Gets a reference to the `django` module. */
   API::Node django() { result = API::moduleImport("django") }
 
-  /**
-   * Gets a reference to the attribute `attr_name` of the `django` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private API::Node django_attr(string attr_name) { result = django().getMember(attr_name) }
-
   /** Provides models for the `django` module. */
   module django {
     // -------------------------------------------------------------------------
     // django.db
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.db` module. */
-    API::Node db() { result = django_attr("db") }
+    API::Node db() { result = django().getMember("db") }
 
     /**
      * `django.db` implements PEP249, providing ways to execute SQL statements against a database.
@@ -473,34 +467,28 @@ private module PrivateDjango {
     // django.urls
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.urls` module. */
-    API::Node urls() { result = django_attr("urls") }
+    API::Node urls() { result = django().getMember("urls") }
 
     /** Provides models for the `django.urls` module */
     module urls {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `urls` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node urls_attr(string attr_name) { result = urls().getMember(attr_name) }
-
       /**
        * Gets a reference to the `django.urls.path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#path
        */
-      API::Node path() { result = urls_attr("path") }
+      API::Node path() { result = urls().getMember("path") }
 
       /**
        * Gets a reference to the `django.urls.re_path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
        */
-      API::Node re_path() { result = urls_attr("re_path") }
+      API::Node re_path() { result = urls().getMember("re_path") }
     }
 
     // -------------------------------------------------------------------------
     // django.conf
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.conf` module. */
-    API::Node conf() { result = django_attr("conf") }
+    API::Node conf() { result = django().getMember("conf") }
 
     /** Provides models for the `django.conf` module */
     module conf {
@@ -525,30 +513,18 @@ private module PrivateDjango {
     // django.http
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.http` module. */
-    API::Node http() { result = django_attr("http") }
+    API::Node http() { result = django().getMember("http") }
 
     /** Provides models for the `django.http` module */
     module http {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.http` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node http_attr(string attr_name) { result = http().getMember(attr_name) }
-
       // ---------------------------------------------------------------------------
       // django.http.request
       // ---------------------------------------------------------------------------
       /** Gets a reference to the `django.http.request` module. */
-      API::Node request() { result = http_attr("request") }
+      API::Node request() { result = http().getMember("request") }
 
       /** Provides models for the `django.http.request` module. */
       module request {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.request` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private API::Node request_attr(string attr_name) { result = request().getMember(attr_name) }
-
         /**
          * Provides models for the `django.http.request.HttpRequest` class
          *
@@ -557,10 +533,10 @@ private module PrivateDjango {
         module HttpRequest {
           /** Gets a reference to the `django.http.request.HttpRequest` class. */
           API::Node classRef() {
-            result = request_attr("HttpRequest")
+            result = request().getMember("HttpRequest")
             or
             // handle django.http.HttpRequest alias
-            result = http_attr("HttpRequest")
+            result = http().getMember("HttpRequest")
           }
 
           /**
@@ -592,18 +568,10 @@ private module PrivateDjango {
       // django.http.response
       // -------------------------------------------------------------------------
       /** Gets a reference to the `django.http.response` module. */
-      API::Node response() { result = http_attr("response") }
+      API::Node response() { result = http().getMember("response") }
 
       /** Provides models for the `django.http.response` module */
       module response {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.response` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private API::Node response_attr(string attr_name) {
-          result = response().getMember(attr_name)
-        }
-
         /**
          * Provides models for the `django.http.response.HttpResponse` class
          *
@@ -611,10 +579,10 @@ private module PrivateDjango {
          */
         module HttpResponse {
           API::Node baseClassRef() {
-            result = response_attr("HttpResponse")
+            result = response().getMember("HttpResponse")
             or
             // Handle `django.http.HttpResponse` alias
-            result = http_attr("HttpResponse")
+            result = http().getMember("HttpResponse")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponse` class. */
@@ -672,10 +640,10 @@ private module PrivateDjango {
         module HttpResponseRedirect {
           /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseRedirect")
+            result = response().getMember("HttpResponseRedirect")
             or
             // Handle `django.http.HttpResponseRedirect` alias
-            result = http_attr("HttpResponseRedirect")
+            result = http().getMember("HttpResponseRedirect")
           }
 
           /** Gets a reference a subclass of the `django.http.response.HttpResponseRedirect` class. */
@@ -734,10 +702,10 @@ private module PrivateDjango {
         module HttpResponsePermanentRedirect {
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponsePermanentRedirect")
+            result = response().getMember("HttpResponsePermanentRedirect")
             or
             // Handle `django.http.HttpResponsePermanentRedirect` alias
-            result = http_attr("HttpResponsePermanentRedirect")
+            result = http().getMember("HttpResponsePermanentRedirect")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
@@ -796,11 +764,11 @@ private module PrivateDjango {
         module HttpResponseNotModified {
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseNotModified")
+            result = response().getMember("HttpResponseNotModified")
             or
             // TODO: remove/expand this part of the template as needed
             // Handle `django.http.HttpResponseNotModified` alias
-            result = http_attr("HttpResponseNotModified")
+            result = http().getMember("HttpResponseNotModified")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
@@ -849,10 +817,10 @@ private module PrivateDjango {
         module HttpResponseBadRequest {
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseBadRequest")
+            result = response().getMember("HttpResponseBadRequest")
             or
             // Handle `django.http.HttpResponseBadRequest` alias
-            result = http_attr("HttpResponseBadRequest")
+            result = http().getMember("HttpResponseBadRequest")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
@@ -903,10 +871,10 @@ private module PrivateDjango {
         module HttpResponseNotFound {
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseNotFound")
+            result = response().getMember("HttpResponseNotFound")
             or
             // Handle `django.http.HttpResponseNotFound` alias
-            result = http_attr("HttpResponseNotFound")
+            result = http().getMember("HttpResponseNotFound")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
@@ -957,10 +925,10 @@ private module PrivateDjango {
         module HttpResponseForbidden {
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseForbidden")
+            result = response().getMember("HttpResponseForbidden")
             or
             // Handle `django.http.HttpResponseForbidden` alias
-            result = http_attr("HttpResponseForbidden")
+            result = http().getMember("HttpResponseForbidden")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
@@ -1011,10 +979,10 @@ private module PrivateDjango {
         module HttpResponseNotAllowed {
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseNotAllowed")
+            result = response().getMember("HttpResponseNotAllowed")
             or
             // Handle `django.http.HttpResponseNotAllowed` alias
-            result = http_attr("HttpResponseNotAllowed")
+            result = http().getMember("HttpResponseNotAllowed")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
@@ -1066,10 +1034,10 @@ private module PrivateDjango {
         module HttpResponseGone {
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseGone")
+            result = response().getMember("HttpResponseGone")
             or
             // Handle `django.http.HttpResponseGone` alias
-            result = http_attr("HttpResponseGone")
+            result = http().getMember("HttpResponseGone")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
@@ -1120,10 +1088,10 @@ private module PrivateDjango {
         module HttpResponseServerError {
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
           API::Node baseClassRef() {
-            result = response_attr("HttpResponseServerError")
+            result = response().getMember("HttpResponseServerError")
             or
             // Handle `django.http.HttpResponseServerError` alias
-            result = http_attr("HttpResponseServerError")
+            result = http().getMember("HttpResponseServerError")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
@@ -1174,10 +1142,10 @@ private module PrivateDjango {
         module JsonResponse {
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
           API::Node baseClassRef() {
-            result = response_attr("JsonResponse")
+            result = response().getMember("JsonResponse")
             or
             // Handle `django.http.JsonResponse` alias
-            result = http_attr("JsonResponse")
+            result = http().getMember("JsonResponse")
           }
 
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
@@ -1231,10 +1199,10 @@ private module PrivateDjango {
         module StreamingHttpResponse {
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
           API::Node baseClassRef() {
-            result = response_attr("StreamingHttpResponse")
+            result = response().getMember("StreamingHttpResponse")
             or
             // Handle `django.http.StreamingHttpResponse` alias
-            result = http_attr("StreamingHttpResponse")
+            result = http().getMember("StreamingHttpResponse")
           }
 
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
@@ -1285,10 +1253,10 @@ private module PrivateDjango {
         module FileResponse {
           /** Gets a reference to the `django.http.response.FileResponse` class. */
           API::Node baseClassRef() {
-            result = response_attr("FileResponse")
+            result = response().getMember("FileResponse")
             or
             // Handle `django.http.FileResponse` alias
-            result = http_attr("FileResponse")
+            result = http().getMember("FileResponse")
           }
 
           /** Gets a reference to the `django.http.response.FileResponse` class. */
@@ -1378,24 +1346,16 @@ private module PrivateDjango {
     // django.shortcuts
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.shortcuts` module. */
-    API::Node shortcuts() { result = django_attr("shortcuts") }
+    API::Node shortcuts() { result = django().getMember("shortcuts") }
 
     /** Provides models for the `django.shortcuts` module */
     module shortcuts {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.shortcuts` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private API::Node shortcuts_attr(string attr_name) {
-        result = shortcuts().getMember(attr_name)
-      }
-
       /**
        * Gets a reference to the `django.shortcuts.redirect` function
        *
        * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
        */
-      API::Node redirect() { result = shortcuts_attr("redirect") }
+      API::Node redirect() { result = shortcuts().getMember("redirect") }
     }
   }
 

From a27dac029f0c742cfb0c76a93703a54a0f5d214e Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Fri, 19 Mar 2021 15:16:57 +0100
Subject: [PATCH 310/433] Java: Use shared flow summary library for csv models.

---
 .../code/java/dataflow/ExternalFlow.qll       | 88 ++++++++++++++++---
 .../semmle/code/java/dataflow/FlowSummary.qll |  4 +-
 .../java/dataflow/internal/DataFlowUtil.qll   |  2 -
 .../dataflow/internal/TaintTrackingUtil.qll   |  6 +-
 4 files changed, 79 insertions(+), 21 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 4bb79e84ead9..c1ad6eb4ecf0 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -67,6 +67,7 @@
 import java
 private import semmle.code.java.dataflow.DataFlow::DataFlow
 private import internal.DataFlowPrivate
+private import FlowSummary
 
 /**
  * A module importing the frameworks that provide external flow data,
@@ -459,7 +460,8 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, input, _, _) and pred = "summary"
     |
       specSplit(input, part, _) and
-      not part.regexpMatch("|Argument|ReturnValue") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element") and
+      not (part = "Argument" and pred = "sink") and
       not parseArg(part, _) and
       msg = "Unrecognized input specification \"" + part + "\" in " + pred + " model."
     )
@@ -470,7 +472,8 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, _, output, _) and pred = "summary"
     |
       specSplit(output, part, _) and
-      not part.regexpMatch("|Argument|Parameter|ReturnValue") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element") and
+      not (part = ["Argument", "Parameter"] and pred = "source") and
       not parseArg(part, _) and
       not parseParam(part, _) and
       msg = "Unrecognized output specification \"" + part + "\" in " + pred + " model."
@@ -675,6 +678,75 @@ private predicate summaryElementRef(Top ref, string input, string output, string
   )
 }
 
+private SummaryComponent interpretComponent(string c) {
+  specSplit(_, c, _) and
+  (
+    exists(int pos | parseArg(c, pos) and result = SummaryComponent::argument(pos))
+    or
+    exists(int pos | parseParam(c, pos) and result = SummaryComponent::parameter(pos))
+    or
+    c = "ReturnValue" and result = SummaryComponent::return()
+    or
+    c = "ArrayElement" and result = SummaryComponent::content(any(ArrayContent c0))
+    or
+    c = "Element" and result = SummaryComponent::content(any(CollectionContent c0))
+    // or
+    // c = "MapKey" and result = SummaryComponent::content(any(MapKeyContent c0))
+    // or
+    // c = "MapValue" and result = SummaryComponent::content(any(MapValueContent c0))
+  )
+}
+
+private predicate interpretSpec(string spec, int idx, SummaryComponentStack stack) {
+  exists(string c |
+    summaryElement(_, spec, _, _) or
+    summaryElement(_, _, spec, _)
+  |
+    len(spec, idx + 1) and
+    specSplit(spec, c, idx) and
+    stack = SummaryComponentStack::singleton(interpretComponent(c))
+  )
+  or
+  exists(SummaryComponent head, SummaryComponentStack tail |
+    interpretSpec(spec, idx, head, tail) and
+    stack = SummaryComponentStack::push(head, tail)
+  )
+}
+
+private predicate interpretSpec(
+  string output, int idx, SummaryComponent head, SummaryComponentStack tail
+) {
+  exists(string c |
+    interpretSpec(output, idx + 1, tail) and
+    specSplit(output, c, idx) and
+    head = interpretComponent(c)
+  )
+}
+
+private class MkStack extends RequiredSummaryComponentStack {
+  MkStack() { interpretSpec(_, _, _, this) }
+
+  override predicate required(SummaryComponent c) { interpretSpec(_, _, c, this) }
+}
+
+private class SummarizedCallableExternal extends SummarizedCallable {
+  SummarizedCallableExternal() { summaryElement(this, _, _, _) }
+
+  override predicate propagatesFlow(
+    SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+  ) {
+    exists(string inSpec, string outSpec, string kind |
+      summaryElement(this, inSpec, outSpec, kind) and
+      interpretSpec(inSpec, 0, input) and
+      interpretSpec(outSpec, 0, output)
+    |
+      kind = "value" and preservesValue = true
+      or
+      kind = "taint" and preservesValue = false
+    )
+  }
+}
+
 private newtype TAstOrNode =
   TAst(Top t) or
   TNode(Node n)
@@ -761,15 +833,3 @@ predicate sinkNode(Node node, string kind) {
     interpretInput(input, 0, ref, TNode(node))
   )
 }
-
-/**
- * Holds if `node1` to `node2` is specified as a flow step with the given kind
- * in a CSV flow model.
- */
-predicate summaryStep(Node node1, Node node2, string kind) {
-  exists(Top ref, string input, string output |
-    summaryElementRef(ref, input, output, kind) and
-    interpretInput(input, 0, ref, TNode(node1)) and
-    interpretOutput(output, 0, ref, TNode(node2))
-  )
-}
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
index 02e9548c544e..e53a4fc56303 100644
--- a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
@@ -8,7 +8,9 @@ private import internal.DataFlowDispatch
 private import internal.DataFlowPrivate
 
 // import all instances below
-private module Summaries { }
+private module Summaries {
+  private import semmle.code.java.dataflow.ExternalFlow
+}
 
 class SummaryComponent = Impl::Public::SummaryComponent;
 
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 030bf30bd49b..2ad095740154 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -142,8 +142,6 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   or
   node2.asExpr().(AssignExpr).getSource() = node1.asExpr()
   or
-  summaryStep(node1, node2, "value")
-  or
   exists(MethodAccess ma, ValuePreservingMethod m, int argNo |
     ma.getCallee().getSourceDeclaration() = m and m.returnsValue(argNo)
   |
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index 0f20ffe62dbe..d684ebb52756 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -57,16 +57,14 @@ private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::No
   localAdditionalTaintUpdateStep(src.asExpr(),
     sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
   or
-  summaryStep(src, sink, "taint") and
-  not summaryStep(src, sink, "value")
-  or
   exists(Argument arg |
     src.asExpr() = arg and
     arg.isVararg() and
     sink.(DataFlow::ImplicitVarargsArray).getCall() = arg.getCall()
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false) and
+  not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, true)
 }
 
 /**

From 60965b0d8c4c407f8c681d76472ec12ae0365505 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Fri, 19 Mar 2021 15:17:50 +0100
Subject: [PATCH 311/433] Java: Adjust some csv models.

---
 .../src/semmle/code/java/frameworks/ApacheHttp.qll  | 13 ++++++-------
 .../src/semmle/code/java/frameworks/apache/Lang.qll | 10 +++++-----
 .../src/semmle/code/java/frameworks/guava/Base.qll  | 11 ++++++-----
 .../ql/src/semmle/code/java/frameworks/guava/IO.qll |  2 +-
 4 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll b/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
index 2dc1077cb4e4..8378f1e72600 100644
--- a/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
+++ b/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
@@ -149,9 +149,8 @@ private class ApacheHttpFlowStep extends SummaryModelCsv {
         "org.apache.hc.core5.http.message;RequestLine;true;getMethod;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.http.message;RequestLine;true;getUri;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.http.message;RequestLine;true;toString;();;Argument[-1];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(HttpRequest);;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];ReturnValue;taint",
+        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(HttpRequest);;Argument[0];Argument[-1];taint",
+        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];Argument[-1];taint",
         "org.apache.hc.core5.function;Supplier;true;get;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.net;URIAuthority;true;getHostName;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.net;URIAuthority;true;toString;();;Argument[-1];ReturnValue;taint",
@@ -181,16 +180,16 @@ private class ApacheHttpFlowStep extends SummaryModelCsv {
         "org.apache.hc.core5.http.io.entity;HttpEntities;true;withTrailers;;;Argument[0];ReturnValue;taint",
         "org.apache.http.entity;BasicHttpEntity;true;setContent;(InputStream);;Argument[0];Argument[-1];taint",
         "org.apache.http.entity;BufferedHttpEntity;true;BufferedHttpEntity;(HttpEntity);;Argument[0];ReturnValue;taint",
-        "org.apache.http.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.http.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.http.entity;HttpEntityWrapper;true;HttpEntityWrapper;(HttpEntity);;Argument[0];ReturnValue;taint",
         "org.apache.http.entity;InputStreamEntity;true;InputStreamEntity;;;Argument[0];ReturnValue;taint",
-        "org.apache.http.entity;StringEntity;true;StringEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.http.entity;StringEntity;true;StringEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.hc.core5.http.io.entity;BasicHttpEntity;true;BasicHttpEntity;;;Argument[0];ReturnValue;taint",
         "org.apache.hc.core5.http.io.entity;BufferedHttpEntity;true;BufferedHttpEntity;(HttpEntity);;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.io.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.hc.core5.http.io.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.hc.core5.http.io.entity;HttpEntityWrapper;true;HttpEntityWrapper;(HttpEntity);;Argument[0];ReturnValue;taint",
         "org.apache.hc.core5.http.io.entity;InputStreamEntity;true;InputStreamEntity;;;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.io.entity;StringEntity;true;StringEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.hc.core5.http.io.entity;StringEntity;true;StringEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(byte[],int,int);;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(char[],int,int);;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(CharArrayBuffer,int,int);;Argument[0];Argument[-1];taint",
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
index deab8f4a6929..670014e0f8fb 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
@@ -626,12 +626,12 @@ private class ApacheObjectUtilsModel extends SummaryModelCsv {
         "org.apache.commons.lang3;ObjectUtils;false;CONST_BYTE;;;Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;CONST_SHORT;;;Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;defaultIfNull;;;Argument[0..1];ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;firstNonNull;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ObjectUtils;false;firstNonNull;;;ArrayElement of Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;getIfNull;;;Argument[0];ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;max;;;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;median;;;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;min;;;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;mode;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ObjectUtils;false;max;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;median;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;min;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;mode;;;ArrayElement of Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;requireNonEmpty;;;Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;toString;(Object,String);;Argument[1];ReturnValue;value"
       ]
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Base.qll b/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
index ebcfe35a6b9a..194d723caf55 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
@@ -13,7 +13,8 @@ private class GuavaBaseCsv extends SummaryModelCsv {
         "com.google.common.base;Strings;false;padStart;(String,int,char);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Strings;false;padEnd;(String,int,char);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Strings;false;repeat;(String,int);;Argument[0];ReturnValue;taint",
-        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;Argument;ReturnValue;taint",
+        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;ArrayElement of Argument[1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;on;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Joiner;false;skipNulls;();;Argument[-1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
@@ -22,14 +23,14 @@ private class GuavaBaseCsv extends SummaryModelCsv {
         "com.google.common.base;Joiner;false;withKeyValueSeparator;(String);;Argument[-1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;withKeyValueSeparator;(char);;Argument[-1];ReturnValue;taint",
         // Note: The signatures of some of the appendTo methods involve collection flow
-        "com.google.common.base;Joiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner;false;appendTo;;;Argument[-1..3];Argument[0];taint",
         "com.google.common.base;Joiner;false;appendTo;;;Argument[0];ReturnValue;value",
-        "com.google.common.base;Joiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner;false;join;;;Argument[-1..2];ReturnValue;taint",
         "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
-        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[1];Argument[0];taint",
         "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[0];ReturnValue;value",
-        "com.google.common.base;Joiner$MapJoiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner$MapJoiner;false;join;;;Argument[-1..0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;split;(CharSequence);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;splitToStream;(CharSequence);;Argument[0];ReturnValue;taint",
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/IO.qll b/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
index 2a4a03428083..fac9ab9d48da 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
@@ -61,7 +61,7 @@ private class GuavaIoCsv extends SummaryModelCsv {
         "com.google.common.io;Files;false;simplifyPath;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.io;MoreFiles;false;getFileExtension;(Path);;Argument[0];ReturnValue;taint",
         "com.google.common.io;MoreFiles;false;getNameWithoutExtension;(Path);;Argument[0];ReturnValue;taint",
-        "com.google.common.io;LineReader;false;LineReader;(Readable);;Argument[0];ReturnValue;taint",
+        "com.google.common.io;LineReader;false;LineReader;(Readable);;Argument[0];Argument[-1];taint",
         "com.google.common.io;LineReader;true;readLine;();;Argument[-1];ReturnValue;taint",
         "com.google.common.io;ByteArrayDataOutput;true;toByteArray;();;Argument[-1];ReturnValue;taint",
         "com.google.common.io;ByteArrayDataOutput;true;write;(byte[]);;Argument[0];Argument[-1];taint",

From 175c71221a8934c9a7d6dddb876aef278d3b379b Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Tue, 13 Apr 2021 14:26:15 +0200
Subject: [PATCH 312/433] Java: Adjust some test output with more edges/nodes.

---
 .../security/CWE-074/XsltInjection.expected   | 78 ++++++++++++++-----
 .../JakartaExpressionInjection.expected       |  4 +-
 .../security/CWE-094/JexlInjection.expected   |  8 +-
 .../security/CWE-094/MvelInjection.expected   |  6 +-
 .../security/CWE-094/SpelInjection.expected   | 36 +++++++--
 .../SensitiveCookieNotHttpOnly.expected       | 10 +++
 .../CWE-522/InsecureBasicAuth.expected        | 10 +++
 .../security/CWE-652/XQueryInjection.expected | 24 +++++-
 .../security/CWE-918/RequestForgery.expected  | 13 ++++
 .../CWE-022/semmle/tests/TaintedPath.expected | 10 ++-
 .../CWE-022/semmle/tests/ZipSlip.expected     |  7 ++
 .../semmle/tests/ResponseSplitting.expected   |  4 +-
 .../tests/ArithmeticTaintedLocal.expected     | 38 ++++++---
 .../CWE-502/UnsafeDeserialization.expected    | 75 ++++++++++++++----
 .../query-tests/security/CWE-611/XXE.expected | 60 ++++++++++----
 .../tests/NumericCastTaintedLocal.expected    | 10 ++-
 16 files changed, 320 insertions(+), 73 deletions(-)

diff --git a/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
index ece3ed7d17f5..680252d4d370 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
@@ -1,48 +1,81 @@
 edges
-| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:31:5:31:59 | newTransformer(...) |
-| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:36:5:36:74 | newTransformer(...) |
-| XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:43:5:43:59 | newTransformer(...) |
-| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:74 | newTransformer(...) |
-| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:59 | newTransformer(...) |
+| XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource | XsltInjection.java:31:5:31:59 | newTransformer(...) |
+| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource | XsltInjection.java:36:5:36:74 | newTransformer(...) |
+| XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader |
+| XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:42:61:42:64 | xslt : String |
+| XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource | XsltInjection.java:43:5:43:59 | newTransformer(...) |
+| XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader | XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:42:61:42:64 | xslt : String | XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader |
+| XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource | XsltInjection.java:48:5:48:74 | newTransformer(...) |
+| XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource | XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource |
+| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource |
+| XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource | XsltInjection.java:53:5:53:59 | newTransformer(...) |
+| XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource | XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource |
+| XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource |
+| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) |
-| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:63:5:63:74 | newTransformer(...) |
+| XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:63:5:63:74 | newTransformer(...) |
+| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | XsltInjection.java:68:5:68:59 | newTransformer(...) |
-| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:76:5:76:34 | newTransformer(...) |
-| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:83:5:83:34 | newTransformer(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:35 | load(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:98:5:98:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:99:5:99:37 | load30(...) |
-| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:108:5:108:46 | load(...) |
-| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:110:5:110:50 | load(...) |
-| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:109:5:109:49 | load(...) |
+| XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource | XsltInjection.java:76:5:76:34 | newTransformer(...) |
+| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource | XsltInjection.java:83:5:83:34 | newTransformer(...) |
+| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:90:5:90:35 | load(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:91:5:91:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:92:5:92:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:93:5:93:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:94:5:94:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:95:5:95:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:96:5:96:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:97:5:97:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:98:5:98:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:99:5:99:37 | load30(...) |
+| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:104:23:104:27 | param : String |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | XsltInjection.java:108:5:108:46 | load(...) |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | XsltInjection.java:110:5:110:50 | load(...) |
+| XsltInjection.java:104:23:104:27 | param : String | XsltInjection.java:104:15:104:28 | new URI(...) : URI |
+| XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource | XsltInjection.java:109:5:109:49 | load(...) |
+| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource |
 nodes
+| XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:31:5:31:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:36:5:36:74 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:40:45:40:70 | param : String | semmle.label | param : String |
+| XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
+| XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
+| XsltInjection.java:42:61:42:64 | xslt : String | semmle.label | xslt : String |
 | XsltInjection.java:43:5:43:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:48:5:48:74 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
+| XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:53:5:53:59 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:58:5:58:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:63:5:63:74 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:68:5:68:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:76:5:76:34 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:83:5:83:34 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:90:5:90:35 | load(...) | semmle.label | load(...) |
 | XsltInjection.java:91:5:91:37 | load30(...) | semmle.label | load30(...) |
@@ -55,6 +88,9 @@ nodes
 | XsltInjection.java:98:5:98:37 | load30(...) | semmle.label | load30(...) |
 | XsltInjection.java:99:5:99:37 | load30(...) | semmle.label | load30(...) |
 | XsltInjection.java:103:36:103:61 | param : String | semmle.label | param : String |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| XsltInjection.java:104:23:104:27 | param : String | semmle.label | param : String |
+| XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:108:5:108:46 | load(...) | semmle.label | load(...) |
 | XsltInjection.java:109:5:109:49 | load(...) | semmle.label | load(...) |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
index 390871b54cf1..b4f4e1f696bc 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -1,5 +1,6 @@
 edges
-| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
+| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] |
+| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
 | JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:32:24:32:33 | expression : String |
 | JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:40:24:40:33 | expression : String |
 | JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:48:24:48:33 | expression : String |
@@ -18,6 +19,7 @@ edges
 | JakartaExpressionInjection.java:95:24:95:33 | expression : String | JakartaExpressionInjection.java:99:13:99:13 | e |
 nodes
 | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | JakartaExpressionInjection.java:25:31:25:40 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:32:24:32:33 | expression : String | semmle.label | expression : String |
 | JakartaExpressionInjection.java:34:28:34:37 | expression | semmle.label | expression |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
index 8140928cf215..f42f083578e1 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
@@ -8,7 +8,8 @@ edges
 | Jexl2Injection.java:54:73:54:87 | jexlExpr : String | Jexl2Injection.java:57:9:57:35 | parse(...) |
 | Jexl2Injection.java:60:72:60:86 | jexlExpr : String | Jexl2Injection.java:63:9:63:35 | parse(...) |
 | Jexl2Injection.java:66:73:66:87 | jexlExpr : String | Jexl2Injection.java:69:9:69:44 | createTemplate(...) |
-| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:78:31:78:38 | jexlExpr : String |
+| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] |
+| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | Jexl2Injection.java:78:31:78:38 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:86:24:86:56 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:90:24:90:68 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:94:24:94:52 | jexlExpr : String |
@@ -46,7 +47,8 @@ edges
 | Jexl3Injection.java:66:73:66:87 | jexlExpr : String | Jexl3Injection.java:69:9:69:39 | createExpression(...) |
 | Jexl3Injection.java:72:72:72:86 | jexlExpr : String | Jexl3Injection.java:75:9:75:37 | createTemplate(...) |
 | Jexl3Injection.java:78:54:78:68 | jexlExpr : String | Jexl3Injection.java:84:13:84:13 | e |
-| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:96:31:96:38 | jexlExpr : String |
+| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] |
+| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | Jexl3Injection.java:96:31:96:38 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:104:24:104:56 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:108:24:108:68 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:112:24:112:52 | jexlExpr : String |
@@ -103,6 +105,7 @@ nodes
 | Jexl2Injection.java:66:73:66:87 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:69:9:69:44 | createTemplate(...) | semmle.label | createTemplate(...) |
 | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
@@ -143,6 +146,7 @@ nodes
 | Jexl3Injection.java:78:54:78:68 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:84:13:84:13 | e | semmle.label | e |
 | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
index b2325fa78a42..545da956f8ec 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
@@ -10,7 +10,9 @@ edges
 | MvelInjection.java:77:40:77:51 | read(...) : String | MvelInjection.java:77:7:77:52 | compileTemplate(...) |
 | MvelInjection.java:81:54:81:65 | read(...) : String | MvelInjection.java:82:29:82:46 | compile(...) |
 | MvelInjection.java:86:58:86:69 | read(...) : String | MvelInjection.java:88:32:88:41 | expression |
-| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:95:14:95:36 | new String(...) : String |
+| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:94:15:94:16 | is : InputStream |
+| MvelInjection.java:94:15:94:16 | is : InputStream | MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] |
+| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | MvelInjection.java:95:14:95:36 | new String(...) : String |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:25:15:25:26 | read(...) |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:29:54:29:65 | read(...) : String |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:34:58:34:69 | read(...) : String |
@@ -46,6 +48,8 @@ nodes
 | MvelInjection.java:86:58:86:69 | read(...) : String | semmle.label | read(...) : String |
 | MvelInjection.java:88:32:88:41 | expression | semmle.label | expression |
 | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| MvelInjection.java:94:15:94:16 | is : InputStream | semmle.label | is : InputStream |
+| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | semmle.label | new String(...) : String |
 #select
 | MvelInjection.java:25:15:25:26 | read(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:25:15:25:26 | read(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
index 263d6be6c32a..83d1725237a4 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
@@ -1,22 +1,46 @@
 edges
-| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:23:5:23:14 | expression |
-| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | SpelInjection.java:34:5:34:14 | expression |
-| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | SpelInjection.java:48:5:48:14 | expression |
-| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | SpelInjection.java:59:5:59:14 | expression |
-| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | SpelInjection.java:70:5:70:14 | expression |
-| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | SpelInjection.java:83:5:83:14 | expression |
+| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:18:13:18:14 | in : InputStream |
+| SpelInjection.java:18:13:18:14 | in : InputStream | SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] |
+| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | SpelInjection.java:23:5:23:14 | expression |
+| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | SpelInjection.java:30:13:30:14 | in : InputStream |
+| SpelInjection.java:30:13:30:14 | in : InputStream | SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] |
+| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | SpelInjection.java:34:5:34:14 | expression |
+| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | SpelInjection.java:41:13:41:14 | in : InputStream |
+| SpelInjection.java:41:13:41:14 | in : InputStream | SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] |
+| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | SpelInjection.java:48:5:48:14 | expression |
+| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | SpelInjection.java:55:13:55:14 | in : InputStream |
+| SpelInjection.java:55:13:55:14 | in : InputStream | SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] |
+| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | SpelInjection.java:59:5:59:14 | expression |
+| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | SpelInjection.java:66:13:66:14 | in : InputStream |
+| SpelInjection.java:66:13:66:14 | in : InputStream | SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] |
+| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | SpelInjection.java:70:5:70:14 | expression |
+| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | SpelInjection.java:77:13:77:14 | in : InputStream |
+| SpelInjection.java:77:13:77:14 | in : InputStream | SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] |
+| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | SpelInjection.java:83:5:83:14 | expression |
 nodes
 | SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:18:13:18:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:23:5:23:14 | expression | semmle.label | expression |
 | SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:30:13:30:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:34:5:34:14 | expression | semmle.label | expression |
 | SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:41:13:41:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:48:5:48:14 | expression | semmle.label | expression |
 | SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:55:13:55:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:59:5:59:14 | expression | semmle.label | expression |
 | SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:66:13:66:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:70:5:70:14 | expression | semmle.label | expression |
 | SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:77:13:77:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:83:5:83:14 | expression | semmle.label | expression |
 #select
 | SpelInjection.java:23:5:23:14 | expression | SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:23:5:23:14 | expression | SpEL injection from $@. | SpelInjection.java:15:22:15:44 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
index a9d126ca4a97..6c23f5d44e9c 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -1,5 +1,8 @@
 edges
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String |
 | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String | SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
 | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
 | SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) |
@@ -7,11 +10,16 @@ edges
 | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
 | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String |
 | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String | SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie |
 nodes
 | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String | semmle.label | tokenCookieStr : String |
 | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | semmle.label | jwtCookie |
 | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | semmle.label | "token=" : String |
 | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | semmle.label | ... + ... : String |
@@ -25,6 +33,8 @@ nodes
 | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | semmle.label | ... + ... : String |
 | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | semmle.label | secString |
 | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | semmle.label | "Presto-UI-Token" : String |
+| SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String | semmle.label | PRESTO_UI_COOKIE : String |
 | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | semmle.label | cookie : Cookie |
 | SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | semmle.label | createAuthenticationCookie(...) : Cookie |
 | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | semmle.label | cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
index 92cf245968e1..6a4ee5fdddd1 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
@@ -1,8 +1,14 @@
 edges
 | InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post |
 | InsecureBasicAuth.java:35:19:35:64 | "http://www.example.com:8000/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get |
+| InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:46:50:46:55 | uriStr : String |
 | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:54:3:54:6 | post |
+| InsecureBasicAuth.java:46:39:46:56 | create(...) : URI | InsecureBasicAuth.java:54:3:54:6 | post |
+| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | InsecureBasicAuth.java:46:39:46:56 | create(...) : URI |
+| InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:62:21:62:26 | uriStr : String |
 | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:71:3:71:6 | post |
+| InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI | InsecureBasicAuth.java:71:3:71:6 | post |
+| InsecureBasicAuth.java:62:21:62:26 | uriStr : String | InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI |
 | InsecureBasicAuth.java:78:47:78:52 | "http" : String | InsecureBasicAuth.java:86:3:86:6 | post |
 | InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:102:3:102:6 | post |
 | InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:119:3:119:6 | post |
@@ -16,8 +22,12 @@ nodes
 | InsecureBasicAuth.java:35:19:35:64 | "http://www.example.com:8000/payment/retrieve" : String | semmle.label | "http://www.example.com:8000/payment/retrieve" : String |
 | InsecureBasicAuth.java:38:3:38:5 | get | semmle.label | get |
 | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
+| InsecureBasicAuth.java:46:39:46:56 | create(...) : URI | semmle.label | create(...) : URI |
+| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | semmle.label | uriStr : String |
 | InsecureBasicAuth.java:54:3:54:6 | post | semmle.label | post |
 | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
+| InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| InsecureBasicAuth.java:62:21:62:26 | uriStr : String | semmle.label | uriStr : String |
 | InsecureBasicAuth.java:71:3:71:6 | post | semmle.label | post |
 | InsecureBasicAuth.java:78:47:78:52 | "http" : String | semmle.label | "http" : String |
 | InsecureBasicAuth.java:86:3:86:6 | post | semmle.label | post |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected
index b3ae0ff90fb9..919bc3c58d1b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected
@@ -5,10 +5,19 @@ edges
 | XQueryInjection.java:86:33:86:60 | nameStr : String | XQueryInjection.java:92:53:92:57 | query |
 | XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:104:35:104:38 | xqpe |
 | XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:116:53:116:56 | name |
-| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:129:35:129:38 | xqpe |
-| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:142:53:142:54 | br |
+| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:125:70:125:73 | name : ServletInputStream |
+| XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:129:35:129:38 | xqpe |
+| XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:125:70:125:73 | name : ServletInputStream | XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:138:70:138:73 | name : ServletInputStream |
+| XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:142:53:142:54 | br |
+| XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:138:70:138:73 | name : ServletInputStream | XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader |
 | XQueryInjection.java:150:23:150:50 | getParameter(...) : String | XQueryInjection.java:155:29:155:32 | name |
-| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:159:29:159:30 | br |
+| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:158:70:158:71 | is : ServletInputStream |
+| XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:159:29:159:30 | br |
+| XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:158:70:158:71 | is : ServletInputStream | XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader |
 nodes
 | XQueryInjection.java:45:23:45:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | XQueryInjection.java:51:35:51:38 | xqpe | semmle.label | xqpe |
@@ -23,12 +32,21 @@ nodes
 | XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
 | XQueryInjection.java:116:53:116:56 | name | semmle.label | name |
 | XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:125:70:125:73 | name : ServletInputStream | semmle.label | name : ServletInputStream |
 | XQueryInjection.java:129:35:129:38 | xqpe | semmle.label | xqpe |
 | XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:138:70:138:73 | name : ServletInputStream | semmle.label | name : ServletInputStream |
 | XQueryInjection.java:142:53:142:54 | br | semmle.label | br |
 | XQueryInjection.java:150:23:150:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | XQueryInjection.java:155:29:155:32 | name | semmle.label | name |
 | XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:158:70:158:71 | is : ServletInputStream | semmle.label | is : ServletInputStream |
 | XQueryInjection.java:159:29:159:30 | br | semmle.label | br |
 #select
 | XQueryInjection.java:51:35:51:38 | xqpe | XQueryInjection.java:45:23:45:50 | getParameter(...) : String | XQueryInjection.java:51:35:51:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:45:23:45:50 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
index 1d2cae77dfe4..f6c7072a5198 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
@@ -1,5 +1,6 @@
 edges
 | JaxWsSSRF.java:21:22:21:48 | getParameter(...) : String | JaxWsSSRF.java:22:23:22:25 | url |
+| RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:25:31:25:34 | sink : String |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:55:32:55:35 | url1 |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:58:32:58:35 | url1 |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:59:30:59:33 | url1 |
@@ -7,6 +8,12 @@ edges
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:64:59:64:61 | uri |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:67:43:67:45 | uri |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:69:29:69:32 | uri2 |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | RequestForgery2.java:64:59:64:61 | uri |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | RequestForgery2.java:67:43:67:45 | uri |
+| RequestForgery2.java:25:31:25:34 | sink : String | RequestForgery2.java:25:23:25:35 | new URI(...) : URI |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | RequestForgery.java:22:52:22:54 | uri |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | RequestForgery.java:27:57:27:59 | uri |
+| RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:19:23:19:58 | new URI(...) : URI |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:22:52:22:54 | uri |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:27:57:27:59 | uri |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:32:47:32:67 | ... + ... |
@@ -15,13 +22,17 @@ edges
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:45:47:45:60 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:54:59:54:72 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:58:74:58:96 | new URI(...) |
+| SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:58:82:58:95 | fooResourceUrl : String |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:62:57:62:70 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:66:48:66:61 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:69:30:69:43 | fooResourceUrl |
+| SpringSSRF.java:58:82:58:95 | fooResourceUrl : String | SpringSSRF.java:58:74:58:96 | new URI(...) |
 nodes
 | JaxWsSSRF.java:21:22:21:48 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JaxWsSSRF.java:22:23:22:25 | url | semmle.label | url |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| RequestForgery2.java:25:31:25:34 | sink : String | semmle.label | sink : String |
 | RequestForgery2.java:55:32:55:35 | url1 | semmle.label | url1 |
 | RequestForgery2.java:58:32:58:35 | url1 | semmle.label | url1 |
 | RequestForgery2.java:59:30:59:33 | url1 | semmle.label | url1 |
@@ -29,6 +40,7 @@ nodes
 | RequestForgery2.java:64:59:64:61 | uri | semmle.label | uri |
 | RequestForgery2.java:67:43:67:45 | uri | semmle.label | uri |
 | RequestForgery2.java:69:29:69:32 | uri2 | semmle.label | uri2 |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | semmle.label | new URI(...) : URI |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | RequestForgery.java:22:52:22:54 | uri | semmle.label | uri |
 | RequestForgery.java:27:57:27:59 | uri | semmle.label | uri |
@@ -39,6 +51,7 @@ nodes
 | SpringSSRF.java:45:47:45:60 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:54:59:54:72 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:58:74:58:96 | new URI(...) | semmle.label | new URI(...) |
+| SpringSSRF.java:58:82:58:95 | fooResourceUrl : String | semmle.label | fooResourceUrl : String |
 | SpringSSRF.java:62:57:62:70 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:66:48:66:61 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:69:30:69:43 | fooResourceUrl | semmle.label | fooResourceUrl |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
index bf3e3f665f9d..138f05d2986e 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
@@ -3,14 +3,22 @@ edges
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp |
-| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... |
+| Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader | Test.java:80:31:80:32 | br : BufferedReader |
+| Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader | Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader |
+| Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
+| Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
 nodes
 | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:24:20:24:23 | temp | semmle.label | temp |
 | Test.java:27:21:27:24 | temp | semmle.label | temp |
 | Test.java:30:44:30:47 | temp | semmle.label | temp |
 | Test.java:34:21:34:24 | temp | semmle.label | temp |
+| Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| Test.java:80:31:80:32 | br : BufferedReader | semmle.label | br : BufferedReader |
+| Test.java:80:31:80:43 | readLine(...) : String | semmle.label | readLine(...) : String |
 | Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
 #select
 | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
index 6b27b1ec84c3..59e4d879d23b 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
@@ -1,9 +1,16 @@
 edges
+| ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:8:31:8:34 | name : String |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:9:48:9:51 | file |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:10:49:10:52 | file |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:11:36:11:39 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:9:48:9:51 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:10:49:10:52 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:11:36:11:39 | file |
+| ZipTest.java:8:31:8:34 | name : String | ZipTest.java:8:17:8:35 | new File(...) : File |
 nodes
 | ZipTest.java:7:19:7:33 | getName(...) : String | semmle.label | getName(...) : String |
+| ZipTest.java:8:17:8:35 | new File(...) : File | semmle.label | new File(...) : File |
+| ZipTest.java:8:31:8:34 | name : String | semmle.label | name : String |
 | ZipTest.java:9:48:9:51 | file | semmle.label | file |
 | ZipTest.java:10:49:10:52 | file | semmle.label | file |
 | ZipTest.java:11:36:11:39 | file | semmle.label | file |
diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
index 4a1a172bbf5d..1b4efe7781e2 100644
--- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
+++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
@@ -1,6 +1,8 @@
 edges
-| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie |
+| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie |
+| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie |
 nodes
+| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
 | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | ResponseSplitting.java:23:23:23:28 | cookie | semmle.label | cookie |
 | ResponseSplitting.java:28:38:28:72 | getParameter(...) | semmle.label | getParameter(...) |
diff --git a/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected b/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
index 178de2e3dcdf..637b605a06f9 100644
--- a/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
@@ -1,13 +1,23 @@
 edges
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:32:17:32:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:40:17:40:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:50:17:50:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:64:20:64:23 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:95:37:95:40 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:118:9:118:12 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:119:10:119:13 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:120:10:120:13 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:121:10:121:13 | data : Number |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:32:17:32:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:40:17:40:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:50:17:50:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:64:20:64:23 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:95:37:95:40 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:118:9:118:12 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:119:10:119:13 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:120:10:120:13 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:121:10:121:13 | data : Number |
 | ArithmeticTainted.java:64:4:64:10 | tainted [post update] [dat] : Number | ArithmeticTainted.java:66:18:66:24 | tainted [dat] : Number |
 | ArithmeticTainted.java:64:20:64:23 | data : Number | ArithmeticTainted.java:64:4:64:10 | tainted [post update] [dat] : Number |
 | ArithmeticTainted.java:66:18:66:24 | tainted [dat] : Number | ArithmeticTainted.java:66:18:66:34 | getData(...) : Number |
@@ -21,8 +31,18 @@ edges
 | ArithmeticTainted.java:133:27:133:34 | data : Number | ArithmeticTainted.java:135:3:135:6 | data |
 | ArithmeticTainted.java:137:27:137:34 | data : Number | ArithmeticTainted.java:139:5:139:8 | data |
 nodes
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | semmle.label | System.in : InputStream |
 | ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | semmle.label | System.in : InputStream |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | semmle.label | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | semmle.label | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
 | ArithmeticTainted.java:32:17:32:20 | data | semmle.label | data |
 | ArithmeticTainted.java:40:17:40:20 | data | semmle.label | data |
 | ArithmeticTainted.java:50:17:50:20 | data | semmle.label | data |
diff --git a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
index f575a093d6e5..2af8369c1114 100644
--- a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
+++ b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
@@ -1,40 +1,74 @@
 edges
+| A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:14:50:14:60 | inputStream : InputStream |
 | A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in |
+| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:15:12:15:13 | in |
+| A.java:14:50:14:60 | inputStream : InputStream | A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:20:50:20:60 | inputStream : InputStream |
 | A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in |
-| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:27:12:27:12 | d |
-| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:34:23:34:28 | reader |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:40:28:40:32 | input |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:41:34:41:38 | input |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:42:40:42:44 | input |
+| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:21:12:21:13 | in |
+| A.java:20:50:20:60 | inputStream : InputStream | A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:26:35:26:45 | inputStream : InputStream |
+| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | A.java:27:12:27:12 | d |
+| A.java:26:35:26:45 | inputStream : InputStream | A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder |
+| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:33:43:33:53 | inputStream : InputStream |
+| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | A.java:34:23:34:28 | reader |
+| A.java:33:43:33:53 | inputStream : InputStream | A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:40:28:40:32 | input |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:41:34:41:38 | input |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:42:40:42:44 | input |
+| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:39:19:39:50 | new Input(...) : Input |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:61:26:61:30 | input |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:62:30:62:34 | input |
-| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
+| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:50:63:54 | input : InputStream |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:64:24:64:28 | input |
-| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
+| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:46:65:50 | input : InputStream |
+| A.java:63:50:63:54 | input : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
+| A.java:65:46:65:50 | input : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:71:26:71:30 | input |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:72:30:72:34 | input |
-| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
+| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:50:73:54 | input : InputStream |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input |
-| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
+| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:46:75:50 | input : InputStream |
+| A.java:73:50:73:54 | input : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
+| A.java:75:46:75:50 | input : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:91:26:91:30 | input |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:92:30:92:34 | input |
-| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:50:93:54 | input : InputStream |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:94:24:94:28 | input |
-| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:46:95:50 | input : InputStream |
+| A.java:93:50:93:54 | input : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
+| A.java:95:46:95:50 | input : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream |
-| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes |
-| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s |
-| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:31:23:31:23 | s |
+| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:14:5:14:15 | inputStream : InputStream |
+| B.java:14:5:14:15 | inputStream : InputStream | B.java:14:22:14:26 | bytes [post update] : byte[] |
+| B.java:14:22:14:26 | bytes [post update] : byte[] | B.java:15:23:15:27 | bytes |
+| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:21:5:21:15 | inputStream : InputStream |
+| B.java:21:5:21:15 | inputStream : InputStream | B.java:21:22:21:26 | bytes [post update] : byte[] |
+| B.java:21:22:21:26 | bytes [post update] : byte[] | B.java:23:29:23:29 | s |
+| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:29:5:29:15 | inputStream : InputStream |
+| B.java:29:5:29:15 | inputStream : InputStream | B.java:29:22:29:26 | bytes [post update] : byte[] |
+| B.java:29:22:29:26 | bytes [post update] : byte[] | B.java:31:23:31:23 | s |
 | TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
+| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream |
+| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
 nodes
 | A.java:13:31:13:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:14:50:14:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:15:12:15:13 | in | semmle.label | in |
 | A.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:20:50:20:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:21:12:21:13 | in | semmle.label | in |
 | A.java:25:31:25:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | semmle.label | new XMLDecoder(...) : XMLDecoder |
+| A.java:26:35:26:45 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:27:12:27:12 | d | semmle.label | d |
 | A.java:32:31:32:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| A.java:33:43:33:53 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:34:23:34:28 | reader | semmle.label | reader |
+| A.java:39:19:39:50 | new Input(...) : Input | semmle.label | new Input(...) : Input |
 | A.java:39:29:39:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:40:28:40:32 | input | semmle.label | input |
 | A.java:41:34:41:38 | input | semmle.label | input |
@@ -43,30 +77,43 @@ nodes
 | A.java:61:26:61:30 | input | semmle.label | input |
 | A.java:62:30:62:34 | input | semmle.label | input |
 | A.java:63:28:63:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:63:50:63:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:64:24:64:28 | input | semmle.label | input |
 | A.java:65:24:65:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:65:46:65:50 | input : InputStream | semmle.label | input : InputStream |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:71:26:71:30 | input | semmle.label | input |
 | A.java:72:30:72:34 | input | semmle.label | input |
 | A.java:73:28:73:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:73:50:73:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:74:24:74:28 | input | semmle.label | input |
 | A.java:75:24:75:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:75:46:75:50 | input : InputStream | semmle.label | input : InputStream |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:91:26:91:30 | input | semmle.label | input |
 | A.java:92:30:92:34 | input | semmle.label | input |
 | A.java:93:28:93:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:93:50:93:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:94:24:94:28 | input | semmle.label | input |
 | A.java:95:24:95:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:95:46:95:50 | input : InputStream | semmle.label | input : InputStream |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | B.java:8:29:8:39 | inputStream | semmle.label | inputStream |
 | B.java:12:31:12:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:14:5:14:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:14:22:14:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:15:23:15:27 | bytes | semmle.label | bytes |
 | B.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:21:5:21:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:21:22:21:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:23:29:23:29 | s | semmle.label | s |
 | B.java:27:31:27:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:29:5:29:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:29:22:29:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:31:23:31:23 | s | semmle.label | s |
 | TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | semmle.label | entityStream : InputStream |
 | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) | semmle.label | new ObjectInputStream(...) |
+| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | semmle.label | entityStream : InputStream |
 #select
 | A.java:15:12:15:26 | readObject(...) | A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in | Unsafe deserialization of $@. | A.java:13:31:13:51 | getInputStream(...) | user input |
 | A.java:21:12:21:28 | readUnshared(...) | A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in | Unsafe deserialization of $@. | A.java:19:31:19:51 | getInputStream(...) | user input |
diff --git a/java/ql/test/query-tests/security/CWE-611/XXE.expected b/java/ql/test/query-tests/security/CWE-611/XXE.expected
index 5a73087602f7..e2fcffee125f 100644
--- a/java/ql/test/query-tests/security/CWE-611/XXE.expected
+++ b/java/ql/test/query-tests/security/CWE-611/XXE.expected
@@ -1,30 +1,46 @@
 edges
-| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
-| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
-| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
-| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source |
+| DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource | DocumentBuilderTests.java:94:16:94:21 | source : SAXSource |
+| DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource | DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource |
+| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource |
+| DocumentBuilderTests.java:94:16:94:21 | source : SAXSource | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | DocumentBuilderTests.java:101:46:101:51 | source : StreamSource |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | DocumentBuilderTests.java:102:16:102:21 | source : StreamSource |
+| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource |
+| DocumentBuilderTests.java:101:46:101:51 | source : StreamSource | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
+| DocumentBuilderTests.java:102:16:102:21 | source : StreamSource | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
+| SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource | SAXSourceTests.java:20:18:20:23 | source |
+| SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource | SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource |
+| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource |
 | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) |
 | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) |
 | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) |
 | SchemaTests.java:38:56:38:76 | getInputStream(...) : InputStream | SchemaTests.java:38:39:38:77 | new StreamSource(...) |
 | SchemaTests.java:45:56:45:76 | getInputStream(...) : InputStream | SchemaTests.java:45:39:45:77 | new StreamSource(...) |
 | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) |
-| SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:31:41:31:53 | new String(...) |
-| SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:38:41:38:53 | new String(...) |
+| SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] | SimpleXMLTests.java:31:41:31:53 | new String(...) |
+| SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] | SimpleXMLTests.java:38:41:38:53 | new String(...) |
 | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) |
 | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) |
 | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) |
 | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) |
 | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) |
-| SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:90:37:90:49 | new String(...) |
-| SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:97:37:97:49 | new String(...) |
-| SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:104:26:104:38 | new String(...) |
-| SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:111:26:111:38 | new String(...) |
+| SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] | SimpleXMLTests.java:90:37:90:49 | new String(...) |
+| SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] | SimpleXMLTests.java:97:37:97:49 | new String(...) |
+| SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] | SimpleXMLTests.java:104:26:104:38 | new String(...) |
+| SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] | SimpleXMLTests.java:111:26:111:38 | new String(...) |
 | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) |
 | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) |
 | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) |
-| SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:146:22:146:34 | new String(...) |
-| SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:153:22:153:34 | new String(...) |
+| SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] | SimpleXMLTests.java:146:22:146:34 | new String(...) |
+| SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] | SimpleXMLTests.java:153:22:153:34 | new String(...) |
 | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | TransformerTests.java:20:27:20:65 | new StreamSource(...) |
 | TransformerTests.java:21:40:21:60 | getInputStream(...) : InputStream | TransformerTests.java:21:23:21:61 | new StreamSource(...) |
 | TransformerTests.java:71:44:71:64 | getInputStream(...) : InputStream | TransformerTests.java:71:27:71:65 | new StreamSource(...) |
@@ -40,7 +56,8 @@ edges
 | TransformerTests.java:122:38:122:58 | getInputStream(...) : InputStream | TransformerTests.java:122:21:122:59 | new StreamSource(...) |
 | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) |
 | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) |
-| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) |
+| TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource | TransformerTests.java:141:18:141:70 | new SAXSource(...) |
+| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource |
 | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) |
 | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) |
 | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) |
@@ -58,10 +75,16 @@ nodes
 | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | semmle.label | getInputStream(...) |
+| DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| DocumentBuilderTests.java:94:16:94:21 | source : SAXSource | semmle.label | source : SAXSource |
 | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | semmle.label | getInputSource(...) |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | semmle.label | sourceToInputSource(...) |
+| DocumentBuilderTests.java:101:46:101:51 | source : StreamSource | semmle.label | source : StreamSource |
+| DocumentBuilderTests.java:102:16:102:21 | source : StreamSource | semmle.label | source : StreamSource |
 | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | semmle.label | getInputStream(...) |
@@ -79,6 +102,8 @@ nodes
 | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | semmle.label | getInputStream(...) |
+| SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SAXSourceTests.java:20:18:20:23 | source | semmle.label | source |
 | SchemaTests.java:12:39:12:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
@@ -96,8 +121,10 @@ nodes
 | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:31:41:31:53 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:38:41:38:53 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -114,12 +141,16 @@ nodes
 | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:90:37:90:49 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:97:37:97:49 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:104:26:104:38 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:111:26:111:38 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
@@ -131,8 +162,10 @@ nodes
 | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:146:22:146:34 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:153:22:153:34 | new String(...) | semmle.label | new String(...) |
 | TransformerTests.java:20:27:20:65 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -165,6 +198,7 @@ nodes
 | TransformerTests.java:136:21:136:59 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | TransformerTests.java:141:18:141:70 | new SAXSource(...) | semmle.label | new SAXSource(...) |
+| TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | semmle.label | getInputStream(...) |
 | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | semmle.label | new InputSource(...) |
diff --git a/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected b/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
index 0be574cad704..90e1b421f97f 100644
--- a/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
@@ -1,7 +1,15 @@
 edges
-| Test.java:11:28:11:36 | System.in : InputStream | Test.java:21:22:21:25 | data |
+| Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader | Test.java:12:26:12:39 | readerBuffered : BufferedReader |
+| Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader | Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader |
+| Test.java:11:28:11:36 | System.in : InputStream | Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader |
+| Test.java:12:26:12:39 | readerBuffered : BufferedReader | Test.java:12:26:12:50 | readLine(...) : String |
+| Test.java:12:26:12:50 | readLine(...) : String | Test.java:21:22:21:25 | data |
 nodes
+| Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | Test.java:11:28:11:36 | System.in : InputStream | semmle.label | System.in : InputStream |
+| Test.java:12:26:12:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| Test.java:12:26:12:50 | readLine(...) : String | semmle.label | readLine(...) : String |
 | Test.java:21:22:21:25 | data | semmle.label | data |
 #select
 | Test.java:21:17:21:25 | (...)... | Test.java:11:28:11:36 | System.in : InputStream | Test.java:21:22:21:25 | data | $@ flows to here and is cast to a narrower type, potentially causing truncation. | Test.java:11:28:11:36 | System.in | User-provided value |

From 579c9558929e8242b19174123f49e19617b15d1d Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Wed, 14 Apr 2021 13:37:30 +0200
Subject: [PATCH 313/433] Java: Adjust some tests.

---
 .../dataflow/external-models/steps.expected   | 16 +++++-----
 .../dataflow/external-models/steps.ql         | 17 ++++++-----
 .../localAdditionalTaintStep.ql               |  8 +++--
 .../apache-commons-lang3/ObjectUtilsTest.java | 30 +++++++++----------
 .../frameworks/guava/TestBase.java            |  4 +--
 5 files changed, 40 insertions(+), 35 deletions(-)

diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.expected b/java/ql/test/library-tests/dataflow/external-models/steps.expected
index f7e0c0fb23ed..02548a949c80 100644
--- a/java/ql/test/library-tests/dataflow/external-models/steps.expected
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.expected
@@ -1,10 +1,10 @@
 invalidModelRow
 #select
-| C.java:6:16:6:19 | arg1 | C.java:6:5:6:20 | stepArgRes(...) | qltest |
-| C.java:10:16:10:21 | argIn1 | C.java:10:24:10:30 | argOut1 [post update] | qltest |
-| C.java:13:16:13:21 | argIn2 | C.java:13:24:13:30 | argOut2 [post update] | qltest |
-| C.java:16:17:16:20 | arg2 | C.java:16:5:16:21 | this <.method> [post update] | qltest |
-| C.java:18:22:18:25 | arg3 | C.java:18:5:18:8 | this [post update] | qltest |
-| C.java:20:5:20:8 | this | C.java:20:5:20:22 | stepQualRes(...) | qltest |
-| C.java:21:5:21:17 | this <.method> | C.java:21:5:21:17 | stepQualRes(...) | qltest |
-| C.java:24:5:24:23 | this <.method> | C.java:24:17:24:22 | argOut [post update] | qltest |
+| C.java:6:16:6:19 | arg1 | C.java:6:5:6:20 | stepArgRes(...) |
+| C.java:10:16:10:21 | argIn1 | C.java:10:24:10:30 | argOut1 [post update] |
+| C.java:13:16:13:21 | argIn2 | C.java:13:24:13:30 | argOut2 [post update] |
+| C.java:16:17:16:20 | arg2 | C.java:16:5:16:21 | this <.method> [post update] |
+| C.java:18:22:18:25 | arg3 | C.java:18:5:18:8 | this [post update] |
+| C.java:20:5:20:8 | this | C.java:20:5:20:22 | stepQualRes(...) |
+| C.java:21:5:21:17 | this <.method> | C.java:21:5:21:17 | stepQualRes(...) |
+| C.java:24:5:24:23 | this <.method> | C.java:24:17:24:22 | argOut [post update] |
diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.ql b/java/ql/test/library-tests/dataflow/external-models/steps.ql
index 441d5eeca2b1..58edd018587e 100644
--- a/java/ql/test/library-tests/dataflow/external-models/steps.ql
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.ql
@@ -1,6 +1,7 @@
 import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.ExternalFlow
+import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 import CsvValidation
 
 class SummaryModelTest extends SummaryModelCsv {
@@ -8,15 +9,15 @@ class SummaryModelTest extends SummaryModelCsv {
     row =
       [
         //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
-        "my.qltest;C;false;stepArgRes;(Object);;Argument[0];ReturnValue;qltest",
-        "my.qltest;C;false;stepArgArg;(Object,Object);;Argument[0];Argument[1];qltest",
-        "my.qltest;C;false;stepArgQual;(Object);;Argument[0];Argument[-1];qltest",
-        "my.qltest;C;false;stepQualRes;();;Argument[-1];ReturnValue;qltest",
-        "my.qltest;C;false;stepQualArg;(Object);;Argument[-1];Argument[0];qltest"
+        "my.qltest;C;false;stepArgRes;(Object);;Argument[0];ReturnValue;taint",
+        "my.qltest;C;false;stepArgArg;(Object,Object);;Argument[0];Argument[1];taint",
+        "my.qltest;C;false;stepArgQual;(Object);;Argument[0];Argument[-1];taint",
+        "my.qltest;C;false;stepQualRes;();;Argument[-1];ReturnValue;taint",
+        "my.qltest;C;false;stepQualArg;(Object);;Argument[-1];Argument[0];taint"
       ]
   }
 }
 
-from DataFlow::Node node1, DataFlow::Node node2, string kind
-where summaryStep(node1, node2, kind)
-select node1, node2, kind
+from DataFlow::Node node1, DataFlow::Node node2
+where FlowSummaryImpl::Private::Steps::summaryThroughStep(node1, node2, false)
+select node1, node2
diff --git a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
index 41b5a413386c..1520ea7347d8 100644
--- a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
+++ b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
@@ -1,8 +1,12 @@
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.internal.TaintTrackingUtil
+import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 
 from DataFlow::Node src, DataFlow::Node sink
 where
-  localAdditionalTaintStep(src, sink) and
-  src.getLocation().getFile().getExtension() = "java"
+  (
+    localAdditionalTaintStep(src, sink) or
+    FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
+  ) and
+  not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
 select src, sink
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
index d586b887290c..58ee4d262e6e 100644
--- a/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
@@ -17,22 +17,22 @@ void test() throws Exception {
     sink(ObjectUtils.CONST_BYTE(IntSource.taint())); // $hasValueFlow
     sink(ObjectUtils.defaultIfNull(taint(), null)); // $hasValueFlow
     sink(ObjectUtils.defaultIfNull(null, taint())); // $hasValueFlow
-    sink(ObjectUtils.firstNonNull(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.firstNonNull(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.firstNonNull(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(null, null, taint())); // $ MISSING:hasValueFlow
     sink(ObjectUtils.getIfNull(taint(), null)); // $hasValueFlow
-    sink(ObjectUtils.max(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.max(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.max(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median((String)null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median((String)null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
+    sink(ObjectUtils.max(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.max(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.max(null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median((String)null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median((String)null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(null, null, taint())); // $ MISSING:hasValueFlow
     sink(ObjectUtils.requireNonEmpty(taint(), "message")); // $hasValueFlow
     sink(ObjectUtils.requireNonEmpty("not null", taint())); // GOOD (message doesn't propagate to the return)
     sink(ObjectUtils.toString(taint(), "default string")); // GOOD (first argument is stringified)
diff --git a/java/ql/test/library-tests/frameworks/guava/TestBase.java b/java/ql/test/library-tests/frameworks/guava/TestBase.java
index c2c3beecdf28..9ce907f45519 100644
--- a/java/ql/test/library-tests/frameworks/guava/TestBase.java
+++ b/java/ql/test/library-tests/frameworks/guava/TestBase.java
@@ -18,7 +18,7 @@ void test1() {
         sink(Strings.lenientFormat(x, 3)); // $numTaintFlow=1
         sink(Strings.commonPrefix(x, "abc")); 
         sink(Strings.commonSuffix(x, "cde")); 
-        sink(Strings.lenientFormat("%s = %s", x, 3)); // $numTaintFlow=1
+        sink(Strings.lenientFormat("%s = %s", x, 3)); // $ MISSING:numTaintFlow=1
     }
 
     void test2() {
@@ -60,4 +60,4 @@ void test3() {
     void test4() {
         sink(Preconditions.checkNotNull(taint())); // $numTaintFlow=1
     }
-}
\ No newline at end of file
+}

From 39862740e051d09d3e45af8b70afb8930709b02d Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Thu, 15 Apr 2021 16:12:40 +0200
Subject: [PATCH 314/433] Java: Convert support for fluent interfaces.

---
 .../java/dataflow/internal/DataFlowUtil.qll   |  8 ++++++
 .../dataflow/internal/TaintTrackingUtil.qll   | 26 -------------------
 2 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 2ad095740154..64e245e1c605 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -150,6 +150,14 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   )
   or
   FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2, true)
+  or
+  // If flow through a method updates a parameter from some input A, and that
+  // parameter also is returned through B, then we'd like a combined flow from A
+  // to B as well. As an example, this simplifies modeling of fluent methods:
+  // for `StringBuilder.append(x)` with a specified value flow from qualifier to
+  // return value and taint flow from argument 0 to the qualifier, then this
+  // allows the inferral of taint flow from argument 0 to the return value.
+  node1.(SummaryNode).(PostUpdateNode).getPreUpdateNode().(ParameterNode) = node2
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index d684ebb52756..9dc5d8f24b77 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -46,12 +46,6 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
  * different objects.
  */
 predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
-  localAdditionalBasicTaintStep(src, sink)
-  or
-  composedValueAndTaintModelStep(src, sink)
-}
-
-private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   localAdditionalTaintExprStep(src.asExpr(), sink.asExpr())
   or
   localAdditionalTaintUpdateStep(src.asExpr(),
@@ -67,26 +61,6 @@ private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::No
   not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, true)
 }
 
-/**
- * Holds if an additional step from `src` to `sink` through a call can be inferred from the
- * combination of a value-preserving step providing an alias between an input and the output
- * and a taint step from `src` to one the aliased nodes. For example, if we know that `f(a, b)` returns
- * the exact value of `a` and also propagates taint from `b` to `a`, then we also know that
- * the return value is tainted after `f` completes.
- */
-private predicate composedValueAndTaintModelStep(ArgumentNode src, DataFlow::Node sink) {
-  exists(Call call, ArgumentNode valueSource, DataFlow::PostUpdateNode valueSourcePost |
-    src.argumentOf(call, _) and
-    valueSource.argumentOf(call, _) and
-    src != valueSource and
-    valueSourcePost.getPreUpdateNode() = valueSource and
-    // in-x -value-> out-y and in-z -taint-> in-x ==> in-z -taint-> out-y
-    localAdditionalBasicTaintStep(src, valueSourcePost) and
-    DataFlow::localFlowStep(valueSource, DataFlow::exprNode(call)) and
-    sink = DataFlow::exprNode(call)
-  )
-}
-
 /**
  * Holds if the additional step from `src` to `sink` should be included in all
  * global taint flow configurations.

From 7d84cfacefe2682b414951fe1fbb48efa8d7ac8a Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Thu, 15 Apr 2021 16:22:51 +0200
Subject: [PATCH 315/433] Java: Add MapKeyContent and MapValueContent.

---
 .../semmle/code/java/dataflow/ExternalFlow.qll | 12 ++++++------
 .../java/dataflow/internal/DataFlowPrivate.qll | 18 ++++++++++++++----
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index c1ad6eb4ecf0..7d70017c6d89 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -460,7 +460,7 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, input, _, _) and pred = "summary"
     |
       specSplit(input, part, _) and
-      not part.regexpMatch("|ReturnValue|ArrayElement|Element") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element|MapKey|MapValue") and
       not (part = "Argument" and pred = "sink") and
       not parseArg(part, _) and
       msg = "Unrecognized input specification \"" + part + "\" in " + pred + " model."
@@ -472,7 +472,7 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, _, output, _) and pred = "summary"
     |
       specSplit(output, part, _) and
-      not part.regexpMatch("|ReturnValue|ArrayElement|Element") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element|MapKey|MapValue") and
       not (part = ["Argument", "Parameter"] and pred = "source") and
       not parseArg(part, _) and
       not parseParam(part, _) and
@@ -690,10 +690,10 @@ private SummaryComponent interpretComponent(string c) {
     c = "ArrayElement" and result = SummaryComponent::content(any(ArrayContent c0))
     or
     c = "Element" and result = SummaryComponent::content(any(CollectionContent c0))
-    // or
-    // c = "MapKey" and result = SummaryComponent::content(any(MapKeyContent c0))
-    // or
-    // c = "MapValue" and result = SummaryComponent::content(any(MapValueContent c0))
+    or
+    c = "MapKey" and result = SummaryComponent::content(any(MapKeyContent c0))
+    or
+    c = "MapValue" and result = SummaryComponent::content(any(MapValueContent c0))
   )
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
index c425eaa11857..23d84c10c9f5 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
@@ -84,8 +84,10 @@ private predicate instanceFieldAssign(Expr src, FieldAccess fa) {
 
 private newtype TContent =
   TFieldContent(InstanceField f) or
+  TArrayContent() or
   TCollectionContent() or
-  TArrayContent()
+  TMapKeyContent() or
+  TMapValueContent()
 
 /**
  * A reference contained in an object. Examples include instance fields, the
@@ -114,12 +116,20 @@ class FieldContent extends Content, TFieldContent {
   }
 }
 
+class ArrayContent extends Content, TArrayContent {
+  override string toString() { result = "[]" }
+}
+
 class CollectionContent extends Content, TCollectionContent {
-  override string toString() { result = "collection" }
+  override string toString() { result = "<element>" }
 }
 
-class ArrayContent extends Content, TArrayContent {
-  override string toString() { result = "array" }
+class MapKeyContent extends Content, TMapKeyContent {
+  override string toString() { result = "<map.key>" }
+}
+
+class MapValueContent extends Content, TMapValueContent {
+  override string toString() { result = "<map.value>" }
 }
 
 /**

From b2cb284ff273c8197209c25510ebff60e1ba1cbe Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 19 Apr 2021 14:56:20 +0200
Subject: [PATCH 316/433] Python: Add more examples of what is ok with new
 taint tests

---
 .../inline-taint-test-demo/InlineTaintTest.expected  |  6 ++++--
 .../meta/inline-taint-test-demo/taint_test.py        | 12 ++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
index 1b9dcc764beb..cb60ce493554 100644
--- a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
@@ -1,5 +1,7 @@
 argumentToEnsureNotTaintedNotMarkedAsSpurious
-| ERROR, you should add `SPURIOUS:` to this annotation | taint_test.py:36:9:36:29 | taint_test.py:36 | should_not_be_tainted |
+| ERROR, you should add `SPURIOUS:` to this annotation | taint_test.py:48:9:48:29 | taint_test.py:48 | should_not_be_tainted |
 untaintedArgumentToEnsureTaintedNotMarkedAsMissing
-| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:28:9:28:25 | taint_test.py:28 |
+| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:32:9:32:25 | taint_test.py:32 |
+| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:37:24:37:40 | taint_test.py:37 |
 failures
+| taint_test.py:41:20:41:21 | ts | Fixed missing result:tainted= |
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py b/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
index c5c64b05ff13..f25b61bcf3a0 100644
--- a/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/taint_test.py
@@ -9,6 +9,10 @@ def expected_usage():
         should_be_tainted, # $ MISSING: tainted
     )
 
+    # having one annotation for multiple arguments is OK, as long as all arguments
+    # fulfil the same annotation
+    ensure_tainted(ts, ts) # $ tainted
+
     # simulating handling something we _want_ to treat at untainted, but we currently treat as tainted
     should_not_be_tainted = "pretend this is now safe" + ts
     ensure_not_tainted(
@@ -28,6 +32,14 @@ def bad_usage():
         should_be_tainted,
     )
 
+    # using one annotation for multiple arguments i not OK when it's mixed whether our
+    # taint-tracking works as expected
+    ensure_tainted(ts, should_be_tainted) # $ tainted
+
+    # if you try to get around it by adding BOTH annotations, that results in a problem
+    # from the default set of inline-test-expectation rules
+    ensure_tainted(ts, should_be_tainted) # $ tainted MISSING: tainted
+
     # simulating handling something we _want_ to treat at untainted, but we currently treat as tainted
     should_not_be_tainted = "pretend this is now safe" + ts
 

From 9585390941d16c35c667665be3803d56d83f5844 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 19 Apr 2021 14:59:47 +0200
Subject: [PATCH 317/433] Python: Taint tests, report error location first

To better match the standard output from inline expectation tests
---
 python/ql/test/experimental/meta/InlineTaintTest.qll        | 4 ++--
 .../meta/inline-taint-test-demo/InlineTaintTest.expected    | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/python/ql/test/experimental/meta/InlineTaintTest.qll b/python/ql/test/experimental/meta/InlineTaintTest.qll
index b45029477d41..a5e5d14994f6 100644
--- a/python/ql/test/experimental/meta/InlineTaintTest.qll
+++ b/python/ql/test/experimental/meta/InlineTaintTest.qll
@@ -66,7 +66,7 @@ class InlineTaintTest extends InlineExpectationsTest {
 }
 
 query predicate argumentToEnsureNotTaintedNotMarkedAsSpurious(
-  string error, Location location, string element
+  Location location, string error, string element
 ) {
   error = "ERROR, you should add `SPURIOUS:` to this annotation" and
   location = shouldNotBeTainted().getLocation() and
@@ -78,7 +78,7 @@ query predicate argumentToEnsureNotTaintedNotMarkedAsSpurious(
   )
 }
 
-query predicate untaintedArgumentToEnsureTaintedNotMarkedAsMissing(string error, Location location) {
+query predicate untaintedArgumentToEnsureTaintedNotMarkedAsMissing(Location location, string error) {
   error = "ERROR, you should add `# $ MISSING: tainted` annotation" and
   exists(DataFlow::Node sink |
     sink = shouldBeTainted() and
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
index cb60ce493554..a547545f38a7 100644
--- a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
@@ -1,7 +1,7 @@
 argumentToEnsureNotTaintedNotMarkedAsSpurious
-| ERROR, you should add `SPURIOUS:` to this annotation | taint_test.py:48:9:48:29 | taint_test.py:48 | should_not_be_tainted |
+| taint_test.py:48:9:48:29 | taint_test.py:48 | ERROR, you should add `SPURIOUS:` to this annotation | should_not_be_tainted |
 untaintedArgumentToEnsureTaintedNotMarkedAsMissing
-| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:32:9:32:25 | taint_test.py:32 |
-| ERROR, you should add `# $ MISSING: tainted` annotation | taint_test.py:37:24:37:40 | taint_test.py:37 |
+| taint_test.py:32:9:32:25 | taint_test.py:32 | ERROR, you should add `# $ MISSING: tainted` annotation |
+| taint_test.py:37:24:37:40 | taint_test.py:37 | ERROR, you should add `# $ MISSING: tainted` annotation |
 failures
 | taint_test.py:41:20:41:21 | ts | Fixed missing result:tainted= |

From d607c13ab61a7de905c6ebc91c27644c553b259a Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 19 Apr 2021 15:01:10 +0200
Subject: [PATCH 318/433] Python: Taint tests: include elment for forgotten
 MISSING

---
 python/ql/test/experimental/meta/InlineTaintTest.qll         | 5 ++++-
 .../meta/inline-taint-test-demo/InlineTaintTest.expected     | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python/ql/test/experimental/meta/InlineTaintTest.qll b/python/ql/test/experimental/meta/InlineTaintTest.qll
index a5e5d14994f6..dd0865adc4b4 100644
--- a/python/ql/test/experimental/meta/InlineTaintTest.qll
+++ b/python/ql/test/experimental/meta/InlineTaintTest.qll
@@ -78,10 +78,13 @@ query predicate argumentToEnsureNotTaintedNotMarkedAsSpurious(
   )
 }
 
-query predicate untaintedArgumentToEnsureTaintedNotMarkedAsMissing(Location location, string error) {
+query predicate untaintedArgumentToEnsureTaintedNotMarkedAsMissing(
+  Location location, string error, string element
+) {
   error = "ERROR, you should add `# $ MISSING: tainted` annotation" and
   exists(DataFlow::Node sink |
     sink = shouldBeTainted() and
+    element = prettyExp(sink.asExpr()) and
     not any(TestTaintTrackingConfiguration config).hasFlow(_, sink) and
     location = sink.getLocation() and
     not exists(FalseNegativeExpectation missingResult |
diff --git a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
index a547545f38a7..745561a5e655 100644
--- a/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
+++ b/python/ql/test/experimental/meta/inline-taint-test-demo/InlineTaintTest.expected
@@ -1,7 +1,7 @@
 argumentToEnsureNotTaintedNotMarkedAsSpurious
 | taint_test.py:48:9:48:29 | taint_test.py:48 | ERROR, you should add `SPURIOUS:` to this annotation | should_not_be_tainted |
 untaintedArgumentToEnsureTaintedNotMarkedAsMissing
-| taint_test.py:32:9:32:25 | taint_test.py:32 | ERROR, you should add `# $ MISSING: tainted` annotation |
-| taint_test.py:37:24:37:40 | taint_test.py:37 | ERROR, you should add `# $ MISSING: tainted` annotation |
+| taint_test.py:32:9:32:25 | taint_test.py:32 | ERROR, you should add `# $ MISSING: tainted` annotation | should_be_tainted |
+| taint_test.py:37:24:37:40 | taint_test.py:37 | ERROR, you should add `# $ MISSING: tainted` annotation | should_be_tainted |
 failures
 | taint_test.py:41:20:41:21 | ts | Fixed missing result:tainted= |

From 15e4b7f95d68d56c4ffef29111f5b69e16219e39 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 19 Apr 2021 13:34:02 +0200
Subject: [PATCH 319/433] C#: Remove CP from
 `HardcodedCredentials::getCredentialSink`

---
 .../dataflow/HardcodedCredentials.qll         | 37 ++++++++++++-------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/security/dataflow/HardcodedCredentials.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/HardcodedCredentials.qll
index 4538f09e2c0b..0ffabe60588b 100644
--- a/csharp/ql/src/semmle/code/csharp/security/dataflow/HardcodedCredentials.qll
+++ b/csharp/ql/src/semmle/code/csharp/security/dataflow/HardcodedCredentials.qll
@@ -111,13 +111,24 @@ module HardcodedCredentials {
   }
 
   /**
-   * Gets a regular expression for matching names of locations (variables, parameters, keys) that
-   * indicate the value being held is a credential.
+   * An assignable whose name indicates that the value being held is a credential.
    */
-  private string getACredentialRegex() {
-    result = "(?i).*pass(wd|word|code|phrase)(?!.*question).*" or
-    result = "(?i).*(puid|username|userid).*" or
-    result = "(?i).*(cert)(?!.*(format|name)).*"
+  private class CredentialVar extends Assignable {
+    pragma[noinline]
+    CredentialVar() {
+      exists(string name | name = this.getName() |
+        name.regexpMatch("(?i).*pass(wd|word|code|phrase)(?!.*question).*")
+        or
+        name.regexpMatch("(?i).*(puid|username|userid).*")
+        or
+        name.regexpMatch("(?i).*(cert)(?!.*(format|name)).*")
+      )
+    }
+  }
+
+  private class CredentialVariableAccess extends VariableAccess {
+    pragma[noinline]
+    CredentialVariableAccess() { this.getTarget() instanceof CredentialVar }
   }
 
   /**
@@ -128,11 +139,11 @@ module HardcodedCredentials {
   ) {
     // An argument to a library call that looks like a credential
     // "...flows to the [Username] parameter in [call to method CreateUser]"
-    exists(Call call |
+    exists(Call call, CredentialVar param |
       supplementaryElement = call and
       description = "the $@ parameter in $@" and
-      sink = call.getArgumentForName(sinkName) and
-      sinkName.regexpMatch(getACredentialRegex()) and
+      sink = call.getArgumentForParameter(param) and
+      sinkName = param.getName() and
       call.getTarget().fromLibrary()
     )
     or
@@ -144,22 +155,20 @@ module HardcodedCredentials {
       description = "the $@ in $@" and
       sink = call.getArgument(0) and
       sinkName = "setter call argument" and
-      p.getName().regexpMatch(getACredentialRegex()) and
+      p instanceof CredentialVar and
       p.fromLibrary()
     )
     or
     // Sink compared to password variable
     // "...flows to [] which is compared against [access of UserName]"
-    exists(ComparisonTest ct, VariableAccess credentialAccess, string varName |
+    exists(ComparisonTest ct, CredentialVariableAccess credentialAccess |
       sinkName = sink.toString() and
       supplementaryElement = credentialAccess and
       description = "$@ which is compared against $@" and
       ct.getAnArgument() = credentialAccess and
       ct.getAnArgument() = sink and
       ct.getComparisonKind().isEquality() and
-      not sink = credentialAccess and
-      varName = credentialAccess.getTarget().getName() and
-      varName.regexpMatch(getACredentialRegex())
+      not sink = credentialAccess
     )
   }
 

From 80eb0a2df680c52929241d30a6d4223b5c97a0d9 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
Date: Mon, 19 Apr 2021 15:45:58 +0200
Subject: [PATCH 320/433] Apply suggestions from code review

Co-authored-by: Chris Smowton <smowton@github.com>
---
 java/ql/src/semmle/code/java/dataflow/FlowSummary.qll           | 2 +-
 java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
index e53a4fc56303..0f222d5caa23 100644
--- a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
@@ -7,7 +7,7 @@ private import internal.FlowSummaryImpl as Impl
 private import internal.DataFlowDispatch
 private import internal.DataFlowPrivate
 
-// import all instances below
+// import all instances of SummarizedCallable below
 private module Summaries {
   private import semmle.code.java.dataflow.ExternalFlow
 }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 64e245e1c605..47743caf6688 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -156,7 +156,7 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   // to B as well. As an example, this simplifies modeling of fluent methods:
   // for `StringBuilder.append(x)` with a specified value flow from qualifier to
   // return value and taint flow from argument 0 to the qualifier, then this
-  // allows the inferral of taint flow from argument 0 to the return value.
+  // allows us to infer taint flow from argument 0 to the return value.
   node1.(SummaryNode).(PostUpdateNode).getPreUpdateNode().(ParameterNode) = node2
 }
 

From 9128ec72ad6ce2b22fa6467fc5c5800ae97417e2 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 19 Apr 2021 12:51:28 +0200
Subject: [PATCH 321/433] C#: A few minor SSA performance tweaks

---
 .../code/cil/internal/SsaImplCommon.qll       | 42 +++++++++++++------
 .../internal/pressa/SsaImplCommon.qll         | 42 +++++++++++++------
 .../dataflow/internal/SsaImplCommon.qll       | 42 +++++++++++++------
 .../internal/basessa/SsaImplCommon.qll        | 42 +++++++++++++------
 4 files changed, 120 insertions(+), 48 deletions(-)

diff --git a/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll
index f828419a4409..f37a4f2d074a 100644
--- a/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll
@@ -316,6 +316,15 @@ private module SsaDefReaches {
     )
   }
 
+  /**
+   * Holds if the reference to `def` at index `i` in basic block `bb` is the
+   * last reference to `v` inside `bb`.
+   */
+  pragma[noinline]
+  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
+    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
+  }
+
   predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
     exists(ssaDefRank(def, v, bb, _, _))
   }
@@ -351,8 +360,7 @@ private module SsaDefReaches {
    */
   predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
     varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-    variableRead(bb2, i2, _, _)
+    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1
   }
 }
 
@@ -434,15 +442,22 @@ predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2
     bb2 = bb1
   )
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+  lastSsaRef(def, _, bb1, i1) and
   defAdjacentRead(def, bb1, bb2, i2)
 }
 
+pragma[noinline]
+private predicate adjacentDefRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
+) {
+  adjacentDefRead(def, bb1, i1, bb2, i2) and
+  v = def.getSourceVariable()
+}
+
 private predicate adjacentDefReachesRead(
   Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
 ) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  exists(SourceVariable v | v = def.getSourceVariable() |
+  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
     ssaRef(bb1, i1, v, SsaDef())
     or
     variableRead(bb1, i1, v, true)
@@ -475,17 +490,19 @@ predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, Ba
  */
 pragma[nomagic]
 predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+  exists(SourceVariable v |
     // Next reference to `v` inside `bb` is a write
-    next.definesAt(v, bb, j) and
-    rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    exists(int rnk, int j |
+      rnk = ssaDefRank(def, v, bb, i, _) and
+      next.definesAt(v, bb, j) and
+      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    )
     or
     // Can reach a write using one or more steps
-    rnk = maxSsaRefRank(bb, v) and
+    lastSsaRef(def, v, bb, i) and
     exists(BasicBlock bb2 |
       varBlockReaches(def, bb, bb2) and
-      next.definesAt(v, bb2, j) and
-      1 = ssaRefRank(bb2, j, v, SsaDef())
+      1 = ssaDefRank(next, v, bb2, _, SsaDef())
     )
   )
 }
@@ -539,7 +556,8 @@ pragma[nomagic]
 predicate lastRef(Definition def, BasicBlock bb, int i) {
   lastRefRedef(def, bb, i, _)
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+  lastSsaRef(def, _, bb, i) and
+  (
     // Can reach exit directly
     bb instanceof ExitBasicBlock
     or
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
index f828419a4409..f37a4f2d074a 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
@@ -316,6 +316,15 @@ private module SsaDefReaches {
     )
   }
 
+  /**
+   * Holds if the reference to `def` at index `i` in basic block `bb` is the
+   * last reference to `v` inside `bb`.
+   */
+  pragma[noinline]
+  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
+    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
+  }
+
   predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
     exists(ssaDefRank(def, v, bb, _, _))
   }
@@ -351,8 +360,7 @@ private module SsaDefReaches {
    */
   predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
     varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-    variableRead(bb2, i2, _, _)
+    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1
   }
 }
 
@@ -434,15 +442,22 @@ predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2
     bb2 = bb1
   )
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+  lastSsaRef(def, _, bb1, i1) and
   defAdjacentRead(def, bb1, bb2, i2)
 }
 
+pragma[noinline]
+private predicate adjacentDefRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
+) {
+  adjacentDefRead(def, bb1, i1, bb2, i2) and
+  v = def.getSourceVariable()
+}
+
 private predicate adjacentDefReachesRead(
   Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
 ) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  exists(SourceVariable v | v = def.getSourceVariable() |
+  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
     ssaRef(bb1, i1, v, SsaDef())
     or
     variableRead(bb1, i1, v, true)
@@ -475,17 +490,19 @@ predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, Ba
  */
 pragma[nomagic]
 predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+  exists(SourceVariable v |
     // Next reference to `v` inside `bb` is a write
-    next.definesAt(v, bb, j) and
-    rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    exists(int rnk, int j |
+      rnk = ssaDefRank(def, v, bb, i, _) and
+      next.definesAt(v, bb, j) and
+      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    )
     or
     // Can reach a write using one or more steps
-    rnk = maxSsaRefRank(bb, v) and
+    lastSsaRef(def, v, bb, i) and
     exists(BasicBlock bb2 |
       varBlockReaches(def, bb, bb2) and
-      next.definesAt(v, bb2, j) and
-      1 = ssaRefRank(bb2, j, v, SsaDef())
+      1 = ssaDefRank(next, v, bb2, _, SsaDef())
     )
   )
 }
@@ -539,7 +556,8 @@ pragma[nomagic]
 predicate lastRef(Definition def, BasicBlock bb, int i) {
   lastRefRedef(def, bb, i, _)
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+  lastSsaRef(def, _, bb, i) and
+  (
     // Can reach exit directly
     bb instanceof ExitBasicBlock
     or
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
index f828419a4409..f37a4f2d074a 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -316,6 +316,15 @@ private module SsaDefReaches {
     )
   }
 
+  /**
+   * Holds if the reference to `def` at index `i` in basic block `bb` is the
+   * last reference to `v` inside `bb`.
+   */
+  pragma[noinline]
+  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
+    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
+  }
+
   predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
     exists(ssaDefRank(def, v, bb, _, _))
   }
@@ -351,8 +360,7 @@ private module SsaDefReaches {
    */
   predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
     varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-    variableRead(bb2, i2, _, _)
+    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1
   }
 }
 
@@ -434,15 +442,22 @@ predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2
     bb2 = bb1
   )
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+  lastSsaRef(def, _, bb1, i1) and
   defAdjacentRead(def, bb1, bb2, i2)
 }
 
+pragma[noinline]
+private predicate adjacentDefRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
+) {
+  adjacentDefRead(def, bb1, i1, bb2, i2) and
+  v = def.getSourceVariable()
+}
+
 private predicate adjacentDefReachesRead(
   Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
 ) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  exists(SourceVariable v | v = def.getSourceVariable() |
+  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
     ssaRef(bb1, i1, v, SsaDef())
     or
     variableRead(bb1, i1, v, true)
@@ -475,17 +490,19 @@ predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, Ba
  */
 pragma[nomagic]
 predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+  exists(SourceVariable v |
     // Next reference to `v` inside `bb` is a write
-    next.definesAt(v, bb, j) and
-    rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    exists(int rnk, int j |
+      rnk = ssaDefRank(def, v, bb, i, _) and
+      next.definesAt(v, bb, j) and
+      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    )
     or
     // Can reach a write using one or more steps
-    rnk = maxSsaRefRank(bb, v) and
+    lastSsaRef(def, v, bb, i) and
     exists(BasicBlock bb2 |
       varBlockReaches(def, bb, bb2) and
-      next.definesAt(v, bb2, j) and
-      1 = ssaRefRank(bb2, j, v, SsaDef())
+      1 = ssaDefRank(next, v, bb2, _, SsaDef())
     )
   )
 }
@@ -539,7 +556,8 @@ pragma[nomagic]
 predicate lastRef(Definition def, BasicBlock bb, int i) {
   lastRefRedef(def, bb, i, _)
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+  lastSsaRef(def, _, bb, i) and
+  (
     // Can reach exit directly
     bb instanceof ExitBasicBlock
     or
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
index f828419a4409..f37a4f2d074a 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
@@ -316,6 +316,15 @@ private module SsaDefReaches {
     )
   }
 
+  /**
+   * Holds if the reference to `def` at index `i` in basic block `bb` is the
+   * last reference to `v` inside `bb`.
+   */
+  pragma[noinline]
+  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
+    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
+  }
+
   predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
     exists(ssaDefRank(def, v, bb, _, _))
   }
@@ -351,8 +360,7 @@ private module SsaDefReaches {
    */
   predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
     varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-    variableRead(bb2, i2, _, _)
+    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1
   }
 }
 
@@ -434,15 +442,22 @@ predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2
     bb2 = bb1
   )
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+  lastSsaRef(def, _, bb1, i1) and
   defAdjacentRead(def, bb1, bb2, i2)
 }
 
+pragma[noinline]
+private predicate adjacentDefRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
+) {
+  adjacentDefRead(def, bb1, i1, bb2, i2) and
+  v = def.getSourceVariable()
+}
+
 private predicate adjacentDefReachesRead(
   Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
 ) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  exists(SourceVariable v | v = def.getSourceVariable() |
+  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
     ssaRef(bb1, i1, v, SsaDef())
     or
     variableRead(bb1, i1, v, true)
@@ -475,17 +490,19 @@ predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, Ba
  */
 pragma[nomagic]
 predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+  exists(SourceVariable v |
     // Next reference to `v` inside `bb` is a write
-    next.definesAt(v, bb, j) and
-    rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    exists(int rnk, int j |
+      rnk = ssaDefRank(def, v, bb, i, _) and
+      next.definesAt(v, bb, j) and
+      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    )
     or
     // Can reach a write using one or more steps
-    rnk = maxSsaRefRank(bb, v) and
+    lastSsaRef(def, v, bb, i) and
     exists(BasicBlock bb2 |
       varBlockReaches(def, bb, bb2) and
-      next.definesAt(v, bb2, j) and
-      1 = ssaRefRank(bb2, j, v, SsaDef())
+      1 = ssaDefRank(next, v, bb2, _, SsaDef())
     )
   )
 }
@@ -539,7 +556,8 @@ pragma[nomagic]
 predicate lastRef(Definition def, BasicBlock bb, int i) {
   lastRefRedef(def, bb, i, _)
   or
-  exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+  lastSsaRef(def, _, bb, i) and
+  (
     // Can reach exit directly
     bb instanceof ExitBasicBlock
     or

From bc6685aa3f3f7cd2a6c9c3ace67e1466016070e4 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@gmail.com>
Date: Mon, 19 Apr 2021 19:57:35 +0200
Subject: [PATCH 322/433] Python: Fix typo

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/src/semmle/python/frameworks/Django.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 4c9bbddd4744..23c0a814a7a8 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -646,7 +646,7 @@ private module PrivateDjango {
             result = http().getMember("HttpResponseRedirect")
           }
 
-          /** Gets a reference a subclass of the `django.http.response.HttpResponseRedirect` class. */
+          /** Gets a reference to a subclass of the `django.http.response.HttpResponseRedirect` class. */
           API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**

From 87cd72496c40debd31d754bbfdfb7584a9dfb67a Mon Sep 17 00:00:00 2001
From: yo-h <55373593+yo-h@users.noreply.github.com>
Date: Mon, 19 Apr 2021 14:58:56 -0400
Subject: [PATCH 323/433] Java: add extractor `diagnostic` queries

---
 .../src/Diagnostics/DiagnosticsReporting.qll  | 70 +++++++++++++++++++
 java/ql/src/Diagnostics/ExtractionErrors.ql   | 13 ++++
 .../Diagnostics/SuccessfullyExtractedFiles.ql | 14 ++++
 3 files changed, 97 insertions(+)
 create mode 100644 java/ql/src/Diagnostics/DiagnosticsReporting.qll
 create mode 100644 java/ql/src/Diagnostics/ExtractionErrors.ql
 create mode 100644 java/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql

diff --git a/java/ql/src/Diagnostics/DiagnosticsReporting.qll b/java/ql/src/Diagnostics/DiagnosticsReporting.qll
new file mode 100644
index 000000000000..76ce4cdfd500
--- /dev/null
+++ b/java/ql/src/Diagnostics/DiagnosticsReporting.qll
@@ -0,0 +1,70 @@
+/**
+ * Provides classes and predicates for reporting extractor diagnostics to end users.
+ */
+
+import java
+
+/** Gets the SARIF severity level that indicates an error. */
+private int getErrorSeverity() { result = 2 }
+
+/** Gets the SARIF severity level that indicates a warning. */
+private int getWarnSeverity() { result = 1 }
+
+private predicate knownWarnings(@diagnostic d, string msg, int sev) {
+  exists(string filename |
+    diagnostics(d, 2, _, "Skipping Lombok-ed source file: " + filename, _, _) and
+    msg = "Use of Lombok detected. Skipping file: " + filename and
+    sev = getWarnSeverity()
+  )
+}
+
+private predicate knownErrors(@diagnostic d, string msg, int sev) {
+  exists(string numErr, Location l |
+    diagnostics(d, 6, _, numErr, _, l) and
+    msg = "Frontend errors in file: " + l.getFile().getAbsolutePath() + " (" + numErr + ")" and
+    sev = getErrorSeverity()
+  )
+  or
+  exists(string filename, Location l |
+    diagnostics(d, 7, _, "Exception compiling file " + filename, _, l) and
+    msg = "Extraction incomplete in file: " + filename and
+    sev = getErrorSeverity()
+  )
+  or
+  exists(string errMsg, Location l |
+    diagnostics(d, 8, _, errMsg, _, l) and
+    msg = "Severe error: " + errMsg and
+    sev = getErrorSeverity()
+  )
+}
+
+private predicate unknownErrors(@diagnostic d, string msg, int sev) {
+  not knownErrors(d, _, _) and
+  exists(Location l, File f, int diagSev |
+    diagnostics(d, diagSev, _, _, _, l) and l.getFile() = f and diagSev > 3
+  |
+    exists(f.getRelativePath()) and
+    msg = "Unknown errors in file: " + f.getAbsolutePath() + " (" + diagSev + ")" and
+    sev = getErrorSeverity()
+  )
+}
+
+/**
+ * Holds if an extraction error or warning occurred that should be reported to end users,
+ * with the error message `msg` and SARIF severity `sev`.
+ */
+predicate reportableDiagnostics(@diagnostic d, string msg, int sev) {
+  knownWarnings(d, msg, sev) or knownErrors(d, msg, sev) or unknownErrors(d, msg, sev)
+}
+
+/**
+ * Holds if compilation unit `f` is a source file that has
+ * no relevant extraction diagnostics associated with it.
+ */
+predicate successfullyExtracted(CompilationUnit f) {
+  not exists(@diagnostic d, Location l |
+    reportableDiagnostics(d, _, _) and diagnostics(d, _, _, _, _, l) and l.getFile() = f
+  ) and
+  exists(f.getRelativePath()) and
+  f.fromSource()
+}
diff --git a/java/ql/src/Diagnostics/ExtractionErrors.ql b/java/ql/src/Diagnostics/ExtractionErrors.ql
new file mode 100644
index 000000000000..8b045df256e0
--- /dev/null
+++ b/java/ql/src/Diagnostics/ExtractionErrors.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Extraction errors
+ * @description A list of extraction errors for files in the source code directory.
+ * @kind diagnostic
+ * @id java/diagnostics/extraction-errors
+ */
+
+import java
+import DiagnosticsReporting
+
+from string msg, int sev
+where reportableDiagnostics(_, msg, sev)
+select msg, sev
diff --git a/java/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql b/java/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
new file mode 100644
index 000000000000..161c9f17e42b
--- /dev/null
+++ b/java/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Successfully extracted files
+ * @description A list of all files in the source code directory that
+ *              were extracted without encountering an error in the file.
+ * @kind diagnostic
+ * @id java/diagnostics/successfully-extracted-files
+ */
+
+import java
+import DiagnosticsReporting
+
+from CompilationUnit f
+where successfullyExtracted(f)
+select f, ""

From 408954e4d8d8155720e4588cde9f96c9af572366 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tam=C3=A1s=20Vajk?= <tamasvajk@github.com>
Date: Tue, 20 Apr 2021 09:30:47 +0200
Subject: [PATCH 324/433] C#: Add Dapper to supported frameworks

---
 docs/codeql/support/reusables/frameworks.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/codeql/support/reusables/frameworks.rst b/docs/codeql/support/reusables/frameworks.rst
index 22569cbdcc66..2dfebad49194 100644
--- a/docs/codeql/support/reusables/frameworks.rst
+++ b/docs/codeql/support/reusables/frameworks.rst
@@ -28,6 +28,7 @@ C# built-in support
    Json.NET, Serialization
    NHibernate, Database ORM
    WinForms, User interface
+   Dapper, Database ORM
 
 Go built-in support
 ================================

From 61d4d17225f14af4d8ccc053e518aa5a3f94ad76 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 20 Apr 2021 09:57:58 +0200
Subject: [PATCH 325/433] C++: Simplify smart pointer model and accept test
 changes.

---
 .../models/implementations/SmartPointer.qll   | 14 ++++++------
 .../dataflow/taint-tests/localTaint.expected  | 22 +++++++++----------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index 4b060c234f89..adef44a1125b 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -18,20 +18,20 @@ private class UniqueOrSharedPtr extends Class, PointerWrapper {
 }
 
 /** Any function that unwraps a pointer wrapper class to reveal the underlying pointer. */
-private class PointerWrapperDataFlow extends DataFlowFunction {
-  PointerWrapperDataFlow() {
+private class PointerWrapperFlow extends TaintFunction, DataFlowFunction {
+  PointerWrapperFlow() {
     this = any(PointerWrapper wrapper).getAnUnwrapperFunction() and
     not this.getUnspecifiedType() instanceof ReferenceType
   }
 
-  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierAddress() and output.isReturnValue()
-    or
-    input.isQualifierObject() and output.isReturnValueDeref()
-    or
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isReturnValueDeref() and
     output.isQualifierObject()
   }
+
+  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and output.isReturnValue()
+  }
 }
 
 /**
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 59ba0948d858..b003dc5a12bc 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3275,11 +3275,11 @@
 | smart_pointer.cpp:51:30:51:50 | call to make_shared | smart_pointer.cpp:52:10:52:10 | p |  |
 | smart_pointer.cpp:51:52:51:57 | call to source | smart_pointer.cpp:51:30:51:50 | call to make_shared | TAINT |
 | smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get |  |
-| smart_pointer.cpp:52:12:52:14 | ref arg call to get | smart_pointer.cpp:52:10:52:10 | ref arg p |  |
+| smart_pointer.cpp:52:12:52:14 | ref arg call to get | smart_pointer.cpp:52:10:52:10 | ref arg p | TAINT |
 | smart_pointer.cpp:56:30:56:50 | call to make_unique | smart_pointer.cpp:57:10:57:10 | p |  |
 | smart_pointer.cpp:56:52:56:57 | call to source | smart_pointer.cpp:56:30:56:50 | call to make_unique | TAINT |
 | smart_pointer.cpp:57:10:57:10 | p | smart_pointer.cpp:57:12:57:14 | call to get |  |
-| smart_pointer.cpp:57:12:57:14 | ref arg call to get | smart_pointer.cpp:57:10:57:10 | ref arg p |  |
+| smart_pointer.cpp:57:12:57:14 | ref arg call to get | smart_pointer.cpp:57:10:57:10 | ref arg p | TAINT |
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:66:10:66:10 | p |  |
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:67:10:67:10 | p |  |
 | smart_pointer.cpp:65:48:65:53 | call to source | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
@@ -3319,7 +3319,7 @@
 | smart_pointer.cpp:87:3:87:3 | ref arg p | smart_pointer.cpp:89:8:89:8 | p |  |
 | smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:87:6:87:6 | x [post update] |  |
 | smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:88:11:88:11 | x |  |
-| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:87:3:87:3 | ref arg p |  |
+| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:87:3:87:3 | ref arg p | TAINT |
 | smart_pointer.cpp:87:10:87:15 | call to source | smart_pointer.cpp:87:3:87:17 | ... = ... |  |
 | smart_pointer.cpp:88:8:88:8 | p | smart_pointer.cpp:88:9:88:9 | call to operator-> |  |
 | smart_pointer.cpp:88:8:88:8 | ref arg p | smart_pointer.cpp:86:45:86:45 | p |  |
@@ -3333,7 +3333,7 @@
 | smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:94:8:94:8 | q |  |
 | smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:91:9:91:9 | x [post update] |  |
 | smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:92:14:92:14 | x |  |
-| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:91:3:91:3 | ref arg q |  |
+| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:91:3:91:3 | ref arg q | TAINT |
 | smart_pointer.cpp:91:13:91:18 | call to source | smart_pointer.cpp:91:3:91:20 | ... = ... |  |
 | smart_pointer.cpp:92:8:92:8 | q | smart_pointer.cpp:92:9:92:9 | call to operator-> |  |
 | smart_pointer.cpp:92:8:92:8 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
@@ -3351,21 +3351,21 @@
 | smart_pointer.cpp:102:25:102:50 | call to unique_ptr | smart_pointer.cpp:104:8:104:8 | p |  |
 | smart_pointer.cpp:103:11:103:11 | p | smart_pointer.cpp:103:13:103:15 | call to get |  |
 | smart_pointer.cpp:103:11:103:11 | ref arg p | smart_pointer.cpp:104:8:104:8 | p |  |
-| smart_pointer.cpp:103:13:103:15 | ref arg call to get | smart_pointer.cpp:103:11:103:11 | ref arg p |  |
+| smart_pointer.cpp:103:13:103:15 | ref arg call to get | smart_pointer.cpp:103:11:103:11 | ref arg p | TAINT |
 | smart_pointer.cpp:104:8:104:8 | p | smart_pointer.cpp:104:9:104:9 | call to operator-> |  |
 | smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
 | smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:113:2:113:4 | ptr |  |
 | smart_pointer.cpp:113:2:113:4 | ptr | smart_pointer.cpp:113:5:113:5 | call to operator-> |  |
 | smart_pointer.cpp:113:2:113:4 | ref arg ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
 | smart_pointer.cpp:113:2:113:18 | ... = ... | smart_pointer.cpp:113:7:113:7 | x [post update] |  |
-| smart_pointer.cpp:113:5:113:5 | call to operator-> [post update] | smart_pointer.cpp:113:2:113:4 | ref arg ptr |  |
+| smart_pointer.cpp:113:5:113:5 | call to operator-> [post update] | smart_pointer.cpp:113:2:113:4 | ref arg ptr | TAINT |
 | smart_pointer.cpp:113:11:113:16 | call to source | smart_pointer.cpp:113:2:113:18 | ... = ... |  |
 | smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
 | smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:117:2:117:4 | ptr |  |
 | smart_pointer.cpp:117:2:117:4 | ptr | smart_pointer.cpp:117:5:117:5 | call to operator-> |  |
 | smart_pointer.cpp:117:2:117:4 | ref arg ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
 | smart_pointer.cpp:117:2:117:18 | ... = ... | smart_pointer.cpp:117:7:117:7 | x [post update] |  |
-| smart_pointer.cpp:117:5:117:5 | call to operator-> [post update] | smart_pointer.cpp:117:2:117:4 | ref arg ptr |  |
+| smart_pointer.cpp:117:5:117:5 | call to operator-> [post update] | smart_pointer.cpp:117:2:117:4 | ref arg ptr | TAINT |
 | smart_pointer.cpp:117:11:117:16 | call to source | smart_pointer.cpp:117:2:117:18 | ... = ... |  |
 | smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:121:4:121:6 | ptr |  |
@@ -3386,12 +3386,12 @@
 | smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
 | smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:126:8:126:9 | p1 |  |
 | smart_pointer.cpp:125:18:125:22 | ref arg call to shared_ptr | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
-| smart_pointer.cpp:125:20:125:20 | call to operator-> [post update] | smart_pointer.cpp:125:18:125:19 | ref arg p1 |  |
+| smart_pointer.cpp:125:20:125:20 | call to operator-> [post update] | smart_pointer.cpp:125:18:125:19 | ref arg p1 | TAINT |
 | smart_pointer.cpp:125:22:125:22 | q | smart_pointer.cpp:125:18:125:22 | call to shared_ptr |  |
 | smart_pointer.cpp:125:22:125:22 | ref arg q | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
 | smart_pointer.cpp:126:8:126:9 | p1 | smart_pointer.cpp:126:10:126:10 | call to operator-> |  |
 | smart_pointer.cpp:126:8:126:9 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
-| smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 |  |
+| smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 | TAINT |
 | smart_pointer.cpp:126:12:126:12 | q | smart_pointer.cpp:126:13:126:13 | call to operator-> |  |
 | smart_pointer.cpp:128:13:128:13 | call to operator* | smart_pointer.cpp:128:13:128:15 | call to shared_ptr | TAINT |
 | smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
@@ -3422,10 +3422,10 @@
 | smart_pointer.cpp:133:23:133:24 | p1 | smart_pointer.cpp:133:25:133:25 | call to operator-> |  |
 | smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
 | smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
-| smart_pointer.cpp:133:25:133:25 | call to operator-> [post update] | smart_pointer.cpp:133:23:133:24 | ref arg p1 |  |
+| smart_pointer.cpp:133:25:133:25 | call to operator-> [post update] | smart_pointer.cpp:133:23:133:24 | ref arg p1 | TAINT |
 | smart_pointer.cpp:134:8:134:9 | p1 | smart_pointer.cpp:134:10:134:10 | call to operator-> |  |
 | smart_pointer.cpp:134:8:134:9 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
-| smart_pointer.cpp:134:10:134:10 | call to operator-> [post update] | smart_pointer.cpp:134:8:134:9 | ref arg p1 |  |
+| smart_pointer.cpp:134:10:134:10 | call to operator-> [post update] | smart_pointer.cpp:134:8:134:9 | ref arg p1 | TAINT |
 | smart_pointer.cpp:134:12:134:12 | q | smart_pointer.cpp:134:13:134:13 | call to operator-> |  |
 | smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |

From dd1bb18938404a76283317189a693571e2d46d8b Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 20 Apr 2021 11:56:25 +0200
Subject: [PATCH 326/433] C#: Various data-flow performance tweaks

- Cache `DataFlowCall::getEnclosingCallable()`.
- Cache `ParameterNode`.
- Cache `ArgumentNode`.
- Force proper join-orders for uses of `getNodeType()`.
- Inline `localFlow` to prevent calculating full TC.
---
 csharp/ql/src/semmle/code/csharp/Caching.qll  |  3 +
 .../dataflow/internal/DataFlowDispatch.qll    |  9 ++-
 .../dataflow/internal/DataFlowPrivate.qll     | 77 ++++++++++++-------
 .../dataflow/internal/DataFlowPublic.qll      | 39 +++-------
 4 files changed, 68 insertions(+), 60 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Caching.qll b/csharp/ql/src/semmle/code/csharp/Caching.qll
index 95ffbf9ffc91..374ecaaa1839 100644
--- a/csharp/ql/src/semmle/code/csharp/Caching.qll
+++ b/csharp/ql/src/semmle/code/csharp/Caching.qll
@@ -49,6 +49,7 @@ module Stages {
 
   cached
   module DataFlowStage {
+    private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
     private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
     private import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
     private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
@@ -78,6 +79,8 @@ module Stages {
       or
       exists(CallContext cc)
       or
+      exists(any(DataFlowCall c).getEnclosingCallable())
+      or
       forceCachingInSameStageRev()
     }
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
index 4eac274b04f2..0a7cf4acc41b 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
@@ -4,6 +4,7 @@ private import dotnet
 private import DataFlowPublic
 private import DataFlowPrivate
 private import FlowSummaryImpl as FlowSummaryImpl
+private import semmle.code.csharp.Caching
 private import semmle.code.csharp.dataflow.FlowSummary
 private import semmle.code.csharp.dispatch.Dispatch
 private import semmle.code.csharp.frameworks.system.Collections
@@ -69,8 +70,6 @@ private predicate transitiveCapturedCallTarget(ControlFlow::Nodes::ElementNode c
 
 cached
 private module Cached {
-  private import semmle.code.csharp.Caching
-
   cached
   newtype TReturnKind =
     TNormalReturnKind() { Stages::DataFlowStage::forceCachingInSameStage() } or
@@ -247,6 +246,7 @@ abstract class DataFlowCall extends TDataFlowCall {
   abstract DataFlow::Node getNode();
 
   /** Gets the enclosing callable of this call. */
+  cached
   abstract DataFlowCallable getEnclosingCallable();
 
   /** Gets the underlying expression, if any. */
@@ -280,7 +280,10 @@ class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
 
   override DataFlow::ExprNode getNode() { result.getControlFlowNode() = cfn }
 
-  override DataFlowCallable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallable() {
+    Stages::DataFlowStage::forceCachingInSameStage() and
+    result = cfn.getEnclosingCallable()
+  }
 
   override string toString() { result = cfn.toString() }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 3b646973e282..f42410ca3a5c 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -21,9 +21,11 @@ private import semmle.code.csharp.frameworks.system.threading.Tasks
 
 abstract class NodeImpl extends Node {
   /** Do not call: use `getEnclosingCallable()` instead. */
+  cached
   abstract DataFlowCallable getEnclosingCallableImpl();
 
   /** Do not call: use `getType()` instead. */
+  cached
   abstract DotNet::Type getTypeImpl();
 
   /** Gets the type of this node used for type pruning. */
@@ -39,27 +41,39 @@ abstract class NodeImpl extends Node {
   }
 
   /** Do not call: use `getControlFlowNode()` instead. */
+  cached
   abstract ControlFlow::Node getControlFlowNodeImpl();
 
   /** Do not call: use `getLocation()` instead. */
+  cached
   abstract Location getLocationImpl();
 
   /** Do not call: use `toString()` instead. */
+  cached
   abstract string toStringImpl();
 }
 
 private class ExprNodeImpl extends ExprNode, NodeImpl {
   override DataFlowCallable getEnclosingCallableImpl() {
+    Stages::DataFlowStage::forceCachingInSameStage() and
     result = this.getExpr().getEnclosingCallable()
   }
 
-  override DotNet::Type getTypeImpl() { result = this.getExpr().getType() }
+  override DotNet::Type getTypeImpl() {
+    Stages::DataFlowStage::forceCachingInSameStage() and
+    result = this.getExpr().getType()
+  }
 
-  override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { this = TExprNode(result) }
+  override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() {
+    Stages::DataFlowStage::forceCachingInSameStage() and this = TExprNode(result)
+  }
 
-  override Location getLocationImpl() { result = this.getExpr().getLocation() }
+  override Location getLocationImpl() {
+    Stages::DataFlowStage::forceCachingInSameStage() and result = this.getExpr().getLocation()
+  }
 
   override string toStringImpl() {
+    Stages::DataFlowStage::forceCachingInSameStage() and
     result = this.getControlFlowNode().toString()
     or
     exists(CIL::Expr e |
@@ -967,6 +981,16 @@ private module Cached {
     or
     n.asExpr() = any(WithExpr we).getInitializer()
   }
+
+  cached
+  predicate parameterNode(Node n, DataFlowCallable c, int i) {
+    n.(ParameterNodeImpl).isParameterOf(c, i)
+  }
+
+  cached
+  predicate argumentNode(Node n, DataFlowCall call, int pos) {
+    n.(ArgumentNodeImpl).argumentOf(call, pos)
+  }
 }
 
 import Cached
@@ -992,8 +1016,6 @@ class SsaDefinitionNode extends NodeImpl, TSsaDefinitionNode {
 }
 
 abstract class ParameterNodeImpl extends NodeImpl {
-  abstract DotNet::Parameter getParameter();
-
   abstract predicate isParameterOf(DataFlowCallable c, int i);
 }
 
@@ -1010,11 +1032,9 @@ private module ParameterNodes {
     /** Gets the SSA definition corresponding to this parameter, if any. */
     Ssa::ExplicitDefinition getSsaDefinition() {
       result.getADefinition().(AssignableDefinitions::ImplicitParameterDefinition).getParameter() =
-        this.getParameter()
+        parameter
     }
 
-    override DotNet::Parameter getParameter() { result = parameter }
-
     override predicate isParameterOf(DataFlowCallable c, int i) { c.getParameter(i) = parameter }
 
     override DataFlowCallable getEnclosingCallableImpl() { result = parameter.getCallable() }
@@ -1037,8 +1057,6 @@ private module ParameterNodes {
     /** Gets the callable containing this implicit instance parameter. */
     Callable getCallable() { result = callable }
 
-    override DotNet::Parameter getParameter() { none() }
-
     override predicate isParameterOf(DataFlowCallable c, int pos) { callable = c and pos = -1 }
 
     override DataFlowCallable getEnclosingCallableImpl() { result = callable }
@@ -1113,8 +1131,6 @@ private module ParameterNodes {
     /** Gets the captured variable that this implicit parameter models. */
     LocalScopeVariable getVariable() { result = def.getVariable() }
 
-    override DotNet::Parameter getParameter() { none() }
-
     override predicate isParameterOf(DataFlowCallable c, int i) {
       i = getParameterPosition(def) and
       c = this.getEnclosingCallable()
@@ -1125,13 +1141,15 @@ private module ParameterNodes {
 import ParameterNodes
 
 /** A data-flow node that represents a call argument. */
-abstract class ArgumentNode extends Node {
+class ArgumentNode extends Node {
+  ArgumentNode() { argumentNode(this, _, _) }
+
   /** Holds if this argument occurs at the given position in the given call. */
-  cached
-  abstract predicate argumentOf(DataFlowCall call, int pos);
+  final predicate argumentOf(DataFlowCall call, int pos) { argumentNode(this, call, pos) }
+}
 
-  /** Gets the call in which this node is an argument. */
-  final DataFlowCall getCall() { this.argumentOf(result, _) }
+abstract private class ArgumentNodeImpl extends Node {
+  abstract predicate argumentOf(DataFlowCall call, int pos);
 }
 
 private module ArgumentNodes {
@@ -1149,7 +1167,7 @@ private module ArgumentNodes {
   }
 
   /** A data-flow node that represents an explicit call argument. */
-  class ExplicitArgumentNode extends ArgumentNode {
+  class ExplicitArgumentNode extends ArgumentNodeImpl {
     ExplicitArgumentNode() {
       this.asExpr() instanceof Argument
       or
@@ -1157,7 +1175,6 @@ private module ArgumentNodes {
     }
 
     override predicate argumentOf(DataFlowCall call, int pos) {
-      Stages::DataFlowStage::forceCachingInSameStage() and
       exists(ArgumentConfiguration x, Expr c, Argument arg |
         arg = this.asExpr() and
         c = call.getExpr() and
@@ -1189,7 +1206,8 @@ private module ArgumentNodes {
    * }                                }
    * ```
    */
-  class ImplicitCapturedArgumentNode extends ArgumentNode, NodeImpl, TImplicitCapturedArgumentNode {
+  class ImplicitCapturedArgumentNode extends ArgumentNodeImpl, NodeImpl,
+    TImplicitCapturedArgumentNode {
     private LocalScopeVariable v;
     private ControlFlow::Nodes::ElementNode cfn;
 
@@ -1231,7 +1249,7 @@ private module ArgumentNodes {
    * A node that corresponds to the value of an object creation (`new C()`) before
    * the constructor has run.
    */
-  class MallocNode extends ArgumentNode, NodeImpl, TMallocNode {
+  class MallocNode extends ArgumentNodeImpl, NodeImpl, TMallocNode {
     private ControlFlow::Nodes::ElementNode cfn;
 
     MallocNode() { this = TMallocNode(cfn) }
@@ -1266,7 +1284,7 @@ private module ArgumentNodes {
    * and that argument is itself a compatible array, for example
    * `Foo(new[] { "a", "b", "c" })`.
    */
-  class ParamsArgumentNode extends ArgumentNode, NodeImpl, TParamsArgumentNode {
+  class ParamsArgumentNode extends ArgumentNodeImpl, NodeImpl, TParamsArgumentNode {
     private ControlFlow::Node callCfn;
 
     ParamsArgumentNode() { this = TParamsArgumentNode(callCfn) }
@@ -1291,7 +1309,7 @@ private module ArgumentNodes {
     override string toStringImpl() { result = "[implicit array creation] " + callCfn }
   }
 
-  private class SummaryArgumentNode extends SummaryNode, ArgumentNode {
+  private class SummaryArgumentNode extends SummaryNode, ArgumentNodeImpl {
     private DataFlowCall c;
     private int i;
 
@@ -1324,10 +1342,7 @@ private module ReturnNodes {
       )
     }
 
-    override NormalReturnKind getKind() {
-      any(DotNet::Callable c).canReturn(this.getExpr()) and
-      exists(result)
-    }
+    override NormalReturnKind getKind() { exists(result) }
   }
 
   /**
@@ -1744,7 +1759,10 @@ class DataFlowType extends Gvn::GvnType {
 }
 
 /** Gets the type of `n` used for type pruning. */
-DataFlowType getNodeType(NodeImpl n) { result = n.getDataFlowType() }
+pragma[inline]
+Gvn::GvnType getNodeType(NodeImpl n) {
+  pragma[only_bind_into](result) = pragma[only_bind_out](n).getDataFlowType()
+}
 
 /** Gets a string representation of a `DataFlowType`. */
 string ppReprType(DataFlowType t) { result = t.toString() }
@@ -1819,7 +1837,8 @@ private module PostUpdateNodes {
    * Such a node acts as both a post-update node for the `MallocNode`, as well as
    * a pre-update node for the `ObjectCreationNode`.
    */
-  class ObjectInitializerNode extends PostUpdateNode, NodeImpl, ArgumentNode, TObjectInitializerNode {
+  class ObjectInitializerNode extends PostUpdateNode, NodeImpl, ArgumentNodeImpl,
+    TObjectInitializerNode {
     private ObjectCreation oc;
     private ControlFlow::Nodes::ElementNode cfn;
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
index dd6e72d54f6d..12a62faf3873 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -3,7 +3,6 @@ private import cil
 private import dotnet
 private import DataFlowDispatch
 private import DataFlowPrivate
-private import semmle.code.csharp.Caching
 private import semmle.code.csharp.controlflow.Guards
 private import semmle.code.csharp.Unification
 
@@ -38,38 +37,21 @@ class Node extends TNode {
   }
 
   /** Gets the type of this node. */
-  cached
-  final DotNet::Type getType() {
-    Stages::DataFlowStage::forceCachingInSameStage() and result = this.(NodeImpl).getTypeImpl()
-  }
+  final DotNet::Type getType() { result = this.(NodeImpl).getTypeImpl() }
 
   /** Gets the enclosing callable of this node. */
-  cached
   final DataFlowCallable getEnclosingCallable() {
-    Stages::DataFlowStage::forceCachingInSameStage() and
     result = this.(NodeImpl).getEnclosingCallableImpl()
   }
 
   /** Gets the control flow node corresponding to this node, if any. */
-  cached
-  final ControlFlow::Node getControlFlowNode() {
-    Stages::DataFlowStage::forceCachingInSameStage() and
-    result = this.(NodeImpl).getControlFlowNodeImpl()
-  }
+  final ControlFlow::Node getControlFlowNode() { result = this.(NodeImpl).getControlFlowNodeImpl() }
 
   /** Gets a textual representation of this node. */
-  cached
-  final string toString() {
-    Stages::DataFlowStage::forceCachingInSameStage() and
-    result = this.(NodeImpl).toStringImpl()
-  }
+  final string toString() { result = this.(NodeImpl).toStringImpl() }
 
   /** Gets the location of this node. */
-  cached
-  final Location getLocation() {
-    Stages::DataFlowStage::forceCachingInSameStage() and
-    result = this.(NodeImpl).getLocationImpl()
-  }
+  final Location getLocation() { result = this.(NodeImpl).getLocationImpl() }
 
   /**
    * Holds if this element is at the specified location.
@@ -81,7 +63,7 @@ class Node extends TNode {
   predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
-    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
   }
 }
 
@@ -117,18 +99,18 @@ class ExprNode extends Node {
  * flow graph.
  */
 class ParameterNode extends Node {
-  private ParameterNodeImpl p;
-
-  ParameterNode() { this = p }
+  ParameterNode() { parameterNode(this, _, _) }
 
   /** Gets the parameter corresponding to this node, if any. */
-  DotNet::Parameter getParameter() { result = p.getParameter() }
+  DotNet::Parameter getParameter() {
+    exists(DataFlowCallable c, int i | this.isParameterOf(c, i) and result = c.getParameter(i))
+  }
 
   /**
    * Holds if this node is the parameter of callable `c` at the specified
    * (zero-based) position.
    */
-  predicate isParameterOf(DataFlowCallable c, int i) { p.isParameterOf(c, i) }
+  predicate isParameterOf(DataFlowCallable c, int i) { parameterNode(this, c, i) }
 }
 
 /** A definition, viewed as a node in a data flow graph. */
@@ -166,6 +148,7 @@ predicate localFlowStep = localFlowStepImpl/2;
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**

From f2de44088691f46331b08ab9a68157bae582f109 Mon Sep 17 00:00:00 2001
From: p0wn4j <p0wn4j@github.com>
Date: Sun, 21 Mar 2021 22:30:43 +0400
Subject: [PATCH 327/433] [Java] CWE-094: Query to detect Groovy Code
 Injections

---
 .../CWE/CWE-094/GroovyInjection.qhelp         |  81 +++++++++
 .../Security/CWE/CWE-094/GroovyInjection.ql   |  20 +++
 .../CWE/CWE-094/GroovyInjectionBad.java       |  27 +++
 .../CWE/CWE-094/GroovyInjectionBlocklist.java |  17 ++
 .../CWE/CWE-094/GroovyInjectionLib.qll        | 162 ++++++++++++++++++
 .../CWE-094/GroovyClassLoaderTest.java        |  39 +++++
 .../security/CWE-094/GroovyEvalTest.java      |  41 +++++
 .../security/CWE-094/GroovyInjection.expected |  73 ++++++++
 .../security/CWE-094/GroovyInjection.qlref    |   1 +
 .../security/CWE-094/GroovyShellTest.java     |  63 +++++++
 .../query-tests/security/CWE-094/options      |   3 +-
 .../groovy/lang/GroovyClassLoader.java        |  32 ++++
 .../groovy/lang/GroovyCodeSource.java         |  23 +++
 .../groovy/lang/GroovyObject.java             |  21 +++
 .../groovy/lang/GroovyShell.java              |  66 +++++++
 .../groovy-all-3.0.7/groovy/lang/Script.java  |  22 +++
 .../groovy-all-3.0.7/groovy/util/Eval.java    |  41 +++++
 17 files changed, 731 insertions(+), 1 deletion(-)
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java
 create mode 100644 java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref
 create mode 100644 java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java
 create mode 100644 java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
new file mode 100644
index 000000000000..2329a6b08f5a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
@@ -0,0 +1,81 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+Apache Groovy is a powerful, optionally typed and dynamic language, 
+with static-typing and static compilation capabilities.
+
+It integrates smoothly with any Java program, 
+and immediately delivers to your application powerful features, 
+including scripting capabilities, Domain-Specific Language authoring, 
+runtime and compile-time meta-programming and functional programming.
+
+If a Groovy script is built using attacker-controlled data, 
+and then evaluated, then it may allow the attacker to achieve RCE.
+</p>
+</overview>
+
+<recommendation>
+<p>
+It is generally recommended to avoid using untrusted input in a Groovy evaluation.
+If this is not possible, use a sandbox solution. Developers must also take care that Groovy
+compile-time metaprogramming can also lead to RCE: it is possible to achieve RCE by compiling
+a Groovy script (see the article "Abusing Meta Programming for Unauthenticated RCE!" linked below).
+
+Groovy's <code>SecureASTCustomizer</code> allows securing source code by controlling what code constructs are permitted. 
+This is typically done when using Groovy for its scripting or domain specific language (DSL) features.
+The fundamental problem is that Groovy is a dynamic language, yet SecureASTCustomizer works by looking at Groovy AST statically.
+
+This makes it very easy for an attacker to bypass many of the intended checks
+(see https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/).
+Therefore, besides SecureASTCustomizer, runtime checks are also necessary before calling Groovy methods
+(see https://melix.github.io/blog/2015/03/sandboxing.html).
+
+It is also possible to use a block-list method, excluding unwanted classes from being loaded by the JVM. 
+This method is not always recommended, because block-lists can be bypassed by unexpected values.
+
+</p>
+</recommendation>
+
+<example>
+<p>
+The following example uses untrusted data to evaluate a Groovy script.
+</p>
+<sample src="GroovyInjectionBad.java" />
+
+<p>
+The following example uses classloader block-list approach to exclude loading dangerous classes.
+</p>
+<sample src="GroovyInjectionBlocklist.java" />
+
+</example>
+
+<references>
+<li>
+  Orange Tsai:
+  <a href="https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html">Abusing Meta Programming for Unauthenticated RCE!</a>.
+</li>
+<li>
+  Cédric Champeau:
+  <a href="https://melix.github.io/blog/2015/03/sandboxing.html">Improved sandboxing of Groovy scripts</a>.
+</li>
+<li>
+  Kohsuke Kawaguchi:
+  <a href="https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/">Groovy SecureASTCustomizer is harmful</a>.
+</li>
+<li>
+  Welk1n:
+  <a href="https://github.com/welk1n/exploiting-groovy-in-Java/">Groovy Injection payloads</a>.
+</li>
+<li>
+  Charles Chan:
+  <a href="https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-sandbox-ea39f80ee87/">Secure Groovy Script Execution in a Sandbox</a>.
+</li>
+<li>
+  Eugene:
+  <a href="https://stringconcat.com/en/scripting-and-sandboxing/">Scripting and sandboxing in a JVM environment</a>.
+</li>
+</references>
+
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql
new file mode 100644
index 000000000000..0622c9cd7e31
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Groovy Language injection
+ * @description Evaluation of a user-controlled Groovy script
+ *              may lead to arbitrary code execution.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/groovy-injection
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import DataFlow::PathGraph
+import GroovyInjectionLib
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, GroovyInjectionConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Groovy Injection from $@.", source.getNode(),
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java
new file mode 100644
index 000000000000..8afe77d2a39e
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java
@@ -0,0 +1,27 @@
+public class GroovyInjection {
+    void injectionViaClassLoader(HttpServletRequest request) {    
+        String script = request.getParameter("script");
+        final GroovyClassLoader classLoader = new GroovyClassLoader();
+        Class groovy = classLoader.parseClass(script);
+        GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+    }
+
+    void injectionViaEval(HttpServletRequest request) {
+        String script = request.getParameter("script");
+        Eval.me(script);
+    }
+
+    void injectionViaGroovyShell(HttpServletRequest request) {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script);
+    }
+
+    void injectionViaGroovyShellGroovyCodeSource(HttpServletRequest request) {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.evaluate(gcs);
+    }
+}
+
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java
new file mode 100644
index 000000000000..61159a3137f2
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java
@@ -0,0 +1,17 @@
+public class SandboxGroovyClassLoader extends ClassLoader {
+    public SandboxGroovyClassLoader(ClassLoader parent) {
+        super(parent);
+    }
+
+    /* override `loadClass` here to prevent loading sensitive classes, such as `java.lang.Runtime`, `java.lang.ProcessBuilder`, `java.lang.System`, etc.  */
+    /* Note we must also block `groovy.transform.ASTTest`, `groovy.lang.GrabConfig` and `org.buildobjects.process.ProcBuilder` to prevent compile-time RCE. */
+
+    static void runWithSandboxGroovyClassLoader() throws Exception {
+        // GOOD: route all class-loading via sand-boxing classloader.
+        SandboxGroovyClassLoader classLoader = new GroovyClassLoader(new SandboxGroovyClassLoader());
+        
+        Class<?> scriptClass = classLoader.parseClass(untrusted.getQueryString());
+        Object scriptInstance = scriptClass.newInstance();
+        Object result = scriptClass.getDeclaredMethod("bar", new Class[]{}).invoke(scriptInstance, new Object[]{});
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
new file mode 100644
index 000000000000..b6bdcc228c7c
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
@@ -0,0 +1,162 @@
+/**
+ * Provides classes and predicates for Groovy Code Injection
+ * taint-tracking configuration.
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+
+/** A data flow sink for Groovy expression injection vulnerabilities. */
+abstract private class GroovyInjectionSink extends DataFlow::ExprNode { }
+
+/**
+ * A taint-tracking configuration for unsafe user input
+ * that is used to evaluate a Groovy expression.
+ */
+class GroovyInjectionConfig extends TaintTracking::Configuration {
+  GroovyInjectionConfig() { this = "GroovyInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof GroovyInjectionSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    groovyCodeSourceTaintStep(fromNode, toNode)
+  }
+}
+
+/** The class `groovy.lang.GroovyShell`. */
+private class TypeGroovyShell extends RefType {
+  TypeGroovyShell() { this.hasQualifiedName("groovy.lang", "GroovyShell") }
+}
+
+/** The class `groovy.lang.GroovyCodeSource`. */
+private class TypeGroovyCodeSource extends RefType {
+  TypeGroovyCodeSource() { this.hasQualifiedName("groovy.lang", "GroovyCodeSource") }
+}
+
+/**
+ * Methods in the `GroovyShell` class that evaluate a Groovy expression.
+ */
+private class GroovyShellMethod extends Method {
+  GroovyShellMethod() {
+    this.getDeclaringType() instanceof TypeGroovyShell and
+    this.getName() in ["evaluate", "parse", "run"]
+  }
+}
+
+private class GroovyShellMethodAccess extends MethodAccess {
+  GroovyShellMethodAccess() { this.getMethod() instanceof GroovyShellMethod }
+}
+
+/**
+ * Holds if `fromNode` to `toNode` is a dataflow step from a tainted string to
+ * a `GroovyCodeSource` instance, i.e. `new GroovyCodeSource(tainted, ...)`.
+ */
+private predicate groovyCodeSourceTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+  exists(ConstructorCall gcscc |
+    gcscc.getConstructedType() instanceof TypeGroovyCodeSource and
+    gcscc = toNode.asExpr() and
+    gcscc.getArgument(0) = fromNode.asExpr()
+  )
+}
+
+/**
+ * A sink for Groovy Injection via the `GroovyShell` class.
+ *
+ * ```
+ * GroovyShell gs = new GroovyShell();
+ * gs.evaluate(sink, ....)
+ * gs.run(sink, ....)
+ * gs.parse(sink,...)
+ * ```
+ */
+private class GroovyShellSink extends GroovyInjectionSink {
+  GroovyShellSink() {
+    exists(GroovyShellMethodAccess ma, Argument firstArg |
+      ma.getArgument(0) = firstArg and
+      firstArg = this.asExpr() and
+      (
+        firstArg.getType() instanceof TypeString or
+        firstArg.getType() instanceof TypeGroovyCodeSource
+      )
+    )
+  }
+}
+
+/** The class `groovy.util.Eval`. */
+private class TypeEval extends RefType {
+  TypeEval() { this.hasQualifiedName("groovy.util", "Eval") }
+}
+
+/**
+ * Methods in the `Eval` class that evaluate a Groovy expression.
+ */
+private class EvalMethod extends Method {
+  EvalMethod() {
+    this.getDeclaringType() instanceof TypeEval and
+    this.getName() in ["me", "x", "xy", "xyz"]
+  }
+}
+
+private class EvalMethodAccess extends MethodAccess {
+  EvalMethodAccess() { this.getMethod() instanceof EvalMethod }
+
+  Expr getArgumentExpr() {
+    result = this.getArgument(this.getNumArgument() - 1)
+  }
+}
+
+/**
+ * A sink for Groovy Injection via the `Eval` class.
+ *
+ * ```
+ * Eval.me(sink)
+ * Eval.me("p1", "p2", sink)
+ * Eval.x("p1", sink)
+ * Eval.xy("p1", "p2" sink)
+ * Eval.xyz("p1", "p2", "p3", sink)
+ * ```
+ */
+private class EvalSink extends GroovyInjectionSink {
+  EvalSink() { exists(EvalMethodAccess ma | ma.getArgumentExpr() = this.asExpr()) }
+}
+
+/** The class `groovy.lang.GroovyClassLoader`. */
+private class TypeGroovyClassLoader extends RefType {
+  TypeGroovyClassLoader() { this.hasQualifiedName("groovy.lang", "GroovyClassLoader") }
+}
+
+/**
+ * A method in the `GroovyClassLoader` class that evaluates a Groovy expression.
+ */
+private class GroovyClassLoaderParseClassMethod extends Method {
+  GroovyClassLoaderParseClassMethod() {
+    this.getDeclaringType() instanceof TypeGroovyClassLoader and
+    this.hasName("parseClass")
+  }
+}
+
+private class GroovyClassLoaderParseClassMethodAccess extends MethodAccess {
+  GroovyClassLoaderParseClassMethodAccess() {
+    this.getMethod() instanceof GroovyClassLoaderParseClassMethod
+  }
+}
+
+/**
+ * A sink for Groovy Injection via the `GroovyClassLoader` class.
+ *
+ * ```
+ * GroovyClassLoader classLoader = new GroovyClassLoader();
+ * Class groovy = classLoader.parseClass(script);
+ * ```
+ *
+ * Groovy supports compile-time metaprogramming, so just calling the `parseClass`
+ * method is enough to achieve RCE.
+ */
+private class GroovyClassLoadParseClassSink extends GroovyInjectionSink {
+  GroovyClassLoadParseClassSink() {
+    exists(GroovyClassLoaderParseClassMethodAccess ma | ma.getArgument(0) = this.asExpr())
+  }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java
new file mode 100644
index 000000000000..6e3ccab34fd5
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java
@@ -0,0 +1,39 @@
+import groovy.lang.GroovyClassLoader;
+import groovy.lang.GroovyCodeSource;
+import groovy.lang.GroovyObject;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+public class GroovyClassLoaderTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            String script = request.getParameter("script");
+            final GroovyClassLoader classLoader = new GroovyClassLoader();
+            Class groovy = classLoader.parseClass(script);
+            GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+
+        } catch (Exception e) {
+            // Ignore
+        }
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            String script = request.getParameter("script");
+            final GroovyClassLoader classLoader = new GroovyClassLoader();
+            GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+            Class groovy = classLoader.parseClass(gcs);
+            GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+        } catch (Exception e) {
+            // Ignore
+        }
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java
new file mode 100644
index 000000000000..ff76af2d3fd4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java
@@ -0,0 +1,41 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import groovy.util.Eval;
+
+public class GroovyEvalTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.me(script);
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.me("test", "result", script);
+    }
+
+    protected void doPut(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.x("result2", script);
+
+    }
+
+    protected void doDelete(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.xy("result3", "result4", script);
+    }
+
+    protected void doPatch(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.xyz("result3", "result4", "aaa", script);
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected
new file mode 100644
index 000000000000..12593ae32c53
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected
@@ -0,0 +1,73 @@
+edges
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression |
+| GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | GroovyClassLoaderTest.java:18:51:18:56 | script |
+| GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | GroovyClassLoaderTest.java:32:51:32:53 | gcs |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script : String |
+| GroovyEvalTest.java:13:17:13:22 | script : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String |
+| GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | GroovyEvalTest.java:19:35:19:40 | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script : String |
+| GroovyEvalTest.java:25:27:25:32 | script : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String |
+| GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | GroovyEvalTest.java:32:39:32:44 | script |
+| GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | GroovyEvalTest.java:38:47:38:52 | script |
+| GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | GroovyShellTest.java:16:24:16:29 | script |
+| GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | GroovyShellTest.java:23:24:23:29 | script |
+| GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | GroovyShellTest.java:30:24:30:29 | script |
+| GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | GroovyShellTest.java:37:19:37:24 | script |
+| GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | GroovyShellTest.java:45:19:45:21 | gcs |
+| GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | GroovyShellTest.java:53:24:53:26 | gcs |
+| GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | GroovyShellTest.java:60:21:60:26 | script |
+nodes
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String | semmle.label | expression : String |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | semmle.label | expression |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String | semmle.label | expression : String |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | semmle.label | expression |
+| GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyClassLoaderTest.java:18:51:18:56 | script | semmle.label | script |
+| GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyClassLoaderTest.java:32:51:32:53 | gcs | semmle.label | gcs |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:13:17:13:22 | script | semmle.label | script |
+| GroovyEvalTest.java:13:17:13:22 | script : String | semmle.label | script : String |
+| GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:19:35:19:40 | script | semmle.label | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:25:27:25:32 | script | semmle.label | script |
+| GroovyEvalTest.java:25:27:25:32 | script : String | semmle.label | script : String |
+| GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:32:39:32:44 | script | semmle.label | script |
+| GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:38:47:38:52 | script | semmle.label | script |
+| GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:16:24:16:29 | script | semmle.label | script |
+| GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:23:24:23:29 | script | semmle.label | script |
+| GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:30:24:30:29 | script | semmle.label | script |
+| GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:37:19:37:24 | script | semmle.label | script |
+| GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:45:19:45:21 | gcs | semmle.label | gcs |
+| GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:53:24:53:26 | gcs | semmle.label | gcs |
+| GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:60:21:60:26 | script | semmle.label | script |
+#select
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | Groovy Injection from $@. | GroovyEvalTest.java:12:25:12:54 | getParameter(...) | this user input |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | Groovy Injection from $@. | GroovyEvalTest.java:24:25:24:54 | getParameter(...) | this user input |
+| GroovyClassLoaderTest.java:18:51:18:56 | script | GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | GroovyClassLoaderTest.java:18:51:18:56 | script | Groovy Injection from $@. | GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) | this user input |
+| GroovyClassLoaderTest.java:32:51:32:53 | gcs | GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | GroovyClassLoaderTest.java:32:51:32:53 | gcs | Groovy Injection from $@. | GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) | this user input |
+| GroovyEvalTest.java:13:17:13:22 | script | GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script | Groovy Injection from $@. | GroovyEvalTest.java:12:25:12:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:19:35:19:40 | script | GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | GroovyEvalTest.java:19:35:19:40 | script | Groovy Injection from $@. | GroovyEvalTest.java:18:25:18:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:25:27:25:32 | script | GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script | Groovy Injection from $@. | GroovyEvalTest.java:24:25:24:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:32:39:32:44 | script | GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | GroovyEvalTest.java:32:39:32:44 | script | Groovy Injection from $@. | GroovyEvalTest.java:31:25:31:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:38:47:38:52 | script | GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | GroovyEvalTest.java:38:47:38:52 | script | Groovy Injection from $@. | GroovyEvalTest.java:37:25:37:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:16:24:16:29 | script | GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | GroovyShellTest.java:16:24:16:29 | script | Groovy Injection from $@. | GroovyShellTest.java:15:25:15:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:23:24:23:29 | script | GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | GroovyShellTest.java:23:24:23:29 | script | Groovy Injection from $@. | GroovyShellTest.java:22:25:22:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:30:24:30:29 | script | GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | GroovyShellTest.java:30:24:30:29 | script | Groovy Injection from $@. | GroovyShellTest.java:29:25:29:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:37:19:37:24 | script | GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | GroovyShellTest.java:37:19:37:24 | script | Groovy Injection from $@. | GroovyShellTest.java:36:25:36:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:45:19:45:21 | gcs | GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | GroovyShellTest.java:45:19:45:21 | gcs | Groovy Injection from $@. | GroovyShellTest.java:43:25:43:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:53:24:53:26 | gcs | GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | GroovyShellTest.java:53:24:53:26 | gcs | Groovy Injection from $@. | GroovyShellTest.java:51:25:51:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:60:21:60:26 | script | GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | GroovyShellTest.java:60:21:60:26 | script | Groovy Injection from $@. | GroovyShellTest.java:59:25:59:54 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref
new file mode 100644
index 000000000000..0ec7e1bc543e
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-094/GroovyInjection.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java
new file mode 100644
index 000000000000..541aaf402505
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java
@@ -0,0 +1,63 @@
+import groovy.lang.GroovyCodeSource;
+import groovy.lang.GroovyShell;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+public class GroovyShellTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script);
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script, "test");
+    }
+
+    protected void doPut(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script, "test", "test2");
+    }
+
+    protected void doOptions(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.run(script, "_", new String[]{});
+    }
+
+    protected void doHead(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.run(gcs, new String[]{});
+    }
+
+    protected void doDelete(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.evaluate(gcs);
+    }
+
+    protected void doPatch(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.parse(script);
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/options b/java/ql/test/experimental/query-tests/security/CWE-094/options
index ec3354ea41ce..18e3518fc972 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/options
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/options
@@ -1 +1,2 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2
\ No newline at end of file
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4
+
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java
new file mode 100644
index 000000000000..aed976677420
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java
@@ -0,0 +1,32 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public class GroovyClassLoader {
+    public GroovyClassLoader() {
+    }
+
+    public Class parseClass(String text) {
+        return null;
+    }
+
+    public Class parseClass(GroovyCodeSource gcs) {
+        return null;
+    }
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java
new file mode 100644
index 000000000000..901043e50460
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java
@@ -0,0 +1,23 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public class GroovyCodeSource {
+    public GroovyCodeSource(String script, String param1, String param2) {}
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java
new file mode 100644
index 000000000000..1302502a0912
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java
@@ -0,0 +1,21 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public interface GroovyObject {}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java
new file mode 100644
index 000000000000..13df0777e03a
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java
@@ -0,0 +1,66 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+import java.util.*;
+
+public class GroovyShell {
+
+    public GroovyShell() {}
+
+    public Object evaluate(GroovyCodeSource codeSource) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText, String fileName) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText, final String fileName, final String codeBase) {
+        return null;
+    }
+
+    public Object run(String scriptText, String fileName, List<String> list) {
+        return null;
+    }
+
+    public Object run(String scriptText, String fileName, String[] args) {
+        return null;
+    }
+
+    public Object run(GroovyCodeSource source, List<String> args) {
+        return null;
+    }
+
+    public Object run(GroovyCodeSource source, String[] args) {
+        return null;
+    }
+
+    public Script parse(String scriptText) {
+        return null;
+    }
+
+    public Script parse(final String scriptText, final String fileName) {
+        return null;
+    }
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java
new file mode 100644
index 000000000000..4a49fc4f9040
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java
@@ -0,0 +1,22 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public abstract class Script {
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java
new file mode 100644
index 000000000000..857ec361e1a5
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java
@@ -0,0 +1,41 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.util;
+
+public class Eval {
+    public static Object me(final String expression) {
+        return me(null, null, expression);
+    }
+
+    public static Object me(final String symbol, final Object object, final String expression) {
+        return null;
+    }
+
+    public static Object x(final Object x, final String expression) {
+        return me("x", x, expression);
+    }
+
+    public static Object xy(final Object x, final Object y, final String expression) {
+        return null;
+    }
+
+    public static Object xyz(final Object x, final Object y, final Object z, final String expression) {
+        return null;
+    }
+}

From bb58a505038d4134b1c13e389f0b483ec65a417f Mon Sep 17 00:00:00 2001
From: Hayk Andriasyan <77549590+p0wn4j@users.noreply.github.com>
Date: Tue, 20 Apr 2021 15:41:58 +0400
Subject: [PATCH 328/433] Update GroovyInjection.qhelp

---
 .../src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
index 2329a6b08f5a..8f1f715482c2 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
@@ -29,7 +29,7 @@ The fundamental problem is that Groovy is a dynamic language, yet SecureASTCusto
 
 This makes it very easy for an attacker to bypass many of the intended checks
 (see https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/).
-Therefore, besides SecureASTCustomizer, runtime checks are also necessary before calling Groovy methods
+Therefore, besides <code>SecureASTCustomizer</code>, runtime checks are also necessary before calling Groovy methods
 (see https://melix.github.io/blog/2015/03/sandboxing.html).
 
 It is also possible to use a block-list method, excluding unwanted classes from being loaded by the JVM. 

From 0ec3ee29e4dc75a8b2252c30be40e77bb672b9df Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Tue, 20 Apr 2021 12:44:49 +0100
Subject: [PATCH 329/433] Style last use of `SecureASTCustomizer`

---
 .../src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
index 8f1f715482c2..9bf84f710dc1 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
@@ -25,7 +25,7 @@ a Groovy script (see the article "Abusing Meta Programming for Unauthenticated R
 
 Groovy's <code>SecureASTCustomizer</code> allows securing source code by controlling what code constructs are permitted. 
 This is typically done when using Groovy for its scripting or domain specific language (DSL) features.
-The fundamental problem is that Groovy is a dynamic language, yet SecureASTCustomizer works by looking at Groovy AST statically.
+The fundamental problem is that Groovy is a dynamic language, yet <code>SecureASTCustomizer</code> works by looking at Groovy AST statically.
 
 This makes it very easy for an attacker to bypass many of the intended checks
 (see https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/).

From 581f4ed757eeebd1de472e30be9e03e87904b837 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 20 Apr 2021 12:12:20 +0100
Subject: [PATCH 330/433] JS: Generalize handling of route handler wrapper
 functions

---
 .../semmle/javascript/dataflow/DataFlow.qll   | 71 ++++++++++++++++++-
 .../semmle/javascript/frameworks/Express.qll  |  8 ++-
 .../src/semmle/javascript/frameworks/HTTP.qll | 56 +--------------
 .../CWE-770/MissingRateLimiting.expected      |  3 +
 .../test/query-tests/Security/CWE-770/tst.js  |  6 ++
 5 files changed, 88 insertions(+), 56 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 7e43df8382bc..a7256b351fb0 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1685,6 +1685,18 @@ module DataFlow {
 
   predicate localTaintStep = TaintTracking::localTaintStep/2;
 
+  private predicate forwardsParameter(
+    DataFlow::FunctionNode function, int i, DataFlow::CallNode call
+  ) {
+    exists(DataFlow::ParameterNode parameter | parameter = function.getParameter(i) |
+      not parameter.isRestParameter() and
+      parameter.flowsTo(call.getArgument(i))
+      or
+      parameter.isRestParameter() and
+      parameter.flowsTo(call.asExpr().(CallExpr).getArgument(i).(SpreadElement).getOperand().flow())
+    )
+  }
+
   /**
    * Holds if the function in `succ` forwards all its arguments to a call to `pred` and returns
    * its result. This can thus be seen as a step `pred -> succ` used for tracking function values
@@ -1722,7 +1734,7 @@ module DataFlow {
     exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
       call.flowsTo(function.getReturnNode()) and
       forall(int i | exists([call.getArgument(i), function.getParameter(i)]) |
-        function.getParameter(i).flowsTo(call.getArgument(i))
+        forwardsParameter(function, i, call)
       ) and
       pred = call.getCalleeNode() and
       succ = function
@@ -1739,4 +1751,61 @@ module DataFlow {
       functionForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
     )
   }
+
+  /**
+   * Holds if the function in `succ` forwards all its arguments to a call to `pred`.
+   * This can thus be seen as a step `pred -> succ` used for tracking function values
+   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
+   *
+   * This is similar to `functionForwardingStep` except the innermost forwarding call does not
+   * need flow to the return value; this can be useful for tracking callback-style functions
+   * where the result tends to be unused.
+   *
+   * Examples:
+   * ```js
+   * function f(x, callback) {
+   *   g(x, callback); // step: g -> f
+   * }
+   *
+   * function doExec(x, callback) {
+   *   console.log(x);
+   *   exec(x, callback); // step: exec -> doExec
+   * }
+   *
+   * function doEither(x, y) {
+   *   if (x > y) {
+   *     return foo(x, y); // step: foo -> doEither
+   *   } else {
+   *     return bar(x, y); // step: bar -> doEither
+   *   }
+   * }
+   *
+   * function wrapWithLogging(f) {
+   *   return (x) => {
+   *     console.log(x);
+   *     return f(x); // step: f -> anonymous function
+   *   }
+   * }
+   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
+   * ```
+   */
+  predicate functionOneWayForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
+      call.getContainer() = function.getFunction() and
+      forall(int i | exists(function.getParameter(i)) | forwardsParameter(function, i, call)) and
+      pred = call.getCalleeNode() and
+      succ = function
+    )
+    or
+    // Given a generic wrapper function like,
+    //
+    //   function wrap(f) { return (x, y) => f(x, y) };
+    //
+    // add steps through calls to that function: `g -> wrap(g)`
+    exists(DataFlow::FunctionNode wrapperFunction, SourceNode param, Node paramUse |
+      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
+      param.flowsTo(paramUse) and
+      functionOneWayForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
+    )
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index 17bfed8afdac..0a618c7f125a 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -224,7 +224,13 @@ module Express {
     /**
      * Gets the function body of this handler, if it is defined locally.
      */
-    RouteHandler getBody() { result.(DataFlow::SourceNode).flowsToExpr(this) }
+    RouteHandler getBody() {
+      exists(DataFlow::SourceNode source | source = flow().getALocalSource() |
+        result = source
+        or
+        DataFlow::functionOneWayForwardingStep(result.(DataFlow::SourceNode).getALocalUse(), source)
+      )
+    }
 
     /**
      * Holds if this is not followed by more handlers.
diff --git a/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll b/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
index 435ea94fd720..9475c32eeab2 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
@@ -235,64 +235,12 @@ module HTTP {
     ResponseExpr getAResponseExpr() { result.getRouteHandler() = this }
   }
 
-  /**
-   * Holds if `call` decorates the function `pred`.
-   * This means that `call` returns a function that forwards its arguments to `pred`.
-   * Only holds when the decorator looks like it is decorating a route-handler.
-   *
-   * Below is a code example relating `call`, `decoratee`, `outer`, `inner`.
-   * ```
-   * function outer(method) {
-   *    return function inner(req, res) {
-   *      return method.call(this, req, res);
-   *    };
-   *  }
-   *  var route = outer(function decoratee(req, res) { // <- call
-   *    res.end("foo");
-   *  });
-   * ```
-   */
-  private predicate isDecoratedCall(DataFlow::CallNode call, DataFlow::FunctionNode decoratee) {
-    // indirect route-handler `result` is given to function `outer`, which returns function `inner` which calls the function `pred`.
-    exists(int i, DataFlow::FunctionNode outer, HTTP::RouteHandlerCandidate inner |
-      inner = outer.getAReturn().getALocalSource() and
-      decoratee = call.getArgument(i).getALocalSource() and
-      outer.getFunction() = call.getACallee() and
-      hasForwardingHandlerParameter(i, outer, inner)
-    )
-  }
-
-  /**
-   * Holds if the `i`th parameter of `outer` has a call that `inner` forwards its parameters to.
-   */
-  private predicate hasForwardingHandlerParameter(
-    int i, DataFlow::FunctionNode outer, HTTP::RouteHandlerCandidate inner
-  ) {
-    isAForwardingRouteHandlerCall(outer.getParameter(i), inner)
-  }
-
-  /**
-   * Holds if `f` looks like a route-handler and a call to `callee` inside `f` forwards all of the parameters from `f` to that call.
-   */
-  private predicate isAForwardingRouteHandlerCall(
-    DataFlow::SourceNode callee, HTTP::RouteHandlerCandidate f
-  ) {
-    exists(DataFlow::CallNode call | call = callee.getACall() |
-      forall(int arg | arg = [0 .. f.getNumParameter() - 1] |
-        f.getParameter(arg).flowsTo(call.getArgument(arg))
-      ) and
-      call.getContainer() = f.getFunction()
-    )
-  }
-
   /**
    * Holds if there exists a step from `pred` to `succ` for a RouteHandler - beyond the usual steps defined by TypeTracking.
    */
   predicate routeHandlerStep(DataFlow::SourceNode pred, DataFlow::SourceNode succ) {
-    isDecoratedCall(succ, pred)
-    or
     // A forwarding call
-    isAForwardingRouteHandlerCall(pred, succ)
+    DataFlow::functionOneWayForwardingStep(pred.getALocalUse(), succ)
     or
     // a container containing route-handlers.
     exists(HTTP::RouteHandlerCandidateContainer container | pred = container.getRouteHandler(succ))
@@ -687,7 +635,7 @@ module HTTP {
     DataFlow::SourceNode getAPossiblyDecoratedHandler(RouteHandlerCandidate candidate) {
       result = candidate
       or
-      isDecoratedCall(result, candidate)
+      DataFlow::functionOneWayForwardingStep(candidate, result)
     }
 
     private string mapValueProp() {
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
index 560be8bbb86b..49f77eeb7abf 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
@@ -7,3 +7,6 @@
 | tst.js:37:20:37:36 | expensiveHandler3 | This route handler performs $@, but is not rate-limited. | tst.js:16:40:16:70 | child_p ... /true") | a system command |
 | tst.js:38:20:38:36 | expensiveHandler4 | This route handler performs $@, but is not rate-limited. | tst.js:17:40:17:83 | connect ... ution') | a database access |
 | tst.js:64:25:64:63 | functio ... req); } | This route handler performs $@, but is not rate-limited. | tst.js:64:46:64:60 | verifyUser(req) | authorization |
+| tst.js:76:25:76:53 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
+| tst.js:78:60:78:76 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
+| tst.js:79:60:79:88 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/tst.js b/javascript/ql/test/query-tests/Security/CWE-770/tst.js
index 3d00cf598446..d6d8db6524a4 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-770/tst.js
@@ -71,3 +71,9 @@ const rateLimiterMiddleware = (req, res, next) => {
   rateLimiter.consume(req.ip).then(next).catch(res.status(429).send('rate limited'));
 };
 express().get('/:path', rateLimiterMiddleware, expensiveHandler1);
+
+const catchAsync = fn => (...args) => fn(...args).catch(args[2]);
+express().get('/:path', catchAsync(expensiveHandler1)); // NOT OK
+express().get('/:path', rateLimiterMiddleware, catchAsync(expensiveHandler1)); // OK
+express().get('/:path', catchAsync(rateLimiterMiddleware), expensiveHandler1); // OK
+express().get('/:path', catchAsync(rateLimiterMiddleware), catchAsync(expensiveHandler1)); // OK

From 1797b6c7f93f4d2ed672092f59c9e0b02af01cce Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 20 Apr 2021 10:39:26 +0200
Subject: [PATCH 331/433] C++: Add FP test from the work on smart pointers in
 dataflow.

---
 .../ReturnStackAllocatedMemory.expected       |  1 +
 .../ReturnStackAllocatedMemory/test.cpp       | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected
index 59a9ee1322ce..d84bde030cf9 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected	
@@ -6,3 +6,4 @@
 | test.cpp:112:2:112:12 | return ... | May return stack-allocated memory from $@. | test.cpp:112:9:112:11 | arr | arr |
 | test.cpp:119:2:119:19 | return ... | May return stack-allocated memory from $@. | test.cpp:119:11:119:13 | arr | arr |
 | test.cpp:171:3:171:24 | return ... | May return stack-allocated memory from $@. | test.cpp:170:35:170:41 | myLocal | myLocal |
+| test.cpp:217:3:217:13 | return ... | May return stack-allocated memory from $@. | test.cpp:216:14:216:17 | port | port |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp
index 03b202817cae..d39b7d1ee282 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
@@ -189,3 +189,30 @@ int *&conversionInFlow() {
   int *&pRef = p; // has conversion in the middle of data flow
   return pRef; // BAD [NOT DETECTED]
 }
+
+namespace std {
+	template<typename T>
+	class shared_ptr {
+	public:
+		shared_ptr() noexcept;
+		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
+		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
+		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
+
+		shared_ptr<T>& operator=(const shared_ptr<T>&) noexcept;
+		shared_ptr<T>& operator=(shared_ptr<T>&&) noexcept;
+
+		T& operator*() const noexcept;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+}
+
+auto make_read_port()
+{
+  auto port = std::shared_ptr<int>(new int);
+  auto ptr = port.get();
+  return ptr; // GOOD [FALSE POSITIVE]
+}
\ No newline at end of file

From 93e55e2631f5f661def6a0877c9b463276e11526 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 20 Apr 2021 13:58:12 +0200
Subject: [PATCH 332/433] C++: Fix FP in cpp/return-stack-allocated-memory.

---
 .../Memory Management/ReturnStackAllocatedMemory.ql          | 5 +++++
 .../ReturnStackAllocatedMemory.expected                      | 1 -
 .../Memory Management/ReturnStackAllocatedMemory/test.cpp    | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
index fc06ed0a500e..f5dda53d4844 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql	
+++ b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql	
@@ -13,6 +13,7 @@
 
 import cpp
 import semmle.code.cpp.dataflow.EscapesTree
+import semmle.code.cpp.models.interfaces.PointerWrapper
 import semmle.code.cpp.dataflow.DataFlow
 
 /**
@@ -39,6 +40,10 @@ predicate hasNontrivialConversion(Expr e) {
     e instanceof ParenthesisExpr
   )
   or
+  // A smart pointer can be stack-allocated while the data it points to is heap-allocated.
+  // So we exclude such "conversions" from this predicate.
+  e = any(PointerWrapper wrapper).getAnUnwrapperFunction().getACallToThisFunction()
+  or
   hasNontrivialConversion(e.getConversion())
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected
index d84bde030cf9..59a9ee1322ce 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected	
@@ -6,4 +6,3 @@
 | test.cpp:112:2:112:12 | return ... | May return stack-allocated memory from $@. | test.cpp:112:9:112:11 | arr | arr |
 | test.cpp:119:2:119:19 | return ... | May return stack-allocated memory from $@. | test.cpp:119:11:119:13 | arr | arr |
 | test.cpp:171:3:171:24 | return ... | May return stack-allocated memory from $@. | test.cpp:170:35:170:41 | myLocal | myLocal |
-| test.cpp:217:3:217:13 | return ... | May return stack-allocated memory from $@. | test.cpp:216:14:216:17 | port | port |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp
index d39b7d1ee282..1ce2558a34f6 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
@@ -214,5 +214,5 @@ auto make_read_port()
 {
   auto port = std::shared_ptr<int>(new int);
   auto ptr = port.get();
-  return ptr; // GOOD [FALSE POSITIVE]
+  return ptr; // GOOD
 }
\ No newline at end of file

From f8d428cb2ddef3dc83f331b04d822533b6e44ef3 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 20 Apr 2021 13:00:42 +0100
Subject: [PATCH 333/433] JS: Use function-forwarding steps when tracking rate
 limiters

---
 .../security/dataflow/MissingRateLimiting.qll | 42 ++++++++++++++-----
 .../CWE-770/MissingRateLimiting.expected      |  2 -
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll b/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll
index 9b26660c6f0e..b9cb1b5059a8 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll
@@ -113,29 +113,53 @@ class DatabaseAccessAsExpensiveAction extends ExpensiveAction {
  * A route handler expression that is rate-limited by a rate-limiting middleware.
  */
 class RouteHandlerExpressionWithRateLimiter extends RateLimitedRouteHandlerExpr {
-  RouteHandlerExpressionWithRateLimiter() { getAMatchingAncestor() instanceof RateLimiter }
+  RouteHandlerExpressionWithRateLimiter() {
+    any(RateLimitingMiddleware m).ref().flowsToExpr(getAMatchingAncestor())
+  }
 }
 
 /**
+ * DEPRECATED. Use `RateLimitingMiddleware` instead.
+ *
  * A middleware that acts as a rate limiter.
  */
-abstract class RateLimiter extends Express::RouteHandlerExpr { }
+deprecated class RateLimiter extends Express::RouteHandlerExpr {
+  RateLimiter() { any(RateLimitingMiddleware m).ref().flowsToExpr(this) }
+}
+
+/**
+ * Creation of a middleware function that acts as a rate limiter.
+ */
+abstract class RateLimitingMiddleware extends DataFlow::SourceNode {
+  /** Gets a data flow node referring to this middleware. */
+  private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
+    t.start() and
+    result = this
+    or
+    DataFlow::functionOneWayForwardingStep(ref(t.continue()).getALocalUse(), result)
+    or
+    exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
+  }
+
+  /** Gets a data flow node referring to this middleware. */
+  DataFlow::SourceNode ref() { result = ref(DataFlow::TypeTracker::end()) }
+}
 
 /**
  * A rate limiter constructed using the `express-rate-limit` package.
  */
-class ExpressRateLimit extends RateLimiter {
+class ExpressRateLimit extends RateLimitingMiddleware {
   ExpressRateLimit() {
-    this = API::moduleImport("express-rate-limit").getReturn().getAUse().asExpr()
+    this = API::moduleImport("express-rate-limit").getReturn().getAnImmediateUse()
   }
 }
 
 /**
  * A rate limiter constructed using the `express-brute` package.
  */
-class BruteForceRateLimit extends RateLimiter {
+class BruteForceRateLimit extends RateLimitingMiddleware {
   BruteForceRateLimit() {
-    this = API::moduleImport("express-brute").getInstance().getMember("prevent").getAUse().asExpr()
+    this = API::moduleImport("express-brute").getInstance().getMember("prevent").getAnImmediateUse()
   }
 }
 
@@ -183,8 +207,6 @@ class RateLimiterFlexibleRateLimiter extends DataFlow::FunctionNode {
 /**
  * A route-handler expression that is rate-limited by the `rate-limiter-flexible` package.
  */
-class RouteHandlerLimitedByRateLimiterFlexible extends RateLimiter {
-  RouteHandlerLimitedByRateLimiterFlexible() {
-    any(RateLimiterFlexibleRateLimiter rl).flowsToExpr(this)
-  }
+class RouteHandlerLimitedByRateLimiterFlexible extends RateLimitingMiddleware {
+  RouteHandlerLimitedByRateLimiterFlexible() { this instanceof RateLimiterFlexibleRateLimiter }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
index 49f77eeb7abf..220ece00a410 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimiting.expected
@@ -8,5 +8,3 @@
 | tst.js:38:20:38:36 | expensiveHandler4 | This route handler performs $@, but is not rate-limited. | tst.js:17:40:17:83 | connect ... ution') | a database access |
 | tst.js:64:25:64:63 | functio ... req); } | This route handler performs $@, but is not rate-limited. | tst.js:64:46:64:60 | verifyUser(req) | authorization |
 | tst.js:76:25:76:53 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
-| tst.js:78:60:78:76 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
-| tst.js:79:60:79:88 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |

From 7046f1a9028cf74046e6ffa38da5f65cd0572184 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 15 Apr 2021 16:24:48 +0200
Subject: [PATCH 334/433] add taint-step for markdown-it when the HTML flag is
 set

---
 .../semmle/javascript/frameworks/Markdown.qll   | 17 +++++++++++++++++
 .../CWE-079/ReflectedXss/ReflectedXss.expected  | 14 ++++++++++++++
 .../CWE-079/ReflectedXss/ReflectedXss.js        | 11 +++++++++++
 .../ReflectedXssWithCustomSanitizer.expected    |  2 ++
 4 files changed, 44 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
index 768e4f202ac8..dd3171ae6055 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
@@ -118,3 +118,20 @@ private class SnarkdownStep extends TaintTracking::SharedTaintStep {
     )
   }
 }
+
+/**
+ * A taint step for the `markdown-it` library.
+ */
+private class MarkdownItStep extends TaintTracking::SharedTaintStep {
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(API::CallNode renderer, API::CallNode call |
+      renderer = API::moduleImport("markdown-it").getACall() and
+      renderer.getParameter(0).getMember("html").getARhs().asExpr().(BooleanLiteral).getValue() =
+        "true" and
+      call = renderer.getReturn().getMember(["render", "renderInline"]).getACall()
+    |
+      succ = call and
+      pred = call.getArgument(0)
+    )
+  }
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
index 93a1061b3d33..6cc8088e7b18 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
@@ -66,6 +66,13 @@ nodes
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body |
 | ReflectedXss.js:85:23:85:30 | req.body |
+| ReflectedXss.js:94:12:94:19 | req.body |
+| ReflectedXss.js:94:12:94:19 | req.body |
+| ReflectedXss.js:94:12:94:19 | req.body |
+| ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:95:30:95:37 | req.body |
+| ReflectedXss.js:95:30:95:37 | req.body |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id |
@@ -212,6 +219,11 @@ edges
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body |
+| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
@@ -307,6 +319,8 @@ edges
 | ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
 | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
+| ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:94:12:94:19 | req.body | user-provided value |
+| ReflectedXss.js:95:12:95:38 | markdow ... q.body) | ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:95:30:95:37 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
index 7e531bdd4e19..003d807a8bd1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
@@ -84,3 +84,14 @@ app.get('/user/:id', function (req, res) {
   res.send(snarkdown(req.body)); // NOT OK
   res.send(snarkdown2(req.body)); // NOT OK
 });
+
+const markdownIt = require('markdown-it')({
+  html: true
+});
+const markdownIt2 = require('markdown-it')({});
+
+app.get('/user/:id', function (req, res) {
+  res.send(req.body); // NOT OK
+  res.send(markdownIt.render(req.body)); // NOT OK
+  res.send(markdownIt2.render(req.body)); // OK - no html
+});
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
index f690572c8996..c96f7c397542 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
@@ -14,6 +14,8 @@
 | ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
 | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
+| ReflectedXss.js:94:12:94:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:94:12:94:19 | req.body | user-provided value |
+| ReflectedXss.js:95:12:95:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:95:30:95:37 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |

From 13d915927bd9e5bad1f541c3a0fa2551f1d2856d Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 15 Apr 2021 16:26:52 +0200
Subject: [PATCH 335/433] add change note

---
 javascript/change-notes/2021-04-15-markdownit.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 javascript/change-notes/2021-04-15-markdownit.md

diff --git a/javascript/change-notes/2021-04-15-markdownit.md b/javascript/change-notes/2021-04-15-markdownit.md
new file mode 100644
index 000000000000..90127a4293d9
--- /dev/null
+++ b/javascript/change-notes/2021-04-15-markdownit.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The security queries now track taint through markdown-it.
+  Affected packages are
+    [markdown-it](https://npmjs.com/package/markdown-it)
\ No newline at end of file

From 19c5889775eb2d1a9bdbdc8053acf816fdc1b5f0 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 15 Apr 2021 20:06:21 +0200
Subject: [PATCH 336/433] use `mayHaveBooleanValue`

---
 javascript/ql/src/semmle/javascript/frameworks/Markdown.qll | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
index dd3171ae6055..2b5d15ab1f4f 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
@@ -126,8 +126,7 @@ private class MarkdownItStep extends TaintTracking::SharedTaintStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(API::CallNode renderer, API::CallNode call |
       renderer = API::moduleImport("markdown-it").getACall() and
-      renderer.getParameter(0).getMember("html").getARhs().asExpr().(BooleanLiteral).getValue() =
-        "true" and
+      renderer.getParameter(0).getMember("html").getARhs().mayHaveBooleanValue(true) and
       call = renderer.getReturn().getMember(["render", "renderInline"]).getACall()
     |
       succ = call and

From 9bfb0d93caabbc222a6d7ce192c2b476245c1a0d Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Tue, 20 Apr 2021 13:59:09 +0100
Subject: [PATCH 337/433] Autoformat QL

---
 .../experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll  | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
index b6bdcc228c7c..61ddb9b9a1a1 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
@@ -103,9 +103,7 @@ private class EvalMethod extends Method {
 private class EvalMethodAccess extends MethodAccess {
   EvalMethodAccess() { this.getMethod() instanceof EvalMethod }
 
-  Expr getArgumentExpr() {
-    result = this.getArgument(this.getNumArgument() - 1)
-  }
+  Expr getArgumentExpr() { result = this.getArgument(this.getNumArgument() - 1) }
 }
 
 /**

From 31bd701bd53a6b30f3bbfd88b0e6da3c02f5738a Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 12:29:26 +0000
Subject: [PATCH 338/433] Python: Final `LocalSourceNode` fixes

---
 .../ql/src/semmle/python/frameworks/PEP249.qll   | 16 ++++++++--------
 .../frameworks/modeling-example/SharedCode.qll   |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/PEP249.qll b/python/ql/src/semmle/python/frameworks/PEP249.qll
index f2b21d08e7c3..6100076d0ada 100644
--- a/python/ql/src/semmle/python/frameworks/PEP249.qll
+++ b/python/ql/src/semmle/python/frameworks/PEP249.qll
@@ -54,7 +54,7 @@ module Connection {
   }
 
   /** Gets a reference to an instance of `db.Connection`. */
-  private DataFlow::Node instance(DataFlow::TypeTracker t) {
+  private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
     t.start() and
     result instanceof InstanceSource
     or
@@ -62,7 +62,7 @@ module Connection {
   }
 
   /** Gets a reference to an instance of `db.Connection`. */
-  DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+  DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 }
 
 /**
@@ -71,7 +71,7 @@ module Connection {
  */
 module cursor {
   /** Gets a reference to the `cursor` method on a connection. */
-  private DataFlow::Node methodRef(DataFlow::TypeTracker t) {
+  private DataFlow::LocalSourceNode methodRef(DataFlow::TypeTracker t) {
     t.startInAttr("cursor") and
     result = Connection::instance()
     or
@@ -79,10 +79,10 @@ module cursor {
   }
 
   /** Gets a reference to the `cursor` method on a connection. */
-  DataFlow::Node methodRef() { result = methodRef(DataFlow::TypeTracker::end()) }
+  DataFlow::Node methodRef() { methodRef(DataFlow::TypeTracker::end()).flowsTo(result) }
 
   /** Gets a reference to a result of calling the `cursor` method on a connection. */
-  private DataFlow::Node methodResult(DataFlow::TypeTracker t) {
+  private DataFlow::LocalSourceNode methodResult(DataFlow::TypeTracker t) {
     t.start() and
     result.asCfgNode().(CallNode).getFunction() = methodRef().asCfgNode()
     or
@@ -90,7 +90,7 @@ module cursor {
   }
 
   /** Gets a reference to a result of calling the `cursor` method on a connection. */
-  DataFlow::Node methodResult() { result = methodResult(DataFlow::TypeTracker::end()) }
+  DataFlow::Node methodResult() { methodResult(DataFlow::TypeTracker::end()).flowsTo(result) }
 }
 
 /**
@@ -101,7 +101,7 @@ module cursor {
  *
  * See https://www.python.org/dev/peps/pep-0249/#id15.
  */
-private DataFlow::Node execute(DataFlow::TypeTracker t) {
+private DataFlow::LocalSourceNode execute(DataFlow::TypeTracker t) {
   t.startInAttr("execute") and
   result in [cursor::methodResult(), Connection::instance()]
   or
@@ -116,7 +116,7 @@ private DataFlow::Node execute(DataFlow::TypeTracker t) {
  *
  * See https://www.python.org/dev/peps/pep-0249/#id15.
  */
-DataFlow::Node execute() { result = execute(DataFlow::TypeTracker::end()) }
+DataFlow::Node execute() { execute(DataFlow::TypeTracker::end()).flowsTo(result) }
 
 /** A call to the `execute` method on a cursor (or on a connection). */
 private class ExecuteCall extends SqlExecution::Range, DataFlow::CallCfgNode {
diff --git a/python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll b/python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll
index feb310f38c24..ae562f830642 100644
--- a/python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll
+++ b/python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll
@@ -6,7 +6,7 @@ private import semmle.python.dataflow.new.TaintTracking
 /** A data-flow Node representing an instance of MyClass. */
 abstract class MyClass extends DataFlow::Node { }
 
-private DataFlow::Node myClassGetValue(MyClass qualifier, DataFlow::TypeTracker t) {
+private DataFlow::LocalSourceNode myClassGetValue(MyClass qualifier, DataFlow::TypeTracker t) {
   t.startInAttr("get_value") and
   result = qualifier
   or
@@ -14,7 +14,7 @@ private DataFlow::Node myClassGetValue(MyClass qualifier, DataFlow::TypeTracker
 }
 
 DataFlow::Node myClassGetValue(MyClass qualifier) {
-  result = myClassGetValue(qualifier, DataFlow::TypeTracker::end())
+  myClassGetValue(qualifier, DataFlow::TypeTracker::end()).flowsTo(result)
 }
 
 // Config

From a55b43b67e2aebb466ff74372875cf61ee3fff55 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 12:35:55 +0000
Subject: [PATCH 339/433] Python: Use `LocalSourceNode` throughout `step`

This commit does a lot of stuff all at once, so here are the main
highlights:

In `TypeTracker.qll`, we change `StepSummary::step` to step only between
source nodes. Because reads and writes of global variables happen in two
different (jump) steps, this requires the intermediate
`ModuleVariableNode` to _also_ be a `LocalSourceNode`, and we therefore
modify the charpred for that class accordingly. (This also means
changing a few of the tests to account for these new source nodes.)

In addition, we change `TypeTracker::step` to likewise step between
local source nodes.

Next, to enable the use of the `track` convenience method on nodes, we
add some pragmas to `TypeTracker::step` that prevent bad joins from
occurring. With this, we can eliminate all of the manual type tracker
join predicates.

Next, we observe that because `StepSummary::step` now uses `flowsTo`, it
automatically encapsulates all local-flow steps. In particular this
means we do not have to use `typePreservingStep` in `smallstep`, but can
use `jumpStep` directly. A similar observation applies to
`TypeTracker::smallstep`.

Having done this, we no longer need `typePreservingStep`, so we get rid
of it.
---
 .../CVE-2018-1281/BindToAllInterfaces.ql      | 32 ++-----------------
 python/ql/src/semmle/python/ApiGraphs.qll     | 13 +-------
 python/ql/src/semmle/python/Concepts.qll      | 16 +---------
 .../python/dataflow/new/TypeTracker.qll       | 22 +++++--------
 .../dataflow/new/internal/LocalSources.qll    |  1 -
 .../semmle/python/frameworks/Cryptography.qll | 14 +-------
 python/ql/src/semmle/python/regex.qll         | 16 +---------
 .../experimental/dataflow/ApiGraphs/use.ql    |  6 +++-
 .../dataflow/typetracking/moduleattr.expected |  1 +
 9 files changed, 20 insertions(+), 101 deletions(-)

diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index dc5633863d2d..069f255f1989 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -32,21 +32,7 @@ private DataFlow::LocalSourceNode vulnerableHostnameRef(DataFlow::TypeTracker t,
     result.asExpr() = allInterfacesStrConst
   )
   or
-  // Due to bad performance when using normal setup with `vulnerableHostnameRef(t2, hostname).track(t2, t)`
-  // we have inlined that code and forced a join
-  exists(DataFlow::TypeTracker t2 |
-    exists(DataFlow::StepSummary summary |
-      vulnerableHostnameRef_first_join(t2, hostname, result, summary) and
-      t = t2.append(summary)
-    )
-  )
-}
-
-pragma[nomagic]
-private predicate vulnerableHostnameRef_first_join(
-  DataFlow::TypeTracker t2, string hostname, DataFlow::Node res, DataFlow::StepSummary summary
-) {
-  DataFlow::StepSummary::step(vulnerableHostnameRef(t2, hostname), res, summary)
+  exists(DataFlow::TypeTracker t2 | result = vulnerableHostnameRef(t2, hostname).track(t2, t))
 }
 
 /** Gets a reference to a hostname that can be used to bind to all interfaces. */
@@ -59,21 +45,7 @@ private DataFlow::LocalSourceNode vulnerableAddressTuple(DataFlow::TypeTracker t
   t.start() and
   result.asExpr() = any(Tuple tup | tup.getElt(0) = vulnerableHostnameRef(hostname).asExpr())
   or
-  // Due to bad performance when using normal setup with `vulnerableAddressTuple(t2, hostname).track(t2, t)`
-  // we have inlined that code and forced a join
-  exists(DataFlow::TypeTracker t2 |
-    exists(DataFlow::StepSummary summary |
-      vulnerableAddressTuple_first_join(t2, hostname, result, summary) and
-      t = t2.append(summary)
-    )
-  )
-}
-
-pragma[nomagic]
-private predicate vulnerableAddressTuple_first_join(
-  DataFlow::TypeTracker t2, string hostname, DataFlow::Node res, DataFlow::StepSummary summary
-) {
-  DataFlow::StepSummary::step(vulnerableAddressTuple(t2, hostname), res, summary)
+  exists(DataFlow::TypeTracker t2 | result = vulnerableAddressTuple(t2, hostname).track(t2, t))
 }
 
 /** Gets a reference to a tuple for which the first element is a hostname that can be used to bind to all interfaces. */
diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 5f1fbbb96269..48f303081702 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -433,18 +433,7 @@ module API {
       use(_, src) and
       result = src
       or
-      // Due to bad performance when using `trackUseNode(t2, attr_name).track(t2, t)`
-      // we have inlined that code and forced a join
-      exists(DataFlow::StepSummary summary |
-        t = trackUseNode_first_join(src, result, summary).append(summary)
-      )
-    }
-
-    pragma[nomagic]
-    private DataFlow::TypeTracker trackUseNode_first_join(
-      DataFlow::LocalSourceNode src, DataFlow::LocalSourceNode res, DataFlow::StepSummary summary
-    ) {
-      DataFlow::StepSummary::step(trackUseNode(src, result), res, summary)
+      exists(DataFlow::TypeTracker t2 | result = trackUseNode(src, t2).track(t2, t))
     }
 
     cached
diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index d8e65cb2e09e..4be00ba5bf97 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -570,21 +570,7 @@ module Cryptography {
         arg = any(KeyGeneration::Range r).getKeySizeArg() and
         result = arg.getALocalSource()
         or
-        // Due to bad performance when using normal setup with we have inlined that code and forced a join
-        exists(DataFlow::TypeBackTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            keysizeBacktracker_first_join(t2, arg, result, summary) and
-            t = t2.prepend(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate keysizeBacktracker_first_join(
-        DataFlow::TypeBackTracker t2, DataFlow::Node arg, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(res, keysizeBacktracker(t2, arg), summary)
+        exists(DataFlow::TypeBackTracker t2 | result = keysizeBacktracker(t2, arg).backtrack(t2, t))
       }
 
       /** Gets a back-reference to the keysize argument `arg` that was used to generate a new key-pair. */
diff --git a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
index d4ce5f606ace..bba7ecf367b9 100644
--- a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
+++ b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
@@ -51,8 +51,8 @@ module StepSummary {
    * heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
    */
   cached
-  predicate step(LocalSourceNode nodeFrom, Node nodeTo, StepSummary summary) {
-    exists(Node mid | typePreservingStep*(nodeFrom, mid) and smallstep(mid, nodeTo, summary))
+  predicate step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    exists(Node mid | nodeFrom.flowsTo(mid) and smallstep(mid, nodeTo, summary))
   }
 
   /**
@@ -63,7 +63,7 @@ module StepSummary {
    * type-preserving steps.
    */
   predicate smallstep(Node nodeFrom, Node nodeTo, StepSummary summary) {
-    typePreservingStep(nodeFrom, nodeTo) and
+    jumpStep(nodeFrom, nodeTo) and
     summary = LevelStep()
     or
     callStep(nodeFrom, nodeTo) and summary = CallStep()
@@ -80,12 +80,6 @@ module StepSummary {
   }
 }
 
-/** Holds if it's reasonable to expect the data flow step from `nodeFrom` to `nodeTo` to preserve types. */
-private predicate typePreservingStep(Node nodeFrom, Node nodeTo) {
-  simpleLocalFlowStep(nodeFrom, nodeTo) or
-  jumpStep(nodeFrom, nodeTo)
-}
-
 /**
  * Gets a callable for the call where `nodeFrom` is used as the `i`'th argument.
  *
@@ -274,10 +268,10 @@ class TypeTracker extends TTypeTracker {
    * heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
    */
   pragma[inline]
-  TypeTracker step(LocalSourceNode nodeFrom, Node nodeTo) {
+  TypeTracker step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo) {
     exists(StepSummary summary |
-      StepSummary::step(nodeFrom, nodeTo, summary) and
-      result = this.append(summary)
+      StepSummary::step(nodeFrom, pragma[only_bind_out](nodeTo), pragma[only_bind_into](summary)) and
+      result = this.append(pragma[only_bind_into](summary))
     )
   }
 
@@ -312,7 +306,7 @@ class TypeTracker extends TTypeTracker {
       result = this.append(summary)
     )
     or
-    typePreservingStep(nodeFrom, nodeTo) and
+    simpleLocalFlowStep(nodeFrom, nodeTo) and
     result = this
   }
 }
@@ -453,7 +447,7 @@ class TypeBackTracker extends TTypeBackTracker {
       this = result.prepend(summary)
     )
     or
-    typePreservingStep(nodeFrom, nodeTo) and
+    simpleLocalFlowStep(nodeFrom, nodeTo) and
     this = result
   }
 }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index 7aa311df76b1..134507add94c 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -41,7 +41,6 @@ class LocalSourceNode extends Node {
   cached
   LocalSourceNode() {
     not comes_from_cfgnode(this) and
-    not this instanceof ModuleVariableNode and
     // Currently, we create synthetic post-update nodes for
     // - arguments to calls that may modify said argument
     // - direct reads a writes of object attributes
diff --git a/python/ql/src/semmle/python/frameworks/Cryptography.qll b/python/ql/src/semmle/python/frameworks/Cryptography.qll
index 3396d7dfa556..266d41897d3d 100644
--- a/python/ql/src/semmle/python/frameworks/Cryptography.qll
+++ b/python/ql/src/semmle/python/frameworks/Cryptography.qll
@@ -83,23 +83,11 @@ private module CryptographyModel {
       result.(DataFlow::CallCfgNode).getFunction() = curveClassWithKeySize(keySize) and
       origin = result
       or
-      // Due to bad performance when using normal setup with we have inlined that code and forced a join
       exists(DataFlow::TypeTracker t2 |
-        exists(DataFlow::StepSummary summary |
-          curveClassInstanceWithKeySize_first_join(t2, keySize, origin, result, summary) and
-          t = t2.append(summary)
-        )
+        result = curveClassInstanceWithKeySize(t2, keySize, origin).track(t2, t)
       )
     }
 
-    pragma[nomagic]
-    private predicate curveClassInstanceWithKeySize_first_join(
-      DataFlow::TypeTracker t2, int keySize, DataFlow::Node origin, DataFlow::Node res,
-      DataFlow::StepSummary summary
-    ) {
-      DataFlow::StepSummary::step(curveClassInstanceWithKeySize(t2, keySize, origin), res, summary)
-    }
-
     /** Gets a reference to a predefined curve class instance with a specific key size (in bits), as well as the origin of the class. */
     DataFlow::Node curveClassInstanceWithKeySize(int keySize, DataFlow::Node origin) {
       curveClassInstanceWithKeySize(DataFlow::TypeTracker::end(), keySize, origin).flowsTo(result)
diff --git a/python/ql/src/semmle/python/regex.qll b/python/ql/src/semmle/python/regex.qll
index f558669ce32a..365c36d0d2f6 100644
--- a/python/ql/src/semmle/python/regex.qll
+++ b/python/ql/src/semmle/python/regex.qll
@@ -82,21 +82,7 @@ private DataFlow::LocalSourceNode re_flag_tracker(string flag_name, DataFlow::Ty
     result.asCfgNode() = binop
   )
   or
-  // Due to bad performance when using normal setup with `re_flag_tracker(t2, attr_name).track(t2, t)`
-  // we have inlined that code and forced a join
-  exists(DataFlow::TypeTracker t2 |
-    exists(DataFlow::StepSummary summary |
-      re_flag_tracker_first_join(t2, flag_name, result, summary) and
-      t = t2.append(summary)
-    )
-  )
-}
-
-pragma[nomagic]
-private predicate re_flag_tracker_first_join(
-  DataFlow::TypeTracker t2, string flag_name, DataFlow::Node res, DataFlow::StepSummary summary
-) {
-  DataFlow::StepSummary::step(re_flag_tracker(flag_name, t2), res, summary)
+  exists(DataFlow::TypeTracker t2 | result = re_flag_tracker(flag_name, t2).track(t2, t))
 }
 
 /**
diff --git a/python/ql/test/experimental/dataflow/ApiGraphs/use.ql b/python/ql/test/experimental/dataflow/ApiGraphs/use.ql
index f02bb048c585..2bcc05d443bd 100644
--- a/python/ql/test/experimental/dataflow/ApiGraphs/use.ql
+++ b/python/ql/test/experimental/dataflow/ApiGraphs/use.ql
@@ -9,7 +9,11 @@ class ApiUseTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = "use" }
 
   private predicate relevant_node(API::Node a, DataFlow::Node n, Location l) {
-    n = a.getAUse() and l = n.getLocation()
+    n = a.getAUse() and
+    l = n.getLocation() and
+    // Module variable nodes have no suitable location, so it's best to simply exclude them entirely
+    // from the inline tests.
+    not n instanceof DataFlow::ModuleVariableNode
   }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
diff --git a/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected b/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
index 82aa6e99c3cf..adfc8c5a3795 100644
--- a/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
+++ b/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
@@ -1,6 +1,7 @@
 module_tracker
 | import_as_attr.py:1:6:1:11 | ControlFlowNode for ImportExpr |
 module_attr_tracker
+| import_as_attr.py:0:0:0:0 | ModuleVariableNode for Global Variable attr_ref in Module import_as_attr |
 | import_as_attr.py:1:20:1:35 | ControlFlowNode for ImportMember |
 | import_as_attr.py:1:28:1:35 | GSSA Variable attr_ref |
 | import_as_attr.py:3:1:3:1 | GSSA Variable x |

From 038bf612be2e8308d4c8d4f82089aa9675844901 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 13:06:30 +0000
Subject: [PATCH 340/433] Python: Add change note

---
 .../change-notes/2021-04-20-stepsummary-localsourcenode.md   | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 python/change-notes/2021-04-20-stepsummary-localsourcenode.md

diff --git a/python/change-notes/2021-04-20-stepsummary-localsourcenode.md b/python/change-notes/2021-04-20-stepsummary-localsourcenode.md
new file mode 100644
index 000000000000..630dfc4e44a9
--- /dev/null
+++ b/python/change-notes/2021-04-20-stepsummary-localsourcenode.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* The predicates `StepSummary::step` and `TypeTracker::step` in `TypeTracker.qll` have been changed
+  to use the more restrictive type `LocalSourceNode` for their second argument. For cases where
+  stepping between non-`LocalSourceNode`s is required, the `StepSummary::smallstep` predicate may be
+  used instead.

From 38548c9acdd246b265b16f2ee3605c686cca56a7 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 13:15:50 +0000
Subject: [PATCH 341/433] Python: Simplify charpred for `LocalSourceNode`

The somewhat convoluted `comes_from_cfgnode` was originally introduced
in order to have local sources for instances of global variables. This
was needed because global variables have an implicit "scope entry" SSA
definition that flows to the first actual use of the variable (and so
would not fit the strict "has no incoming flow" definition of a local
source node).

However, a subsequent change means that we include all global variable
reads anyway, and so the old definition is no longer needed.

(See commit 3fafb47b1680fc7fb42418a1ca6816986262ab05 for further
context.)
---
 .../semmle/python/dataflow/new/internal/LocalSources.qll | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index 134507add94c..808aa4cf48bc 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -10,13 +10,6 @@ import python
 import DataFlowPublic
 private import DataFlowPrivate
 
-private predicate comes_from_cfgnode(Node node) {
-  exists(CfgNode first, Node second |
-    simpleLocalFlowStep(first, second) and
-    simpleLocalFlowStep*(second, node)
-  )
-}
-
 /**
  * A data flow node that is a source of local flow. This includes things like
  * - Expressions
@@ -40,7 +33,7 @@ private predicate comes_from_cfgnode(Node node) {
 class LocalSourceNode extends Node {
   cached
   LocalSourceNode() {
-    not comes_from_cfgnode(this) and
+    not simpleLocalFlowStep(_, this) and
     // Currently, we create synthetic post-update nodes for
     // - arguments to calls that may modify said argument
     // - direct reads a writes of object attributes

From 62dfd1fa7ddeea093047255f5da191f0bdf12cb4 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 20 Apr 2021 15:23:03 +0200
Subject: [PATCH 342/433] improve the `markdown-it` model

---
 .../semmle/javascript/frameworks/Markdown.qll | 42 +++++++++++++----
 .../ReflectedXss/ReflectedXss.expected        | 46 +++++++++++++------
 .../CWE-079/ReflectedXss/ReflectedXss.js      |  7 +++
 .../ReflectedXssWithCustomSanitizer.expected  |  6 ++-
 4 files changed, 76 insertions(+), 25 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
index 2b5d15ab1f4f..76c90aa2ef37 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
@@ -120,17 +120,41 @@ private class SnarkdownStep extends TaintTracking::SharedTaintStep {
 }
 
 /**
- * A taint step for the `markdown-it` library.
+ * Classes and predicates for modelling taint steps the `markdown-it` library.
  */
-private class MarkdownItStep extends TaintTracking::SharedTaintStep {
-  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(API::CallNode renderer, API::CallNode call |
-      renderer = API::moduleImport("markdown-it").getACall() and
-      renderer.getParameter(0).getMember("html").getARhs().mayHaveBooleanValue(true) and
-      call = renderer.getReturn().getMember(["render", "renderInline"]).getACall()
+private module MarkdownIt {
+  /**
+   * The creation of a parser from `markdown-it`.
+   */
+  private API::Node markdownIt() {
+    exists(API::InvokeNode call |
+      call = API::moduleImport("markdown-it").getAnInvocation()
+      or
+      call = API::moduleImport("markdown-it").getMember("Markdown").getAnInvocation()
     |
-      succ = call and
-      pred = call.getArgument(0)
+      call.getParameter(0).getMember("html").getARhs().mayHaveBooleanValue(true) and
+      result = call.getReturn()
     )
+    or
+    exists(API::CallNode call |
+      call = markdownIt().getMember(["use", "set", "configure", "enable", "disable"]).getACall() and
+      result = call.getReturn() and
+      not call.getParameter(0).getARhs().getALocalSource() =
+        DataFlow::moduleImport("markdown-it-sanitizer")
+    )
+  }
+
+  /**
+   * A taint step for the `markdown-it` library.
+   */
+  private class MarkdownItStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::CallNode call |
+        call = markdownIt().getMember(["render", "renderInline"]).getACall()
+      |
+        succ = call and
+        pred = call.getArgument(0)
+      )
+    }
   }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
index 6cc8088e7b18..f8ceeb45b62a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
@@ -66,13 +66,21 @@ nodes
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body |
 | ReflectedXss.js:85:23:85:30 | req.body |
-| ReflectedXss.js:94:12:94:19 | req.body |
-| ReflectedXss.js:94:12:94:19 | req.body |
-| ReflectedXss.js:94:12:94:19 | req.body |
-| ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
-| ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
-| ReflectedXss.js:95:30:95:37 | req.body |
-| ReflectedXss.js:95:30:95:37 | req.body |
+| ReflectedXss.js:97:12:97:19 | req.body |
+| ReflectedXss.js:97:12:97:19 | req.body |
+| ReflectedXss.js:97:12:97:19 | req.body |
+| ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:98:30:98:37 | req.body |
+| ReflectedXss.js:98:30:98:37 | req.body |
+| ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:100:31:100:38 | req.body |
+| ReflectedXss.js:100:31:100:38 | req.body |
+| ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
+| ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
+| ReflectedXss.js:103:76:103:83 | req.body |
+| ReflectedXss.js:103:76:103:83 | req.body |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id |
@@ -219,11 +227,19 @@ edges
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
-| ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body |
-| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
-| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
-| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
-| ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) |
+| ReflectedXss.js:97:12:97:19 | req.body | ReflectedXss.js:97:12:97:19 | req.body |
+| ReflectedXss.js:98:30:98:37 | req.body | ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:98:30:98:37 | req.body | ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:98:30:98:37 | req.body | ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:98:30:98:37 | req.body | ReflectedXss.js:98:12:98:38 | markdow ... q.body) |
+| ReflectedXss.js:100:31:100:38 | req.body | ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:100:31:100:38 | req.body | ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:100:31:100:38 | req.body | ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:100:31:100:38 | req.body | ReflectedXss.js:100:12:100:39 | markdow ... q.body) |
+| ReflectedXss.js:103:76:103:83 | req.body | ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
+| ReflectedXss.js:103:76:103:83 | req.body | ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
+| ReflectedXss.js:103:76:103:83 | req.body | ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
+| ReflectedXss.js:103:76:103:83 | req.body | ReflectedXss.js:103:12:103:84 | markdow ... q.body) |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
@@ -319,8 +335,10 @@ edges
 | ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
 | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
-| ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body | ReflectedXss.js:94:12:94:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:94:12:94:19 | req.body | user-provided value |
-| ReflectedXss.js:95:12:95:38 | markdow ... q.body) | ReflectedXss.js:95:30:95:37 | req.body | ReflectedXss.js:95:12:95:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:95:30:95:37 | req.body | user-provided value |
+| ReflectedXss.js:97:12:97:19 | req.body | ReflectedXss.js:97:12:97:19 | req.body | ReflectedXss.js:97:12:97:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:97:12:97:19 | req.body | user-provided value |
+| ReflectedXss.js:98:12:98:38 | markdow ... q.body) | ReflectedXss.js:98:30:98:37 | req.body | ReflectedXss.js:98:12:98:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:98:30:98:37 | req.body | user-provided value |
+| ReflectedXss.js:100:12:100:39 | markdow ... q.body) | ReflectedXss.js:100:31:100:38 | req.body | ReflectedXss.js:100:12:100:39 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:100:31:100:38 | req.body | user-provided value |
+| ReflectedXss.js:103:12:103:84 | markdow ... q.body) | ReflectedXss.js:103:76:103:83 | req.body | ReflectedXss.js:103:12:103:84 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:103:76:103:83 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
index 003d807a8bd1..6a85c0ec1b0a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
@@ -90,8 +90,15 @@ const markdownIt = require('markdown-it')({
 });
 const markdownIt2 = require('markdown-it')({});
 
+const markdownIt3 = require('markdown-it')({html: true})
+  .use(require('markdown-it-highlightjs'));
+
 app.get('/user/:id', function (req, res) {
   res.send(req.body); // NOT OK
   res.send(markdownIt.render(req.body)); // NOT OK
   res.send(markdownIt2.render(req.body)); // OK - no html
+  res.send(markdownIt3.render(req.body)); // NOT OK
+
+  res.send(markdownIt.use(require('markdown-it-sanitizer')).render(req.body)); // OK - HTML is sanitized. 
+  res.send(markdownIt.use(require('markdown-it-abbr')).use(unknown).render(req.body)); // NOT OK
 });
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
index c96f7c397542..719a82171a80 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
@@ -14,8 +14,10 @@
 | ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
 | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
 | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
-| ReflectedXss.js:94:12:94:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:94:12:94:19 | req.body | user-provided value |
-| ReflectedXss.js:95:12:95:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:95:30:95:37 | req.body | user-provided value |
+| ReflectedXss.js:97:12:97:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:97:12:97:19 | req.body | user-provided value |
+| ReflectedXss.js:98:12:98:38 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:98:30:98:37 | req.body | user-provided value |
+| ReflectedXss.js:100:12:100:39 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:100:31:100:38 | req.body | user-provided value |
+| ReflectedXss.js:103:12:103:84 | markdow ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:103:76:103:83 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |

From 43ca8ea5f79541d53c2b80a6b85e0568a8258436 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 20 Apr 2021 15:15:12 +0100
Subject: [PATCH 343/433] JS: Fix perf issue in forwardsParameter

---
 javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index a7256b351fb0..76c42cd16cf4 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1693,7 +1693,7 @@ module DataFlow {
       parameter.flowsTo(call.getArgument(i))
       or
       parameter.isRestParameter() and
-      parameter.flowsTo(call.asExpr().(CallExpr).getArgument(i).(SpreadElement).getOperand().flow())
+      parameter.flowsTo(call.getASpreadArgument())
     )
   }
 

From 583513bafd427a2ba1626e361b7f04bcefed9db1 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 20 Apr 2021 16:28:47 +0200
Subject: [PATCH 344/433] Fix review findings

---
 .../code/java/security/LdapInjection.qll      | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/java/ql/src/semmle/code/java/security/LdapInjection.qll b/java/ql/src/semmle/code/java/security/LdapInjection.qll
index f5e0994c68f9..6907bb493870 100644
--- a/java/ql/src/semmle/code/java/security/LdapInjection.qll
+++ b/java/ql/src/semmle/code/java/security/LdapInjection.qll
@@ -45,12 +45,12 @@ private class DefaultLdapInjectionSinkModel extends SinkModelCsv {
         "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchRequest);;Argument[0];ldap",
         "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,DereferencePolicy,int,int,boolean,Filter,String[]);;Argument[0..7];ldap",
         "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,DereferencePolicy,int,int,boolean,String,String[]);;Argument[0..7];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,Filter,String[]]);;Argument[0..3];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,String,String[]]);;Argument[0..3];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,Filter,String[]]);;Argument[0..6];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,String,String[]]);;Argument[0..6];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,Filter,String[]]);;Argument[0..2];ldap",
-        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,String,String[]]);;Argument[0..2];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,Filter,String[]);;Argument[0..3];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(SearchResultListener,String,SearchScope,String,String[]);;Argument[0..3];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,Filter,String[]);;Argument[0..6];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,DereferencePolicy,int,int,boolean,String,String[]);;Argument[0..6];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,Filter,String[]);;Argument[0..2];ldap",
+        "com.unboundid.ldap.sdk;LDAPConnection;false;search;(String,SearchScope,String,String[]);;Argument[0..2];ldap",
         // UnboundID: searchForEntry
         "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(ReadOnlySearchRequest);;Argument[0];ldap",
         "com.unboundid.ldap.sdk;LDAPConnection;false;searchForEntry;(SearchRequest);;Argument[0];ldap",
@@ -66,15 +66,15 @@ private class DefaultLdapInjectionSinkModel extends SinkModelCsv {
         "org.springframework.ldap.core;LdapTemplate;false;search;;;Argument[0..1];ldap",
         "org.springframework.ldap.core;LdapTemplate;false;searchForContext;;;Argument[0..1];ldap",
         "org.springframework.ldap.core;LdapTemplate;false;searchForObject;;;Argument[0..1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;;;Argument[0];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticationErrorCallback);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[1];ldap",
-        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticationErrorCallback);;Argument[1];ldap"
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(LdapQuery,String);;Argument[0];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(Name,String,String,AuthenticationErrorCallback);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticatedLdapEntryContextCallback,AuthenticationErrorCallback);;Argument[0..1];ldap",
+        "org.springframework.ldap.core;LdapTemplate;false;authenticate;(String,String,String,AuthenticationErrorCallback);;Argument[0..1];ldap"
       ]
   }
 }

From 7581cbade64b922d6482cc16f7e9e472af25110a Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 14:32:56 +0000
Subject: [PATCH 345/433] Python: Fix forgotten type tracker

This was the last remaining type tracker that did not use
`LocalSourceNode`.
---
 python/ql/src/semmle/python/frameworks/Django.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 23c0a814a7a8..efc4aebc49ec 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1303,7 +1303,7 @@ private module PrivateDjango {
         }
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
-        private DataFlow::Node write(
+        private DataFlow::LocalSourceNode write(
           django::http::response::HttpResponse::InstanceSource instance, DataFlow::TypeTracker t
         ) {
           t.startInAttr("write") and
@@ -1315,7 +1315,7 @@ private module PrivateDjango {
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
         DataFlow::Node write(django::http::response::HttpResponse::InstanceSource instance) {
-          result = write(instance, DataFlow::TypeTracker::end())
+          write(instance, DataFlow::TypeTracker::end()).flowsTo(result)
         }
 
         /**

From 2a07441c19c2a80fdc08a13100f27956df1aba3e Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 14:33:42 +0000
Subject: [PATCH 346/433] Python: `ModuleVariableNode`s are not API uses

This caused some suprising test changes, where suddenly we had flow from
a `ModuleVariableNode` (as a `RemoteFlowSource`) to a sink. This of
course makes little sense, so instead we simply exclude these nodes as
uses in the first place.
---
 python/ql/src/semmle/python/ApiGraphs.qll | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 48f303081702..5f71d9d1c408 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -422,9 +422,9 @@ module API {
     }
 
     /**
-     * Gets a data-flow node to which `nd`, which is a use of an API-graph node, flows.
+     * Gets a data-flow node to which `src`, which is a use of an API-graph node, flows.
      *
-     * The flow from `nd` to that node may be inter-procedural.
+     * The flow from `src` to that node may be inter-procedural.
      */
     private DataFlow::LocalSourceNode trackUseNode(
       DataFlow::LocalSourceNode src, DataFlow::TypeTracker t
@@ -436,9 +436,16 @@ module API {
       exists(DataFlow::TypeTracker t2 | result = trackUseNode(src, t2).track(t2, t))
     }
 
+    /**
+     * Gets a data-flow node to which `src`, which is a use of an API-graph node, flows.
+     *
+     * The flow from `src` to that node may be inter-procedural.
+     */
     cached
     DataFlow::LocalSourceNode trackUseNode(DataFlow::LocalSourceNode src) {
-      result = trackUseNode(src, DataFlow::TypeTracker::end())
+      result = trackUseNode(src, DataFlow::TypeTracker::end()) and
+      // We exclude module variable nodes, as these do not correspond to real uses.
+      not result instanceof DataFlow::ModuleVariableNode
     }
 
     /**

From c0569da65c01c9cdc8a554209f5761e2bef91978 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 14:35:11 +0000
Subject: [PATCH 347/433] Python: Move `track`/`backtrack` to `LocalSourceNode`

This is merely making explicit what was implicitly enforced. The move
to change the return type of `step` already meant that `this` and
`result` had to be `LocalSourceNode`. By moving these methods to their
rightful place, we should hopefully avoid a bit of suprising behaviour.
---
 .../2021-04-20-stepsummary-localsourcenode.md    |  2 ++
 .../dataflow/new/internal/DataFlowPublic.qll     | 16 ----------------
 .../dataflow/new/internal/LocalSources.qll       | 16 ++++++++++++++++
 3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/python/change-notes/2021-04-20-stepsummary-localsourcenode.md b/python/change-notes/2021-04-20-stepsummary-localsourcenode.md
index 630dfc4e44a9..2cfda02b8fbd 100644
--- a/python/change-notes/2021-04-20-stepsummary-localsourcenode.md
+++ b/python/change-notes/2021-04-20-stepsummary-localsourcenode.md
@@ -3,3 +3,5 @@ lgtm,codescanning
   to use the more restrictive type `LocalSourceNode` for their second argument. For cases where
   stepping between non-`LocalSourceNode`s is required, the `StepSummary::smallstep` predicate may be
   used instead.
+* The methods `Node::track` and `Node::backtrack` have been moved to the class `LocalSourceNode`. If
+  the old behavior is required, one can use `LocalSourceNode::flowsTo` to add back the missing flow.
\ No newline at end of file
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 6a397175ab13..03912ca1b867 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -119,22 +119,6 @@ class Node extends TNode {
   /** Gets the expression corresponding to this node, if any. */
   Expr asExpr() { none() }
 
-  /**
-   * Gets a node that this node may flow to using one heap and/or interprocedural step.
-   *
-   * See `TypeTracker` for more details about how to use this.
-   */
-  pragma[inline]
-  Node track(TypeTracker t2, TypeTracker t) { t = t2.step(this, result) }
-
-  /**
-   * Gets a node that may flow into this one using one heap and/or interprocedural step.
-   *
-   * See `TypeBackTracker` for more details about how to use this.
-   */
-  pragma[inline]
-  LocalSourceNode backtrack(TypeBackTracker t2, TypeBackTracker t) { t2 = t.step(result, this) }
-
   /**
    * Gets a local source node from which data may flow to this node in zero or more local data-flow steps.
    */
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
index 808aa4cf48bc..c3df5b4841ce 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -77,6 +77,22 @@ class LocalSourceNode extends Node {
    * Gets a call to this node.
    */
   CallCfgNode getACall() { Cached::call(this, result) }
+
+  /**
+   * Gets a node that this node may flow to using one heap and/or interprocedural step.
+   *
+   * See `TypeTracker` for more details about how to use this.
+   */
+  pragma[inline]
+  LocalSourceNode track(TypeTracker t2, TypeTracker t) { t = t2.step(this, result) }
+
+  /**
+   * Gets a node that may flow into this one using one heap and/or interprocedural step.
+   *
+   * See `TypeBackTracker` for more details about how to use this.
+   */
+  pragma[inline]
+  LocalSourceNode backtrack(TypeBackTracker t2, TypeBackTracker t) { t2 = t.step(result, this) }
 }
 
 cached

From 890f96d9b5947cc264597c1bb63852745432fb7e Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 20 Apr 2021 15:01:04 +0000
Subject: [PATCH 348/433] Python: Prevent bad joins in `TypeBackTracker`

Perhaps unsurprisingly, the join orderer was eager and willing to find
the wrong join order in this predicate as well. Applying a similar
fix to the one used in `TypeTracker::step` fixes the problem.
---
 python/ql/src/semmle/python/dataflow/new/TypeTracker.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
index bba7ecf367b9..5dc7bb85b065 100644
--- a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
+++ b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
@@ -411,8 +411,8 @@ class TypeBackTracker extends TTypeBackTracker {
   pragma[inline]
   TypeBackTracker step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo) {
     exists(StepSummary summary |
-      StepSummary::step(nodeFrom, nodeTo, summary) and
-      this = result.prepend(summary)
+      StepSummary::step(pragma[only_bind_out](nodeFrom), nodeTo, pragma[only_bind_into](summary)) and
+      this = result.prepend(pragma[only_bind_into](summary))
     )
   }
 

From fc2c62350ed68fdbc32e2600065c265216339645 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 20 Apr 2021 18:54:03 +0200
Subject: [PATCH 349/433] Python: Fix bad join Also fixed up the QLDoc

---
 python/ql/src/Security/CWE-327/PyOpenSSL.qll  |  4 ++-
 python/ql/src/Security/CWE-327/Ssl.qll        |  6 ++--
 .../src/Security/CWE-327/TlsLibraryModel.qll  | 28 +++++++++----------
 3 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/PyOpenSSL.qll b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
index d886d46efefa..77dde78a75ad 100644
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -16,7 +16,9 @@ class PyOpenSSLContextCreation extends ContextCreation, DataFlow::CallCfgNode {
     exists(ControlFlowNode protocolArg, PyOpenSSL pyo |
       protocolArg in [node.getArg(0), node.getArgByName("method")]
     |
-      protocolArg = [pyo.specific_version(result), pyo.unspecific_version(result)].asCfgNode()
+      protocolArg =
+        [pyo.specific_version(result).getAUse(), pyo.unspecific_version(result).getAUse()]
+            .asCfgNode()
     )
   }
 }
diff --git a/python/ql/src/Security/CWE-327/Ssl.qll b/python/ql/src/Security/CWE-327/Ssl.qll
index e943470e917e..73041e3393f7 100644
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -14,7 +14,9 @@ class SSLContextCreation extends ContextCreation, DataFlow::CallCfgNode {
     exists(ControlFlowNode protocolArg, Ssl ssl |
       protocolArg in [node.getArg(0), node.getArgByName("protocol")]
     |
-      protocolArg = [ssl.specific_version(result), ssl.unspecific_version(result)].asCfgNode()
+      protocolArg =
+        [ssl.specific_version(result).getAUse(), ssl.unspecific_version(result).getAUse()]
+            .asCfgNode()
     )
     or
     not exists(node.getAnArg()) and
@@ -188,7 +190,7 @@ class Ssl extends TlsLibrary {
 
   override DataFlow::CallCfgNode insecure_connection_creation(ProtocolVersion version) {
     result = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
-    this.specific_version(version) = result.getArgByName("ssl_version") and
+    this.specific_version(version).getAUse() = result.getArgByName("ssl_version") and
     version.isInsecure()
   }
 
diff --git a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
index ba54ea3ccd42..3bac0e2299d1 100644
--- a/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
+++ b/python/ql/src/Security/CWE-327/TlsLibraryModel.qll
@@ -91,26 +91,26 @@ abstract class TlsLibrary extends string {
   /** Gets a name, which is a member of `version_constants`,  that can be used to specify the protocol family `family`. */
   abstract string unspecific_version_name(ProtocolFamily family);
 
-  /** The module or class holding the version constants. */
+  /** Gets an API node representing the module or class holding the version constants. */
   abstract API::Node version_constants();
 
-  /** A dataflow node representing a specific protocol version. */
-  DataFlow::Node specific_version(ProtocolVersion version) {
-    result = version_constants().getMember(specific_version_name(version)).getAUse()
+  /** Gets an API node representing a specific protocol version. */
+  API::Node specific_version(ProtocolVersion version) {
+    result = version_constants().getMember(specific_version_name(version))
   }
 
-  /** Gets a dataflow node representing the protocol family `family`. */
-  DataFlow::Node unspecific_version(ProtocolFamily family) {
-    result = version_constants().getMember(unspecific_version_name(family)).getAUse()
+  /** Gets an API node representing the protocol family `family`. */
+  API::Node unspecific_version(ProtocolFamily family) {
+    result = version_constants().getMember(unspecific_version_name(family))
   }
 
-  /** The creation of a context with a default protocol. */
+  /** Gets a creation of a context with a default protocol. */
   abstract ContextCreation default_context_creation();
 
-  /** The creation of a context with a specific protocol. */
+  /** Gets a creation of a context with a specific protocol. */
   abstract ContextCreation specific_context_creation();
 
-  /** The creation of a context with a specific protocol version, known to be insecure. */
+  /** Gets a creation of a context with a specific protocol version, known to be insecure. */
   ContextCreation insecure_context_creation(ProtocolVersion version) {
     result in [specific_context_creation(), default_context_creation()] and
     result.getProtocol() = version and
@@ -123,15 +123,15 @@ abstract class TlsLibrary extends string {
     result.getProtocol() = family
   }
 
-  /** A connection is created in an insecure manner, not from a context. */
+  /** Gets a dataflow node representing a connection being created in an insecure manner, not from a context. */
   abstract DataFlow::Node insecure_connection_creation(ProtocolVersion version);
 
-  /** A connection is created from a context. */
+  /** Gets a dataflow node representing a connection being created from a context. */
   abstract ConnectionCreation connection_creation();
 
-  /** A context is being restricted on which protocols it can accepts. */
+  /** Gets a dataflow node representing a context being restricted on which protocols it can accepts. */
   abstract ProtocolRestriction protocol_restriction();
 
-  /** A context is being relaxed on which protocols it can accepts. */
+  /** Gets a dataflow node representing a context being relaxed on which protocols it can accepts. */
   abstract ProtocolUnrestriction protocol_unrestriction();
 }

From 98a0959784d0b9229dcfcb533ddf27ad740da845 Mon Sep 17 00:00:00 2001
From: Shati Patel <42641846+shati-patel@users.noreply.github.com>
Date: Tue, 20 Apr 2021 18:12:35 +0100
Subject: [PATCH 350/433] Docs: New "directional binding" pragmas

---
 .../ql-language-reference/annotations.rst     | 41 +++++++++++++++++--
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/docs/codeql/ql-language-reference/annotations.rst b/docs/codeql/ql-language-reference/annotations.rst
index ec60e55bf9bd..e801f0a95aa1 100644
--- a/docs/codeql/ql-language-reference/annotations.rst
+++ b/docs/codeql/ql-language-reference/annotations.rst
@@ -259,8 +259,6 @@ This means that it is part of the output of the QL program.
 Compiler pragmas
 ================
 
-**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
-
 The following compiler pragmas affect the compilation and optimization of queries. You
 should avoid using these annotations unless you experience significant performance issues.
 
@@ -284,6 +282,8 @@ predicates.
 ``pragma[inline]``
 ------------------
 
+**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
+
 The ``pragma[inline]`` annotation tells the QL optimizer to always inline the annotated predicate
 into the places where it is called. This can be useful when a predicate body is very expensive to 
 compute entirely, as it ensures that the predicate is evaluated with the other contextual information
@@ -292,6 +292,8 @@ at the places where it is called.
 ``pragma[noinline]``
 --------------------
 
+**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
+
 The ``pragma[noinline]`` annotation is used to prevent a predicate from being inlined into the
 place where it is called. In practice, this annotation is useful when you've already grouped 
 certain variables together in a "helper" predicate, to ensure that the relation is evaluated 
@@ -301,6 +303,8 @@ work of the helper predicate, so it's a good idea to annotate it with ``pragma[n
 ``pragma[nomagic]``
 -------------------
 
+**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
+
 The ``pragma[nomagic]`` annotation is used to prevent the QL optimizer from performing the "magic sets"
 optimization on a predicate. 
 
@@ -314,6 +318,8 @@ Note that ``nomagic`` implies ``noinline``.
 ``pragma[noopt]``
 -----------------
 
+**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
+
 The ``pragma[noopt]`` annotation is used to prevent the QL optimizer from optimizing a
 predicate, except when it's absolutely necessary for compilation and evaluation to work.
 
@@ -364,7 +370,33 @@ When you use this annotation, be aware of the following issues:
            succ.getSucc() = 3
          )
        }
-   
+
+``pragma[only_bind_out]``
+-------------------------
+
+**Available for**: |expressions|
+
+The ``pragma[only_bind_out]`` annotation lets you specify the direction in which the QL compiler should bind expressions.
+This can be useful to improve performance in rare cases where the QL optimizer orders parts of the QL program in an inefficient way.
+
+For example, ``x = pragma[only_bind_out](y)`` is semantically equivalent to ``x = y``, but has different binding behavior. 
+``x = y`` binds ``x`` from ``y`` and vice versa, while ``x = pragma[only_bind_out](y)`` only binds ``x`` from ``y``.
+
+For more information, see ":ref:`Binding <binding>`."
+
+``pragma[only_bind_into]``
+--------------------------
+
+**Available for**: |expressions|
+
+The ``pragma[only_bind_into]`` annotation lets you specify the direction in which the QL compiler should bind expressions.
+This can be useful to improve performance in rare cases where the QL optimizer orders parts of the QL program in an inefficient way.
+
+For example, ``x = pragma[only_bind_into](y)`` is semantically equivalent to ``x = y``, but has different binding behavior. 
+``x = y`` binds ``x`` from ``y`` and vice versa, while ``x = pragma[only_bind_into](y)`` only binds ``y`` from ``x``.
+
+For more information, see ":ref:`Binding <binding>`."
+
 .. _language:
 
 Language pragmas
@@ -413,4 +445,5 @@ The ``bindingset`` annotation takes a comma-separated list of variables.
 .. |fields|                    replace:: :ref:`fields <fields>`
 .. |modules|                   replace:: :ref:`modules <modules>`
 .. |aliases|                   replace:: :ref:`aliases <aliases>`
-.. |algebraic datatypes|       replace:: :ref:`algebraic datatypes <algebraic-datatypes>`
\ No newline at end of file
+.. |algebraic datatypes|       replace:: :ref:`algebraic datatypes <algebraic-datatypes>`
+.. |expressions|               replace:: :ref:`expressions <expressions>`

From 357e1c08025da77deaee293d05fde3eb7c01b2a6 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 20 Apr 2021 19:57:47 +0200
Subject: [PATCH 351/433] Update
 javascript/ql/src/semmle/javascript/frameworks/Markdown.qll

Co-authored-by: Asger F <asgerf@github.com>
---
 javascript/ql/src/semmle/javascript/frameworks/Markdown.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
index 76c90aa2ef37..743341325a7a 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
@@ -139,7 +139,7 @@ private module MarkdownIt {
     exists(API::CallNode call |
       call = markdownIt().getMember(["use", "set", "configure", "enable", "disable"]).getACall() and
       result = call.getReturn() and
-      not call.getParameter(0).getARhs().getALocalSource() =
+      not call.getParameter(0).getAValueReachingRhs() =
         DataFlow::moduleImport("markdown-it-sanitizer")
     )
   }

From 6408ee2eaf9d00f6c0166a277bdc922e9d5db2db Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 20 Apr 2021 20:03:06 +0200
Subject: [PATCH 352/433] Python: Fix bad join

---
 python/ql/src/Security/CWE-327/InsecureProtocol.ql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/Security/CWE-327/InsecureProtocol.ql b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
index 99e2d83420d1..e1d64dca0a70 100644
--- a/python/ql/src/Security/CWE-327/InsecureProtocol.ql
+++ b/python/ql/src/Security/CWE-327/InsecureProtocol.ql
@@ -25,6 +25,8 @@ class ProtocolConfiguration extends DataFlow::Node {
     or
     unsafe_context_creation(this, _)
   }
+
+  AstNode getNode() { result = this.asCfgNode().(CallNode).getFunction().getNode() }
 }
 
 // Helper for pretty printer `callName`.
@@ -36,9 +38,7 @@ class ProtocolConfiguration extends DataFlow::Node {
 // we have to extend @py_ast_node.
 class Nameable extends @py_ast_node {
   Nameable() {
-    exists(ProtocolConfiguration protocolConfiguration |
-      this = protocolConfiguration.asCfgNode().(CallNode).getFunction().getNode()
-    )
+    this = any(ProtocolConfiguration pc).getNode()
     or
     exists(Nameable attr | this = attr.(Attribute).getObject())
   }

From 01a95316c2d8830b6af5a621dbc8c57c672a909b Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 14:03:48 -0400
Subject: [PATCH 353/433] C++: Add `Instruction::getAParameterSideEffect()`.

---
 .../ir/implementation/aliased_ssa/Instruction.qll   | 13 +++++++++++++
 .../code/cpp/ir/implementation/raw/Instruction.qll  | 13 +++++++++++++
 .../ir/implementation/unaliased_ssa/Instruction.qll | 13 +++++++++++++
 .../ir/implementation/raw/Instruction.qll           | 13 +++++++++++++
 .../ir/implementation/unaliased_ssa/Instruction.qll | 13 +++++++++++++
 5 files changed, 65 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
index af6f3d819824..13c384017379 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -1645,6 +1645,19 @@ class CallInstruction extends Instruction {
    * Gets the number of arguments of the call, including the `this` pointer, if any.
    */
   final int getNumberOfArguments() { result = count(this.getAnArgumentOperand()) }
+
+  /**
+   * Holds if the result is a side effect for the argument at the specified index, or `this` if
+   * `index` is `-1`.
+   *
+   * This helper predicate makes it easy to join on both of these columns at once, avoiding
+   * pathological join orders in case the argument index should get joined first.
+   */
+  pragma[noinline]
+  final SideEffectInstruction getAParameterSideEffect(int index) {
+    this = result.getPrimaryInstruction() and
+    index = result.(IndexedInstruction).getIndex()
+  }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
index af6f3d819824..13c384017379 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -1645,6 +1645,19 @@ class CallInstruction extends Instruction {
    * Gets the number of arguments of the call, including the `this` pointer, if any.
    */
   final int getNumberOfArguments() { result = count(this.getAnArgumentOperand()) }
+
+  /**
+   * Holds if the result is a side effect for the argument at the specified index, or `this` if
+   * `index` is `-1`.
+   *
+   * This helper predicate makes it easy to join on both of these columns at once, avoiding
+   * pathological join orders in case the argument index should get joined first.
+   */
+  pragma[noinline]
+  final SideEffectInstruction getAParameterSideEffect(int index) {
+    this = result.getPrimaryInstruction() and
+    index = result.(IndexedInstruction).getIndex()
+  }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
index af6f3d819824..13c384017379 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -1645,6 +1645,19 @@ class CallInstruction extends Instruction {
    * Gets the number of arguments of the call, including the `this` pointer, if any.
    */
   final int getNumberOfArguments() { result = count(this.getAnArgumentOperand()) }
+
+  /**
+   * Holds if the result is a side effect for the argument at the specified index, or `this` if
+   * `index` is `-1`.
+   *
+   * This helper predicate makes it easy to join on both of these columns at once, avoiding
+   * pathological join orders in case the argument index should get joined first.
+   */
+  pragma[noinline]
+  final SideEffectInstruction getAParameterSideEffect(int index) {
+    this = result.getPrimaryInstruction() and
+    index = result.(IndexedInstruction).getIndex()
+  }
 }
 
 /**
diff --git a/csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll b/csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll
index af6f3d819824..13c384017379 100644
--- a/csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll
+++ b/csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll
@@ -1645,6 +1645,19 @@ class CallInstruction extends Instruction {
    * Gets the number of arguments of the call, including the `this` pointer, if any.
    */
   final int getNumberOfArguments() { result = count(this.getAnArgumentOperand()) }
+
+  /**
+   * Holds if the result is a side effect for the argument at the specified index, or `this` if
+   * `index` is `-1`.
+   *
+   * This helper predicate makes it easy to join on both of these columns at once, avoiding
+   * pathological join orders in case the argument index should get joined first.
+   */
+  pragma[noinline]
+  final SideEffectInstruction getAParameterSideEffect(int index) {
+    this = result.getPrimaryInstruction() and
+    index = result.(IndexedInstruction).getIndex()
+  }
 }
 
 /**
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll
index af6f3d819824..13c384017379 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll
@@ -1645,6 +1645,19 @@ class CallInstruction extends Instruction {
    * Gets the number of arguments of the call, including the `this` pointer, if any.
    */
   final int getNumberOfArguments() { result = count(this.getAnArgumentOperand()) }
+
+  /**
+   * Holds if the result is a side effect for the argument at the specified index, or `this` if
+   * `index` is `-1`.
+   *
+   * This helper predicate makes it easy to join on both of these columns at once, avoiding
+   * pathological join orders in case the argument index should get joined first.
+   */
+  pragma[noinline]
+  final SideEffectInstruction getAParameterSideEffect(int index) {
+    this = result.getPrimaryInstruction() and
+    index = result.(IndexedInstruction).getIndex()
+  }
 }
 
 /**

From 5085e462b0f52c2611e64f9bb51061511ce8870e Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 14:09:41 -0400
Subject: [PATCH 354/433] C++: Allow alias propagation to/from side effects
 (part 1)

---
 .../aliased_ssa/internal/AliasAnalysis.qll    | 135 +++++++++---------
 .../unaliased_ssa/internal/AliasAnalysis.qll  | 135 +++++++++---------
 .../unaliased_ssa/internal/AliasAnalysis.qll  | 135 +++++++++---------
 3 files changed, 204 insertions(+), 201 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
index 19fb0490f808..6105187cc1f9 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -34,7 +34,7 @@ private predicate operandIsConsumedWithoutEscaping(Operand operand) {
 
 private predicate operandEscapesDomain(Operand operand) {
   not operandIsConsumedWithoutEscaping(operand) and
-  not operandIsPropagated(operand, _) and
+  not operandIsPropagated(operand, _, _) and
   not isArgumentForParameter(_, operand, _) and
   not isOnlyEscapesViaReturnArgument(operand) and
   not operand.getUse() instanceof ReturnValueInstruction and
@@ -69,67 +69,66 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
 }
 
 /**
- * Holds if any address held in operand `tag` of instruction `instr` is
- * propagated to the result of `instr`, offset by the number of bits in
- * `bitOffset`. If the address is propagated, but the offset is not known to be
- * a constant, then `bitOffset` is unknown.
+ * Holds if any address held in operand `operand` is propagated to the result of `instr`, offset by
+ * the number of bits in `bitOffset`. If the address is propagated, but the offset is not known to
+ * be a constant, then `bitOffset` is `unknown()`.
  */
-private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
-  exists(Instruction instr |
-    instr = operand.getUse() and
-    (
-      // Converting to a non-virtual base class adds the offset of the base class.
-      exists(ConvertToNonVirtualBaseInstruction convert |
-        convert = instr and
-        bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
-      )
-      or
-      // Conversion using dynamic_cast results in an unknown offset
-      instr instanceof CheckedConvertOrNullInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Converting to a derived class subtracts the offset of the base class.
-      exists(ConvertToDerivedInstruction convert |
-        convert = instr and
-        bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
-      )
-      or
-      // Converting to a virtual base class adds an unknown offset.
-      instr instanceof ConvertToVirtualBaseInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Conversion to another pointer type propagates the source address.
-      exists(ConvertInstruction convert, IRType resultType |
-        convert = instr and
-        resultType = convert.getResultIRType() and
-        resultType instanceof IRAddressType and
-        bitOffset = 0
-      )
-      or
-      // Adding an integer to or subtracting an integer from a pointer propagates
-      // the address with an offset.
-      exists(PointerOffsetInstruction ptrOffset |
-        ptrOffset = instr and
-        operand = ptrOffset.getLeftOperand() and
-        bitOffset = getPointerBitOffset(ptrOffset)
-      )
-      or
-      // Computing a field address from a pointer propagates the address plus the
-      // offset of the field.
-      bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
-      or
-      // A copy propagates the source value.
-      operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-      or
-      // Some functions are known to propagate an argument
-      isAlwaysReturnedArgument(operand) and bitOffset = 0
+private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  instr = operand.getUse() and
+  (
+    // Converting to a non-virtual base class adds the offset of the base class.
+    exists(ConvertToNonVirtualBaseInstruction convert |
+      convert = instr and
+      bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
     )
+    or
+    // Conversion using dynamic_cast results in an unknown offset
+    instr instanceof CheckedConvertOrNullInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Converting to a derived class subtracts the offset of the base class.
+    exists(ConvertToDerivedInstruction convert |
+      convert = instr and
+      bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
+    )
+    or
+    // Converting to a virtual base class adds an unknown offset.
+    instr instanceof ConvertToVirtualBaseInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Conversion to another pointer type propagates the source address.
+    exists(ConvertInstruction convert, IRType resultType |
+      convert = instr and
+      resultType = convert.getResultIRType() and
+      resultType instanceof IRAddressType and
+      bitOffset = 0
+    )
+    or
+    // Adding an integer to or subtracting an integer from a pointer propagates
+    // the address with an offset.
+    exists(PointerOffsetInstruction ptrOffset |
+      ptrOffset = instr and
+      operand = ptrOffset.getLeftOperand() and
+      bitOffset = getPointerBitOffset(ptrOffset)
+    )
+    or
+    // Computing a field address from a pointer propagates the address plus the
+    // offset of the field.
+    bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
+    or
+    // A copy propagates the source value.
+    operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
+    or
+    // Some functions are known to propagate an argument
+    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
 private predicate operandEscapesNonReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and resultEscapesNonReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and resultEscapesNonReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -151,9 +150,11 @@ private predicate operandEscapesNonReturn(Operand operand) {
 }
 
 private predicate operandMayReachReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and
-  resultMayReachReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and
+    resultMayReachReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -173,9 +174,9 @@ private predicate operandMayReachReturn(Operand operand) {
 
 private predicate operandReturned(Operand operand, IntValue bitOffset) {
   // The address is propagated to the result of the instruction, and that result itself is returned
-  exists(IntValue bitOffset1, IntValue bitOffset2 |
-    operandIsPropagated(operand, bitOffset1) and
-    resultReturned(operand.getUse(), bitOffset2) and
+  exists(Instruction instr, IntValue bitOffset1, IntValue bitOffset2 |
+    operandIsPropagated(operand, bitOffset1, instr) and
+    resultReturned(instr, bitOffset2) and
     bitOffset = Ints::add(bitOffset1, bitOffset2)
   )
   or
@@ -270,12 +271,13 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset) {
-  operandIsPropagated(operand, bitOffset)
+private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+  operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |
     isArgumentForParameter(call, operand, init) and
-    resultReturned(init, bitOffset)
+    resultReturned(init, bitOffset) and
+    instr = call
   )
 }
 
@@ -292,8 +294,7 @@ private predicate hasBaseAndOffset(AddressOperand addrOperand, Instruction base,
     // We already have an offset from `middle`.
     hasBaseAndOffset(addrOperand, middle, previousBitOffset) and
     // `middle` is propagated from `base`.
-    middleOperand = middle.getAnOperand() and
-    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset) and
+    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset, middle) and
     base = middleOperand.getDef() and
     bitOffset = Ints::add(previousBitOffset, additionalBitOffset)
   )
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 19fb0490f808..6105187cc1f9 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -34,7 +34,7 @@ private predicate operandIsConsumedWithoutEscaping(Operand operand) {
 
 private predicate operandEscapesDomain(Operand operand) {
   not operandIsConsumedWithoutEscaping(operand) and
-  not operandIsPropagated(operand, _) and
+  not operandIsPropagated(operand, _, _) and
   not isArgumentForParameter(_, operand, _) and
   not isOnlyEscapesViaReturnArgument(operand) and
   not operand.getUse() instanceof ReturnValueInstruction and
@@ -69,67 +69,66 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
 }
 
 /**
- * Holds if any address held in operand `tag` of instruction `instr` is
- * propagated to the result of `instr`, offset by the number of bits in
- * `bitOffset`. If the address is propagated, but the offset is not known to be
- * a constant, then `bitOffset` is unknown.
+ * Holds if any address held in operand `operand` is propagated to the result of `instr`, offset by
+ * the number of bits in `bitOffset`. If the address is propagated, but the offset is not known to
+ * be a constant, then `bitOffset` is `unknown()`.
  */
-private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
-  exists(Instruction instr |
-    instr = operand.getUse() and
-    (
-      // Converting to a non-virtual base class adds the offset of the base class.
-      exists(ConvertToNonVirtualBaseInstruction convert |
-        convert = instr and
-        bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
-      )
-      or
-      // Conversion using dynamic_cast results in an unknown offset
-      instr instanceof CheckedConvertOrNullInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Converting to a derived class subtracts the offset of the base class.
-      exists(ConvertToDerivedInstruction convert |
-        convert = instr and
-        bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
-      )
-      or
-      // Converting to a virtual base class adds an unknown offset.
-      instr instanceof ConvertToVirtualBaseInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Conversion to another pointer type propagates the source address.
-      exists(ConvertInstruction convert, IRType resultType |
-        convert = instr and
-        resultType = convert.getResultIRType() and
-        resultType instanceof IRAddressType and
-        bitOffset = 0
-      )
-      or
-      // Adding an integer to or subtracting an integer from a pointer propagates
-      // the address with an offset.
-      exists(PointerOffsetInstruction ptrOffset |
-        ptrOffset = instr and
-        operand = ptrOffset.getLeftOperand() and
-        bitOffset = getPointerBitOffset(ptrOffset)
-      )
-      or
-      // Computing a field address from a pointer propagates the address plus the
-      // offset of the field.
-      bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
-      or
-      // A copy propagates the source value.
-      operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-      or
-      // Some functions are known to propagate an argument
-      isAlwaysReturnedArgument(operand) and bitOffset = 0
+private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  instr = operand.getUse() and
+  (
+    // Converting to a non-virtual base class adds the offset of the base class.
+    exists(ConvertToNonVirtualBaseInstruction convert |
+      convert = instr and
+      bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
     )
+    or
+    // Conversion using dynamic_cast results in an unknown offset
+    instr instanceof CheckedConvertOrNullInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Converting to a derived class subtracts the offset of the base class.
+    exists(ConvertToDerivedInstruction convert |
+      convert = instr and
+      bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
+    )
+    or
+    // Converting to a virtual base class adds an unknown offset.
+    instr instanceof ConvertToVirtualBaseInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Conversion to another pointer type propagates the source address.
+    exists(ConvertInstruction convert, IRType resultType |
+      convert = instr and
+      resultType = convert.getResultIRType() and
+      resultType instanceof IRAddressType and
+      bitOffset = 0
+    )
+    or
+    // Adding an integer to or subtracting an integer from a pointer propagates
+    // the address with an offset.
+    exists(PointerOffsetInstruction ptrOffset |
+      ptrOffset = instr and
+      operand = ptrOffset.getLeftOperand() and
+      bitOffset = getPointerBitOffset(ptrOffset)
+    )
+    or
+    // Computing a field address from a pointer propagates the address plus the
+    // offset of the field.
+    bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
+    or
+    // A copy propagates the source value.
+    operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
+    or
+    // Some functions are known to propagate an argument
+    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
 private predicate operandEscapesNonReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and resultEscapesNonReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and resultEscapesNonReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -151,9 +150,11 @@ private predicate operandEscapesNonReturn(Operand operand) {
 }
 
 private predicate operandMayReachReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and
-  resultMayReachReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and
+    resultMayReachReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -173,9 +174,9 @@ private predicate operandMayReachReturn(Operand operand) {
 
 private predicate operandReturned(Operand operand, IntValue bitOffset) {
   // The address is propagated to the result of the instruction, and that result itself is returned
-  exists(IntValue bitOffset1, IntValue bitOffset2 |
-    operandIsPropagated(operand, bitOffset1) and
-    resultReturned(operand.getUse(), bitOffset2) and
+  exists(Instruction instr, IntValue bitOffset1, IntValue bitOffset2 |
+    operandIsPropagated(operand, bitOffset1, instr) and
+    resultReturned(instr, bitOffset2) and
     bitOffset = Ints::add(bitOffset1, bitOffset2)
   )
   or
@@ -270,12 +271,13 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset) {
-  operandIsPropagated(operand, bitOffset)
+private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+  operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |
     isArgumentForParameter(call, operand, init) and
-    resultReturned(init, bitOffset)
+    resultReturned(init, bitOffset) and
+    instr = call
   )
 }
 
@@ -292,8 +294,7 @@ private predicate hasBaseAndOffset(AddressOperand addrOperand, Instruction base,
     // We already have an offset from `middle`.
     hasBaseAndOffset(addrOperand, middle, previousBitOffset) and
     // `middle` is propagated from `base`.
-    middleOperand = middle.getAnOperand() and
-    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset) and
+    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset, middle) and
     base = middleOperand.getDef() and
     bitOffset = Ints::add(previousBitOffset, additionalBitOffset)
   )
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 19fb0490f808..6105187cc1f9 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -34,7 +34,7 @@ private predicate operandIsConsumedWithoutEscaping(Operand operand) {
 
 private predicate operandEscapesDomain(Operand operand) {
   not operandIsConsumedWithoutEscaping(operand) and
-  not operandIsPropagated(operand, _) and
+  not operandIsPropagated(operand, _, _) and
   not isArgumentForParameter(_, operand, _) and
   not isOnlyEscapesViaReturnArgument(operand) and
   not operand.getUse() instanceof ReturnValueInstruction and
@@ -69,67 +69,66 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
 }
 
 /**
- * Holds if any address held in operand `tag` of instruction `instr` is
- * propagated to the result of `instr`, offset by the number of bits in
- * `bitOffset`. If the address is propagated, but the offset is not known to be
- * a constant, then `bitOffset` is unknown.
+ * Holds if any address held in operand `operand` is propagated to the result of `instr`, offset by
+ * the number of bits in `bitOffset`. If the address is propagated, but the offset is not known to
+ * be a constant, then `bitOffset` is `unknown()`.
  */
-private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
-  exists(Instruction instr |
-    instr = operand.getUse() and
-    (
-      // Converting to a non-virtual base class adds the offset of the base class.
-      exists(ConvertToNonVirtualBaseInstruction convert |
-        convert = instr and
-        bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
-      )
-      or
-      // Conversion using dynamic_cast results in an unknown offset
-      instr instanceof CheckedConvertOrNullInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Converting to a derived class subtracts the offset of the base class.
-      exists(ConvertToDerivedInstruction convert |
-        convert = instr and
-        bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
-      )
-      or
-      // Converting to a virtual base class adds an unknown offset.
-      instr instanceof ConvertToVirtualBaseInstruction and
-      bitOffset = Ints::unknown()
-      or
-      // Conversion to another pointer type propagates the source address.
-      exists(ConvertInstruction convert, IRType resultType |
-        convert = instr and
-        resultType = convert.getResultIRType() and
-        resultType instanceof IRAddressType and
-        bitOffset = 0
-      )
-      or
-      // Adding an integer to or subtracting an integer from a pointer propagates
-      // the address with an offset.
-      exists(PointerOffsetInstruction ptrOffset |
-        ptrOffset = instr and
-        operand = ptrOffset.getLeftOperand() and
-        bitOffset = getPointerBitOffset(ptrOffset)
-      )
-      or
-      // Computing a field address from a pointer propagates the address plus the
-      // offset of the field.
-      bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
-      or
-      // A copy propagates the source value.
-      operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-      or
-      // Some functions are known to propagate an argument
-      isAlwaysReturnedArgument(operand) and bitOffset = 0
+private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  instr = operand.getUse() and
+  (
+    // Converting to a non-virtual base class adds the offset of the base class.
+    exists(ConvertToNonVirtualBaseInstruction convert |
+      convert = instr and
+      bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
     )
+    or
+    // Conversion using dynamic_cast results in an unknown offset
+    instr instanceof CheckedConvertOrNullInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Converting to a derived class subtracts the offset of the base class.
+    exists(ConvertToDerivedInstruction convert |
+      convert = instr and
+      bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
+    )
+    or
+    // Converting to a virtual base class adds an unknown offset.
+    instr instanceof ConvertToVirtualBaseInstruction and
+    bitOffset = Ints::unknown()
+    or
+    // Conversion to another pointer type propagates the source address.
+    exists(ConvertInstruction convert, IRType resultType |
+      convert = instr and
+      resultType = convert.getResultIRType() and
+      resultType instanceof IRAddressType and
+      bitOffset = 0
+    )
+    or
+    // Adding an integer to or subtracting an integer from a pointer propagates
+    // the address with an offset.
+    exists(PointerOffsetInstruction ptrOffset |
+      ptrOffset = instr and
+      operand = ptrOffset.getLeftOperand() and
+      bitOffset = getPointerBitOffset(ptrOffset)
+    )
+    or
+    // Computing a field address from a pointer propagates the address plus the
+    // offset of the field.
+    bitOffset = Language::getFieldBitOffset(instr.(FieldAddressInstruction).getField())
+    or
+    // A copy propagates the source value.
+    operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
+    or
+    // Some functions are known to propagate an argument
+    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
 private predicate operandEscapesNonReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and resultEscapesNonReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and resultEscapesNonReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -151,9 +150,11 @@ private predicate operandEscapesNonReturn(Operand operand) {
 }
 
 private predicate operandMayReachReturn(Operand operand) {
-  // The address is propagated to the result of the instruction, and that result itself is returned
-  operandIsPropagated(operand, _) and
-  resultMayReachReturn(operand.getUse())
+  exists(Instruction instr |
+    // The address is propagated to the result of the instruction, and that result itself is returned
+    operandIsPropagated(operand, _, instr) and
+    resultMayReachReturn(instr)
+  )
   or
   // The operand is used in a function call which returns it, and the return value is then returned
   exists(CallInstruction ci, Instruction init |
@@ -173,9 +174,9 @@ private predicate operandMayReachReturn(Operand operand) {
 
 private predicate operandReturned(Operand operand, IntValue bitOffset) {
   // The address is propagated to the result of the instruction, and that result itself is returned
-  exists(IntValue bitOffset1, IntValue bitOffset2 |
-    operandIsPropagated(operand, bitOffset1) and
-    resultReturned(operand.getUse(), bitOffset2) and
+  exists(Instruction instr, IntValue bitOffset1, IntValue bitOffset2 |
+    operandIsPropagated(operand, bitOffset1, instr) and
+    resultReturned(instr, bitOffset2) and
     bitOffset = Ints::add(bitOffset1, bitOffset2)
   )
   or
@@ -270,12 +271,13 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset) {
-  operandIsPropagated(operand, bitOffset)
+private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+  operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |
     isArgumentForParameter(call, operand, init) and
-    resultReturned(init, bitOffset)
+    resultReturned(init, bitOffset) and
+    instr = call
   )
 }
 
@@ -292,8 +294,7 @@ private predicate hasBaseAndOffset(AddressOperand addrOperand, Instruction base,
     // We already have an offset from `middle`.
     hasBaseAndOffset(addrOperand, middle, previousBitOffset) and
     // `middle` is propagated from `base`.
-    middleOperand = middle.getAnOperand() and
-    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset) and
+    operandIsPropagatedIncludingByCall(middleOperand, additionalBitOffset, middle) and
     base = middleOperand.getDef() and
     bitOffset = Ints::add(previousBitOffset, additionalBitOffset)
   )

From 45968efd283d185b89103fa2a3cf7868d22928e8 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 18:21:50 -0400
Subject: [PATCH 355/433] C++: Add shared test headers to emulate standard
 library types

---
 cpp/ql/test/include/memory.h      | 137 ++++++++++++++++++++++++++++++
 cpp/ql/test/include/type_traits.h |  21 +++++
 cpp/ql/test/include/utility.h     |  13 +++
 3 files changed, 171 insertions(+)
 create mode 100644 cpp/ql/test/include/memory.h
 create mode 100644 cpp/ql/test/include/type_traits.h
 create mode 100644 cpp/ql/test/include/utility.h

diff --git a/cpp/ql/test/include/memory.h b/cpp/ql/test/include/memory.h
new file mode 100644
index 000000000000..5d5c55ed989e
--- /dev/null
+++ b/cpp/ql/test/include/memory.h
@@ -0,0 +1,137 @@
+#if !defined(CODEQL_MEMORY_H)
+#define CODEQL_MEMORY_H
+
+namespace std {
+  namespace detail {
+    template<typename T>
+    class compressed_pair_element {
+      T element;
+
+    public:
+      compressed_pair_element() = default;
+      compressed_pair_element(const T& t) : element(t) {}
+      
+      T& get() { return element; }
+
+      const T& get() const { return element; }
+    };
+
+    template<typename T, typename U>
+    struct compressed_pair : private compressed_pair_element<T>, private compressed_pair_element<U> {
+      compressed_pair() = default;
+      compressed_pair(T& t) : compressed_pair_element<T>(t), compressed_pair_element<U>() {}
+      compressed_pair(const compressed_pair&) = delete;
+      compressed_pair(compressed_pair<T, U>&&) noexcept = default;
+
+      T& first() { return static_cast<compressed_pair_element<T>&>(*this).get(); }
+      U& second() { return static_cast<compressed_pair_element<U>&>(*this).get(); }
+
+      const T& first() const { return static_cast<const compressed_pair_element<T>&>(*this).get(); }
+      const U& second() const { return static_cast<const compressed_pair_element<U>&>(*this).get(); }
+    };
+  }
+
+  template<class T>
+  struct default_delete {
+    void operator()(T* ptr) const { delete ptr; }
+  };
+
+  template<class T>
+  struct default_delete<T[]> {
+    template<class U>
+    void operator()(U* ptr) const { delete[] ptr; }
+  };
+
+  template<class T, class Deleter = default_delete<T> >
+  class unique_ptr {
+  private:
+    detail::compressed_pair<T*, Deleter> data;
+  public:
+    constexpr unique_ptr() noexcept {}
+    explicit unique_ptr(T* ptr) noexcept : data(ptr) {}
+    unique_ptr(const unique_ptr& ptr) = delete;
+    unique_ptr(unique_ptr&& ptr) noexcept = default;
+
+    unique_ptr& operator=(unique_ptr&& ptr) noexcept = default;
+
+    T& operator*() const { return *get(); }
+    T* operator->() const noexcept { return get(); }
+
+    T* get() const noexcept { return data.first(); }
+    T* release() noexcept { 
+        Deleter& d = data.second();
+        d(data.first());
+        data.first() = nullptr;
+    }
+
+    ~unique_ptr() {
+      Deleter& d = data.second();
+      d(data.first());
+    }
+  };
+  
+  template<typename T, class... Args> unique_ptr<T> make_unique(Args&&... args) {
+    return unique_ptr<T>(new T(args...)); // std::forward calls elided for simplicity.
+  }
+
+  class ctrl_block {
+    unsigned uses;
+
+  public:
+    ctrl_block() : uses(1) {}
+
+    void inc() { ++uses; }
+    bool dec() { return --uses == 0; }
+
+    virtual void destroy() = 0;
+    virtual ~ctrl_block() {}
+  };
+
+  template<typename T, class Deleter = default_delete<T> >
+  struct ctrl_block_impl: public ctrl_block {
+    T* ptr;
+    Deleter d;
+
+    ctrl_block_impl(T* ptr, Deleter d) : ptr(ptr), d(d) {}
+    virtual void destroy() override { d(ptr); }
+  };
+
+  template<class T>
+  class shared_ptr {
+  private:
+    ctrl_block* ctrl;
+    T* ptr;
+
+    void dec() {
+      if(ctrl->dec()) {
+        ctrl->destroy();
+        delete ctrl;
+      }
+    }
+
+    void inc() {
+      ctrl->inc();
+    }
+
+  public:
+    constexpr shared_ptr() noexcept = default;
+    shared_ptr(T* ptr) : ctrl(new ctrl_block_impl<T>(ptr, default_delete<T>())) {}
+    shared_ptr(const shared_ptr& s) noexcept : ptr(s.ptr), ctrl(s.ctrl) {
+      inc();
+    }
+    shared_ptr(shared_ptr&& s) noexcept = default;
+    shared_ptr(unique_ptr<T>&& s) : shared_ptr(s.release()) {
+    }
+    T* operator->() const { return ptr; }
+
+    T& operator*() const { return *ptr; }
+
+    ~shared_ptr() { dec(); }
+  };
+
+  template<typename T, class... Args> shared_ptr<T> make_shared(Args&&... args) {
+    return shared_ptr<T>(new T(args...)); // std::forward calls elided for simplicity.
+  }
+}
+
+#endif
\ No newline at end of file
diff --git a/cpp/ql/test/include/type_traits.h b/cpp/ql/test/include/type_traits.h
new file mode 100644
index 000000000000..19bdd46906be
--- /dev/null
+++ b/cpp/ql/test/include/type_traits.h
@@ -0,0 +1,21 @@
+#if !defined(CODEQL_TYPE_TRAITS_H)
+#define CODEQL_TYPE_TRAITS_H
+
+namespace std {
+    template<typename T>
+    struct remove_reference {
+        typedef T type;
+    };
+
+    template<typename T>
+    struct remove_reference<T&> {
+        typedef T type;
+    };
+
+    template<typename T>
+    struct remove_reference<T&&> {
+        typedef T type;
+    };
+}
+
+#endif
diff --git a/cpp/ql/test/include/utility.h b/cpp/ql/test/include/utility.h
new file mode 100644
index 000000000000..24c8572886db
--- /dev/null
+++ b/cpp/ql/test/include/utility.h
@@ -0,0 +1,13 @@
+#if !defined(CODEQL_UTILITY_H)
+#define CODEQL_UTILITY_H
+
+#include "type_traits.h"
+
+namespace std {
+    template<typename T>
+    typename remove_reference<T>::type&& move(T&& src) {
+        return static_cast<typename remove_reference<T>::type&&>(src);
+    }
+}
+
+#endif

From 078d2522d29566f99c2e41f51f2dd06e318eb400 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 19:40:36 -0400
Subject: [PATCH 356/433] C++: Add missing `shared_ptr<T>` members

---
 cpp/ql/test/include/memory.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cpp/ql/test/include/memory.h b/cpp/ql/test/include/memory.h
index 5d5c55ed989e..fdd09a7d43b5 100644
--- a/cpp/ql/test/include/memory.h
+++ b/cpp/ql/test/include/memory.h
@@ -126,6 +126,8 @@ namespace std {
 
     T& operator*() const { return *ptr; }
 
+    T* get() const noexcept { return ptr; }
+
     ~shared_ptr() { dec(); }
   };
 

From 63fe4fb317c7f73e159831b92a82cf851681bafe Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 19:41:15 -0400
Subject: [PATCH 357/433] C++: More general model for pointer flow

---
 .../src/semmle/code/cpp/models/interfaces/Alias.qll | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/Alias.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/Alias.qll
index 083bbf55c388..e947a93fc908 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/Alias.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/Alias.qll
@@ -50,5 +50,16 @@ abstract class AliasFunction extends Function {
   /**
    * Holds if the function always returns the value of the parameter at the specified index.
    */
-  abstract predicate parameterIsAlwaysReturned(int index);
+  predicate parameterIsAlwaysReturned(int index) { none() }
+
+  /**
+   * Holds if the address passed in via `input` is always propagated to `output`.
+   */
+  predicate hasAddressFlow(FunctionInput input, FunctionOutput output) {
+    exists(int index |
+      // By default, just use the old `parameterIsAlwaysReturned` predicate to detect flow from the
+      // parameter to the return value.
+      input.isParameter(index) and output.isReturnValue() and this.parameterIsAlwaysReturned(index)
+    )
+  }
 }

From a447b049fc9a46e5c8d23e3176eeab469a169cc9 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 19:42:06 -0400
Subject: [PATCH 358/433] C++: Impoved alias analysis of smart pointers

---
 .../aliased_ssa/internal/AliasAnalysis.qll    |  83 +++++++++--
 .../internal/AliasConfiguration.qll           |  16 ++-
 .../unaliased_ssa/internal/AliasAnalysis.qll  |  83 +++++++++--
 .../models/implementations/SmartPointer.qll   | 133 ++++++++++++++----
 .../library-tests/ir/points_to/points_to.ql   |  19 ++-
 .../ir/points_to/smart_pointer.cpp            |  33 +++++
 .../unaliased_ssa/internal/AliasAnalysis.qll  |  83 +++++++++--
 7 files changed, 386 insertions(+), 64 deletions(-)
 create mode 100644 cpp/ql/test/library-tests/ir/points_to/smart_pointer.cpp

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
index 6105187cc1f9..b745554f8df6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -4,6 +4,71 @@ private import AliasAnalysisImports
 
 private class IntValue = Ints::IntValue;
 
+/**
+ * If `instr` is a `SideEffectInstruction`, gets the primary `CallInstruction` that caused the side
+ * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
+ */
+private CallInstruction getPrimaryCall(Instruction instr) {
+  result = instr.(CallInstruction)
+  or
+  result = instr.(SideEffectInstruction).getPrimaryInstruction()
+}
+
+/**
+ * Holds if `operand` serves as an input argument (or indirection) to `call`, in the position
+ * specified by `input`.
+ */
+private predicate isCallInput(
+  CallInstruction call, Operand operand, AliasModels::FunctionInput input
+) {
+  call = getPrimaryCall(operand.getUse()) and
+  (
+    exists(int index |
+      input.isParameterOrQualifierAddress(index) and
+      operand = call.getArgumentOperand(index)
+    )
+    or
+    exists(int index, ReadSideEffectInstruction read |
+      input.isParameterDerefOrQualifierObject(index) and
+      read = call.getAParameterSideEffect(index) and
+      operand = read.getSideEffectOperand()
+    )
+  )
+}
+
+/**
+ * Holds if `instr` serves as a return value or output argument indirection for `call`, in the
+ * position specified by `output`.
+ */
+private predicate isCallOutput(
+  CallInstruction call, Instruction instr, AliasModels::FunctionOutput output
+) {
+  call = getPrimaryCall(instr) and
+  (
+    output.isReturnValue() and instr = call
+    or
+    exists(int index, WriteSideEffectInstruction write |
+      output.isParameterDerefOrQualifierObject(index) and
+      write = call.getAParameterSideEffect(index) and
+      instr = write
+    )
+  )
+}
+
+/**
+ * Holds if the address in `operand` flows directly to the result of `resultInstr` due to modeled
+ * address flow through a function call.
+ */
+private predicate hasAddressFlowThroughCall(Operand operand, Instruction resultInstr) {
+  exists(
+    CallInstruction call, AliasModels::FunctionInput input, AliasModels::FunctionOutput output
+  |
+    call.getStaticCallTarget().(AliasModels::AliasFunction).hasAddressFlow(input, output) and
+    isCallInput(call, operand, input) and
+    isCallOutput(call, resultInstr, output)
+  )
+}
+
 /**
  * Holds if the operand `tag` of instruction `instr` is used in a way that does
  * not result in any address held in that operand from escaping beyond the
@@ -74,6 +139,10 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
  * be a constant, then `bitOffset` is `unknown()`.
  */
 private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  // Some functions are known to propagate an argument
+  hasAddressFlowThroughCall(operand, instr) and
+  bitOffset = 0
+  or
   instr = operand.getUse() and
   (
     // Converting to a non-virtual base class adds the offset of the base class.
@@ -118,9 +187,6 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instr
     or
     // A copy propagates the source value.
     operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-    or
-    // Some functions are known to propagate an argument
-    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
@@ -215,13 +281,6 @@ private predicate isArgumentForParameter(
   )
 }
 
-private predicate isAlwaysReturnedArgument(Operand operand) {
-  exists(AliasModels::AliasFunction f |
-    f = operand.getUse().(CallInstruction).getStaticCallTarget() and
-    f.parameterIsAlwaysReturned(operand.(PositionalArgumentOperand).getIndex())
-  )
-}
-
 private predicate isOnlyEscapesViaReturnArgument(Operand operand) {
   exists(AliasModels::AliasFunction f |
     f = operand.getUse().(CallInstruction).getStaticCallTarget() and
@@ -271,7 +330,9 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+private predicate operandIsPropagatedIncludingByCall(
+  Operand operand, IntValue bitOffset, Instruction instr
+) {
   operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
index 69cd6e6dc291..866afb64b31a 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
@@ -105,7 +105,21 @@ class DynamicAllocation extends Allocation, TDynamicAllocation {
   DynamicAllocation() { this = TDynamicAllocation(call) }
 
   final override string toString() {
-    result = call.toString() + " at " + call.getLocation() // This isn't performant, but it's only used in test/dump code right now.
+    // This isn't performant, but it's only used in test/dump code right now.
+    // Dynamic allocations within a function are numbered in the order by start
+    // line number. This keeps them stable when the function moves within the
+    // file, or when non-allocating lines are added and removed within the
+    // function.
+    exists(int i |
+      result = "dynamic{" + i.toString() + "}" and
+      call =
+        rank[i](CallInstruction rangeCall |
+          exists(TDynamicAllocation(rangeCall)) and
+          rangeCall.getEnclosingIRFunction() = call.getEnclosingIRFunction()
+        |
+          rangeCall order by rangeCall.getLocation().getStartLine()
+        )
+    )
   }
 
   final override CallInstruction getABaseInstruction() { result = call }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 6105187cc1f9..b745554f8df6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -4,6 +4,71 @@ private import AliasAnalysisImports
 
 private class IntValue = Ints::IntValue;
 
+/**
+ * If `instr` is a `SideEffectInstruction`, gets the primary `CallInstruction` that caused the side
+ * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
+ */
+private CallInstruction getPrimaryCall(Instruction instr) {
+  result = instr.(CallInstruction)
+  or
+  result = instr.(SideEffectInstruction).getPrimaryInstruction()
+}
+
+/**
+ * Holds if `operand` serves as an input argument (or indirection) to `call`, in the position
+ * specified by `input`.
+ */
+private predicate isCallInput(
+  CallInstruction call, Operand operand, AliasModels::FunctionInput input
+) {
+  call = getPrimaryCall(operand.getUse()) and
+  (
+    exists(int index |
+      input.isParameterOrQualifierAddress(index) and
+      operand = call.getArgumentOperand(index)
+    )
+    or
+    exists(int index, ReadSideEffectInstruction read |
+      input.isParameterDerefOrQualifierObject(index) and
+      read = call.getAParameterSideEffect(index) and
+      operand = read.getSideEffectOperand()
+    )
+  )
+}
+
+/**
+ * Holds if `instr` serves as a return value or output argument indirection for `call`, in the
+ * position specified by `output`.
+ */
+private predicate isCallOutput(
+  CallInstruction call, Instruction instr, AliasModels::FunctionOutput output
+) {
+  call = getPrimaryCall(instr) and
+  (
+    output.isReturnValue() and instr = call
+    or
+    exists(int index, WriteSideEffectInstruction write |
+      output.isParameterDerefOrQualifierObject(index) and
+      write = call.getAParameterSideEffect(index) and
+      instr = write
+    )
+  )
+}
+
+/**
+ * Holds if the address in `operand` flows directly to the result of `resultInstr` due to modeled
+ * address flow through a function call.
+ */
+private predicate hasAddressFlowThroughCall(Operand operand, Instruction resultInstr) {
+  exists(
+    CallInstruction call, AliasModels::FunctionInput input, AliasModels::FunctionOutput output
+  |
+    call.getStaticCallTarget().(AliasModels::AliasFunction).hasAddressFlow(input, output) and
+    isCallInput(call, operand, input) and
+    isCallOutput(call, resultInstr, output)
+  )
+}
+
 /**
  * Holds if the operand `tag` of instruction `instr` is used in a way that does
  * not result in any address held in that operand from escaping beyond the
@@ -74,6 +139,10 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
  * be a constant, then `bitOffset` is `unknown()`.
  */
 private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  // Some functions are known to propagate an argument
+  hasAddressFlowThroughCall(operand, instr) and
+  bitOffset = 0
+  or
   instr = operand.getUse() and
   (
     // Converting to a non-virtual base class adds the offset of the base class.
@@ -118,9 +187,6 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instr
     or
     // A copy propagates the source value.
     operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-    or
-    // Some functions are known to propagate an argument
-    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
@@ -215,13 +281,6 @@ private predicate isArgumentForParameter(
   )
 }
 
-private predicate isAlwaysReturnedArgument(Operand operand) {
-  exists(AliasModels::AliasFunction f |
-    f = operand.getUse().(CallInstruction).getStaticCallTarget() and
-    f.parameterIsAlwaysReturned(operand.(PositionalArgumentOperand).getIndex())
-  )
-}
-
 private predicate isOnlyEscapesViaReturnArgument(Operand operand) {
   exists(AliasModels::AliasFunction f |
     f = operand.getUse().(CallInstruction).getStaticCallTarget() and
@@ -271,7 +330,9 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+private predicate operandIsPropagatedIncludingByCall(
+  Operand operand, IntValue bitOffset, Instruction instr
+) {
   operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index 4b060c234f89..ea60bd9d5464 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -1,12 +1,14 @@
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.SideEffect
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.DataFlow
 import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
- * The `std::shared_ptr` and `std::unique_ptr` template classes.
+ * The `std::shared_ptr`, `std::weak_ptr`, and `std::unique_ptr` template classes.
  */
-private class UniqueOrSharedPtr extends Class, PointerWrapper {
-  UniqueOrSharedPtr() { this.hasQualifiedName(["std", "bsl"], ["shared_ptr", "unique_ptr"]) }
+private class SmartPtr extends Class, PointerWrapper {
+  SmartPtr() { this.hasQualifiedName(["std", "bsl"], ["shared_ptr", "weak_ptr", "unique_ptr"]) }
 
   override MemberFunction getAnUnwrapperFunction() {
     result.(OverloadedPointerDereferenceFunction).getDeclaringType() = this
@@ -17,11 +19,36 @@ private class UniqueOrSharedPtr extends Class, PointerWrapper {
   override predicate pointsToConst() { this.getTemplateArgument(0).(Type).isConst() }
 }
 
-/** Any function that unwraps a pointer wrapper class to reveal the underlying pointer. */
-private class PointerWrapperDataFlow extends DataFlowFunction {
-  PointerWrapperDataFlow() {
-    this = any(PointerWrapper wrapper).getAnUnwrapperFunction() and
-    not this.getUnspecifiedType() instanceof ReferenceType
+/**
+ * Any function that returns the address wrapped by a `PointerWrapper`, whether as a pointer or a
+ * reference.
+ *
+ * Examples:
+ * - `std::unique_ptr<T>::get()`
+ * - `std::shared_ptr<T>::operator->()`
+ * - `std::weak_ptr<T>::operator*()`
+ */
+private class PointerUnwrapperFunction extends MemberFunction, AliasFunction, DataFlowFunction,
+  SideEffectFunction, TaintFunction {
+  PointerUnwrapperFunction() {
+    exists(PointerWrapper wrapper | wrapper.getAnUnwrapperFunction() = this)
+  }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    // Only reads from `*this`.
+    i = -1 and buffer = false
+  }
+
+  override predicate parameterNeverEscapes(int index) { index = -1 }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate hasAddressFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and output.isReturnValue()
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -32,6 +59,11 @@ private class PointerWrapperDataFlow extends DataFlowFunction {
     input.isReturnValueDeref() and
     output.isQualifierObject()
   }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
 }
 
 /**
@@ -62,31 +94,80 @@ private class MakeUniqueOrShared extends TaintFunction {
 }
 
 /**
- * A prefix `operator*` member function for a `shared_ptr` or `unique_ptr` type.
+ * A function that sets the value of a smart pointer.
+ *
+ * This could be a constructor, an assignment operator, or a named member function like `reset()`.
  */
-private class UniqueOrSharedDereferenceMemberOperator extends MemberFunction, TaintFunction {
-  UniqueOrSharedDereferenceMemberOperator() {
-    this.hasName("operator*") and
-    this.getDeclaringType() instanceof UniqueOrSharedPtr
+private class SmartPtrSetterFunction extends MemberFunction, AliasFunction, SideEffectFunction {
+  SmartPtrSetterFunction() {
+    this.getDeclaringType() instanceof SmartPtr and
+    not this.isStatic() and
+    (
+      this instanceof Constructor
+      or
+      this.hasName("operator=")
+      or
+      this.hasName("reset")
+    )
   }
 
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierObject() and
-    output.isReturnValueDeref()
+  override predicate hasOnlySpecificReadSideEffects() { this instanceof Constructor }
+
+  override predicate hasOnlySpecificWriteSideEffects() { this instanceof ConstMemberFunction }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    // Always write to the destination smart pointer itself.
+    i = -1 and buffer = false and mustWrite = true
+    or
+    // When taking ownership of a smart pointer via an rvalue reference, always overwrite the input
+    // smart pointer.
+    getPointerInput().isParameterDeref(i) and
+    this.getParameter(i).getUnspecifiedType() instanceof RValueReferenceType and
+    buffer = false and
+    mustWrite = true
   }
-}
 
-/**
- * The `std::shared_ptr` or `std::unique_ptr` function `get`.
- */
-private class UniqueOrSharedGet extends TaintFunction {
-  UniqueOrSharedGet() {
-    this.hasName("get") and
-    this.getDeclaringType() instanceof UniqueOrSharedPtr
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    getPointerInput().isParameterDeref(i) and
+    buffer = false
+    or
+    not this instanceof Constructor and
+    i = -1 and
+    buffer = false
   }
 
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierObject() and
+  override predicate parameterNeverEscapes(int index) { index = -1 }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate hasAddressFlow(FunctionInput input, FunctionOutput output) {
+    input = getPointerInput() and
+    output.isQualifierObject()
+    or
+    // Assignment operator always returns a reference to `*this`.
+    this.hasName("operator=") and
+    input.isQualifierAddress() and
     output.isReturnValue()
   }
+
+  private FunctionInput getPointerInput() {
+    exists(Parameter param0 |
+      param0 = this.getParameter(0) and
+      (
+        param0.getUnspecifiedType().(ReferenceType).getBaseType() instanceof SmartPtr and
+        if this.getParameter(1).getUnspecifiedType() instanceof PointerType
+        then
+          // This is one of the constructors of `std::shared_ptr<T>` that creates a smart pointer that
+          // wraps a raw pointer with ownership controlled by an unrelated smart pointer. We propagate
+          // the raw pointer in the second parameter, rather than the smart pointer in the first
+          // parameter.
+          result.isParameter(1)
+        else result.isParameterDeref(0)
+      )
+      or
+      // One of the functions that takes ownership of a raw pointer.
+      param0.getUnspecifiedType() instanceof PointerType and
+      result.isParameter(0)
+    )
+  }
 }
diff --git a/cpp/ql/test/library-tests/ir/points_to/points_to.ql b/cpp/ql/test/library-tests/ir/points_to/points_to.ql
index 89d1e31e119b..da090c5552ee 100644
--- a/cpp/ql/test/library-tests/ir/points_to/points_to.ql
+++ b/cpp/ql/test/library-tests/ir/points_to/points_to.ql
@@ -5,7 +5,16 @@ private import semmle.code.cpp.ir.internal.IntegerConstant as Ints
 private predicate ignoreAllocation(string name) {
   name = "i" or
   name = "p" or
-  name = "q"
+  name = "q" or
+  name = "s" or
+  name = "t" or
+  name = "?{AllAliased}"
+}
+
+private predicate ignoreFile(File file) {
+  // Ignore standard headers.
+  file.getBaseName() = ["memory.h", "type_traits.h", "utility.h"] or
+  not file.fromSource()
 }
 
 module Raw {
@@ -29,7 +38,8 @@ module Raw {
         not ignoreAllocation(memLocation.getAllocation().getAllocationString()) and
         value = memLocation.toString() and
         element = instr.toString() and
-        location = instr.getLocation()
+        location = instr.getLocation() and
+        not ignoreFile(location.getFile())
       )
     }
   }
@@ -52,13 +62,14 @@ module UnaliasedSSA {
     override predicate hasActualResult(Location location, string element, string tag, string value) {
       exists(Instruction instr, MemoryLocation memLocation |
         memLocation = getAMemoryAccess(instr) and
-        not memLocation instanceof AliasedVirtualVariable and
+        not memLocation.getVirtualVariable() instanceof AliasedVirtualVariable and
         not memLocation instanceof AllNonLocalMemory and
         tag = "ussa" and
         not ignoreAllocation(memLocation.getAllocation().getAllocationString()) and
         value = memLocation.toString() and
         element = instr.toString() and
-        location = instr.getLocation()
+        location = instr.getLocation() and
+        not ignoreFile(location.getFile())
       )
     }
   }
diff --git a/cpp/ql/test/library-tests/ir/points_to/smart_pointer.cpp b/cpp/ql/test/library-tests/ir/points_to/smart_pointer.cpp
new file mode 100644
index 000000000000..de4cbc96e5f1
--- /dev/null
+++ b/cpp/ql/test/library-tests/ir/points_to/smart_pointer.cpp
@@ -0,0 +1,33 @@
+#include "../../../include/memory.h"
+#include "../../../include/utility.h"
+
+using std::shared_ptr;
+using std::unique_ptr;
+
+struct S {
+    int x;
+};
+
+void unique_ptr_init(S s) {
+    unique_ptr<S> p(new S); //$ussa=dynamic{1}
+    int i = (*p).x; //$ussa=dynamic{1}[0..4)<int>
+    *p = s;  //$ussa=dynamic{1}[0..4)<S>
+    unique_ptr<S> q = std::move(p);
+    *(q.get()) = s;  //$ussa=dynamic{1}[0..4)<S>
+    shared_ptr<S> t(std::move(q));
+    t->x = 5; //$ussa=dynamic{1}[0..4)<int>
+    *t = s; //$ussa=dynamic{1}[0..4)<S>
+    *(t.get()) = s; //$ussa=dynamic{1}[0..4)<S>
+}
+
+void shared_ptr_init(S s) {
+    shared_ptr<S> p(new S); //$ussa=dynamic{1}
+    int i = (*p).x; //$ussa=dynamic{1}[0..4)<int>
+    *p = s;  //$ussa=dynamic{1}[0..4)<S>
+    shared_ptr<S> q = std::move(p);
+    *(q.get()) = s;  //$ussa=dynamic{1}[0..4)<S>
+    shared_ptr<S> t(q);
+    t->x = 5; //$ussa=dynamic{1}[0..4)<int>
+    *t = s; //$ussa=dynamic{1}[0..4)<S>
+    *(t.get()) = s; //$ussa=dynamic{1}[0..4)<S>
+}
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 6105187cc1f9..b745554f8df6 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -4,6 +4,71 @@ private import AliasAnalysisImports
 
 private class IntValue = Ints::IntValue;
 
+/**
+ * If `instr` is a `SideEffectInstruction`, gets the primary `CallInstruction` that caused the side
+ * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
+ */
+private CallInstruction getPrimaryCall(Instruction instr) {
+  result = instr.(CallInstruction)
+  or
+  result = instr.(SideEffectInstruction).getPrimaryInstruction()
+}
+
+/**
+ * Holds if `operand` serves as an input argument (or indirection) to `call`, in the position
+ * specified by `input`.
+ */
+private predicate isCallInput(
+  CallInstruction call, Operand operand, AliasModels::FunctionInput input
+) {
+  call = getPrimaryCall(operand.getUse()) and
+  (
+    exists(int index |
+      input.isParameterOrQualifierAddress(index) and
+      operand = call.getArgumentOperand(index)
+    )
+    or
+    exists(int index, ReadSideEffectInstruction read |
+      input.isParameterDerefOrQualifierObject(index) and
+      read = call.getAParameterSideEffect(index) and
+      operand = read.getSideEffectOperand()
+    )
+  )
+}
+
+/**
+ * Holds if `instr` serves as a return value or output argument indirection for `call`, in the
+ * position specified by `output`.
+ */
+private predicate isCallOutput(
+  CallInstruction call, Instruction instr, AliasModels::FunctionOutput output
+) {
+  call = getPrimaryCall(instr) and
+  (
+    output.isReturnValue() and instr = call
+    or
+    exists(int index, WriteSideEffectInstruction write |
+      output.isParameterDerefOrQualifierObject(index) and
+      write = call.getAParameterSideEffect(index) and
+      instr = write
+    )
+  )
+}
+
+/**
+ * Holds if the address in `operand` flows directly to the result of `resultInstr` due to modeled
+ * address flow through a function call.
+ */
+private predicate hasAddressFlowThroughCall(Operand operand, Instruction resultInstr) {
+  exists(
+    CallInstruction call, AliasModels::FunctionInput input, AliasModels::FunctionOutput output
+  |
+    call.getStaticCallTarget().(AliasModels::AliasFunction).hasAddressFlow(input, output) and
+    isCallInput(call, operand, input) and
+    isCallOutput(call, resultInstr, output)
+  )
+}
+
 /**
  * Holds if the operand `tag` of instruction `instr` is used in a way that does
  * not result in any address held in that operand from escaping beyond the
@@ -74,6 +139,10 @@ IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
  * be a constant, then `bitOffset` is `unknown()`.
  */
 private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instruction instr) {
+  // Some functions are known to propagate an argument
+  hasAddressFlowThroughCall(operand, instr) and
+  bitOffset = 0
+  or
   instr = operand.getUse() and
   (
     // Converting to a non-virtual base class adds the offset of the base class.
@@ -118,9 +187,6 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset, Instr
     or
     // A copy propagates the source value.
     operand = instr.(CopyInstruction).getSourceValueOperand() and bitOffset = 0
-    or
-    // Some functions are known to propagate an argument
-    isAlwaysReturnedArgument(operand) and bitOffset = 0
   )
 }
 
@@ -215,13 +281,6 @@ private predicate isArgumentForParameter(
   )
 }
 
-private predicate isAlwaysReturnedArgument(Operand operand) {
-  exists(AliasModels::AliasFunction f |
-    f = operand.getUse().(CallInstruction).getStaticCallTarget() and
-    f.parameterIsAlwaysReturned(operand.(PositionalArgumentOperand).getIndex())
-  )
-}
-
 private predicate isOnlyEscapesViaReturnArgument(Operand operand) {
   exists(AliasModels::AliasFunction f |
     f = operand.getUse().(CallInstruction).getStaticCallTarget() and
@@ -271,7 +330,9 @@ predicate allocationEscapes(Configuration::Allocation allocation) {
 /**
  * Equivalent to `operandIsPropagated()`, but includes interprocedural propagation.
  */
-private predicate operandIsPropagatedIncludingByCall(Operand operand, IntValue bitOffset, Instruction instr) {
+private predicate operandIsPropagatedIncludingByCall(
+  Operand operand, IntValue bitOffset, Instruction instr
+) {
   operandIsPropagated(operand, bitOffset, instr)
   or
   exists(CallInstruction call, Instruction init |

From b9da6ce04ad0a968d9ed074867603b54fc5b4123 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Tue, 20 Apr 2021 23:12:05 -0400
Subject: [PATCH 359/433] C++: Prepare for merge of smart pointer models

---
 .../models/implementations/SmartPointer.qll   | 27 ++++++++-----------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index ea60bd9d5464..ebe0de3fd6e4 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -28,12 +28,21 @@ private class SmartPtr extends Class, PointerWrapper {
  * - `std::shared_ptr<T>::operator->()`
  * - `std::weak_ptr<T>::operator*()`
  */
-private class PointerUnwrapperFunction extends MemberFunction, AliasFunction, DataFlowFunction,
-  SideEffectFunction, TaintFunction {
+private class PointerUnwrapperFunction extends MemberFunction, TaintFunction, DataFlowFunction,
+  SideEffectFunction, AliasFunction {
   PointerUnwrapperFunction() {
     exists(PointerWrapper wrapper | wrapper.getAnUnwrapperFunction() = this)
   }
 
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
+  }
+
+  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and output.isReturnValue()
+  }
+
   override predicate hasOnlySpecificReadSideEffects() { any() }
 
   override predicate hasOnlySpecificWriteSideEffects() { any() }
@@ -50,20 +59,6 @@ private class PointerUnwrapperFunction extends MemberFunction, AliasFunction, Da
   override predicate hasAddressFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and output.isReturnValue()
   }
-
-  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierAddress() and output.isReturnValue()
-    or
-    input.isQualifierObject() and output.isReturnValueDeref()
-    or
-    input.isReturnValueDeref() and
-    output.isQualifierObject()
-  }
-
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierObject() and
-    output.isReturnValue()
-  }
 }
 
 /**

From 2a6f979ce6428952d2e0627c309610be4fdc3e8a Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 10:42:06 +0200
Subject: [PATCH 360/433] C# Add line of code metric query

---
 csharp/ql/src/Metrics/Summaries/LinesOfCode.ql     | 11 +++++++++++
 .../Metrics/Summaries/LinesOfCode.expected         |  1 +
 .../Metrics/Summaries/LinesOfCode.qlref            |  1 +
 .../ql/test/query-tests/Metrics/Summaries/file1.cs | 14 ++++++++++++++
 4 files changed, 27 insertions(+)
 create mode 100644 csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
 create mode 100644 csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.expected
 create mode 100644 csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref
 create mode 100644 csharp/ql/test/query-tests/Metrics/Summaries/file1.cs

diff --git a/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql b/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
new file mode 100644
index 000000000000..9156a5e4a7f2
--- /dev/null
+++ b/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
@@ -0,0 +1,11 @@
+/**
+ * @id cs/summary/lines-of-code
+ * @name Total lines of code in the database
+ * @description The total number of lines of code across all files. This is a useful metric of the size of a database. For all files that were seen during the build, this query counts the lines of code, excluding whitespace or comments.
+ * @kind metric
+ * @tags summary
+ */
+
+import csharp
+
+select sum(File f | f.fromSource() | f.getNumberOfLinesOfCode())
diff --git a/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.expected b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.expected
new file mode 100644
index 000000000000..b5a514b9ffa6
--- /dev/null
+++ b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.expected
@@ -0,0 +1 @@
+| 4 |
diff --git a/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref
new file mode 100644
index 000000000000..8c18065043fd
--- /dev/null
+++ b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref
@@ -0,0 +1 @@
+Metrics/Summaries/LinesOfCode.ql
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Metrics/Summaries/file1.cs b/csharp/ql/test/query-tests/Metrics/Summaries/file1.cs
new file mode 100644
index 000000000000..0c12535ee09f
--- /dev/null
+++ b/csharp/ql/test/query-tests/Metrics/Summaries/file1.cs
@@ -0,0 +1,14 @@
+
+class C1
+{
+    /*
+      int M()
+      {
+        return 0;
+      }
+    */
+
+    // int M() => 0;
+
+    int M() => 0; // Comment
+}

From 2302c8d5fa80b49dccf1234e8acb795fa014eb8d Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Fri, 9 Apr 2021 14:23:05 +0200
Subject: [PATCH 361/433] Python: Model new `alias` method on django QuerySets

---
 .../src/semmle/python/frameworks/Django.qll   | 28 +++++++++++++++++--
 .../frameworks/django/SqlExecution.py         |  5 ++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 23c0a814a7a8..8684eff5008b 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -366,7 +366,7 @@ private module PrivateDjango {
               "none", "all", "filter", "exclude", "complex_filter", "union", "intersection",
               "difference", "select_for_update", "select_related", "prefetch_related", "order_by",
               "distinct", "reverse", "defer", "only", "using", "annotate", "extra", "raw",
-              "datetimes", "dates", "values", "values_list"
+              "datetimes", "dates", "values", "values_list", "alias"
             ] and
           result = [manager(), querySet()].getMember(name)
         }
@@ -386,7 +386,8 @@ private module PrivateDjango {
           /** Provides models for the `django.db.models.expressions.RawSQL` class. */
           module RawSQL {
             /**
-             * Gets a reference to the `django.db.models.expressions.RawSQL` class.
+             * Gets an instance of the `django.db.models.expressions.RawSQL` class,
+             * that was initiated with the SQL represented by `sql`.
              */
             API::Node classRef() {
               result = expressions().getMember("RawSQL")
@@ -406,7 +407,10 @@ private module PrivateDjango {
               exists(DataFlow::TypeTracker t2 | result = instance(t2, sql).track(t2, t))
             }
 
-            /** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
+            /**
+             * Gets an instance of the `django.db.models.expressions.RawSQL` class,
+             * that was initiated with the SQL represented by `sql`.
+             */
             DataFlow::Node instance(ControlFlowNode sql) {
               instance(DataFlow::TypeTracker::end(), sql).flowsTo(result)
             }
@@ -435,6 +439,24 @@ private module PrivateDjango {
       override DataFlow::Node getSql() { result.asCfgNode() = sql }
     }
 
+    /**
+     * A call to the `alias` function on a model using a `RawSQL` argument.
+     *
+     * See https://docs.djangoproject.com/en/3.2/ref/models/querysets/#alias
+     */
+    private class ObjectsAlias extends SqlExecution::Range, DataFlow::CallCfgNode {
+      ControlFlowNode sql;
+
+      ObjectsAlias() {
+        this = django::db::models::querySetReturningMethod("alias").getACall() and
+        django::db::models::expressions::RawSQL::instance(sql) in [
+            this.getArg(_), this.getArgByName(_)
+          ]
+      }
+
+      override DataFlow::Node getSql() { result.asCfgNode() = sql }
+    }
+
     /**
      * A call to the `raw` function on a model.
      *
diff --git a/python/ql/test/library-tests/frameworks/django/SqlExecution.py b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
index 449983fc898c..8bf657d04dad 100644
--- a/python/ql/test/library-tests/frameworks/django/SqlExecution.py
+++ b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
@@ -19,9 +19,14 @@ class User(models.Model):
 
 def test_model():
     User.objects.raw("some sql")  # $getSql="some sql"
+
     User.objects.annotate(RawSQL("some sql"))  # $getSql="some sql"
     User.objects.annotate(RawSQL("foo"), RawSQL("bar"))  # $getSql="foo" getSql="bar"
     User.objects.annotate(val=RawSQL("some sql"))  # $getSql="some sql"
+
+    User.objects.alias(RawSQL("foo"), RawSQL("bar"))  # $getSql="foo" getSql="bar"
+    User.objects.alias(val=RawSQL("some sql"))  # $getSql="some sql"
+
     User.objects.extra("some sql")  # $getSql="some sql"
     User.objects.extra(select="select", where="where", tables="tables", order_by="order_by")  # $getSql="select" getSql="where" getSql="tables" getSql="order_by"
 

From 59c6f764575c5d0043f8053c473476c44d401b79 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 21 Apr 2021 13:55:22 +0200
Subject: [PATCH 362/433] Python: Add test for new response.headers in Django

See https://docs.djangoproject.com/en/3.2/ref/request-response/#setting-header-fields
---
 .../frameworks/django-v2-v3/response_test.py             | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
index 912523786777..e3ec03907458 100644
--- a/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
@@ -49,6 +49,15 @@ def redirect_through_normal_response(request):
     resp.content = private # $ MISSING: responseBody=private
     return resp
 
+def redirect_through_normal_response_new_headers_attr(request):
+    private = "private"
+    next = request.GET.get("next")
+
+    resp = HttpResponse() # $ HttpResponse mimetype=text/html
+    resp.status_code = 302
+    resp.headers['Location'] = next # $ MISSING: redirectLocation=next
+    resp.content = private # $ MISSING: responseBody=private
+    return resp
 
 def redirect_shortcut(request):
     next = request.GET.get("next")

From be9cbd79d60a62cb6d5bb957508274916270c30f Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 21 Apr 2021 13:58:34 +0200
Subject: [PATCH 363/433] Python: Add change-note for Django 3.2 support

---
 python/change-notes/2021-04-21-django-v3.2.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 python/change-notes/2021-04-21-django-v3.2.md

diff --git a/python/change-notes/2021-04-21-django-v3.2.md b/python/change-notes/2021-04-21-django-v3.2.md
new file mode 100644
index 000000000000..91fee509f7a2
--- /dev/null
+++ b/python/change-notes/2021-04-21-django-v3.2.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Modeling of Django has been updated to handle new 3.2 release, by supporting the new `QuerySet.alias()` method, which can be a sink for SQL injection.

From f9599da32d1cbeb0be1c6bd42480d797895aef55 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Wed, 21 Apr 2021 14:24:15 +0200
Subject: [PATCH 364/433] Java/C#: Move a couple of flow summary tweaks to the
 shared implementation.

---
 .../csharp/dataflow/internal/FlowSummaryImpl.qll     | 12 ++++++++++++
 .../code/java/dataflow/internal/DataFlowUtil.qll     |  8 --------
 .../code/java/dataflow/internal/FlowSummaryImpl.qll  | 12 ++++++++++++
 .../java/dataflow/internal/TaintTrackingUtil.qll     |  3 +--
 4 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index 3c8c94c913c3..bdf5498d8c63 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -446,7 +446,19 @@ module Private {
         summary(c, inputContents, outputContents, preservesValue) and
         pred = summaryNodeInputState(c, inputContents) and
         succ = summaryNodeOutputState(c, outputContents)
+      |
+        preservesValue = true
+        or
+        preservesValue = false and not summary(c, inputContents, outputContents, true)
       )
+      or
+      // If flow through a method updates a parameter from some input A, and that
+      // parameter also is returned through B, then we'd like a combined flow from A
+      // to B as well. As an example, this simplifies modeling of fluent methods:
+      // for `StringBuilder.append(x)` with a specified value flow from qualifier to
+      // return value and taint flow from argument 0 to the qualifier, then this
+      // allows us to infer taint flow from argument 0 to the return value.
+      summaryPostUpdateNode(pred, succ) and preservesValue = true
     }
 
     /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 47743caf6688..2ad095740154 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -150,14 +150,6 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   )
   or
   FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2, true)
-  or
-  // If flow through a method updates a parameter from some input A, and that
-  // parameter also is returned through B, then we'd like a combined flow from A
-  // to B as well. As an example, this simplifies modeling of fluent methods:
-  // for `StringBuilder.append(x)` with a specified value flow from qualifier to
-  // return value and taint flow from argument 0 to the qualifier, then this
-  // allows us to infer taint flow from argument 0 to the return value.
-  node1.(SummaryNode).(PostUpdateNode).getPreUpdateNode().(ParameterNode) = node2
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
index 3c8c94c913c3..bdf5498d8c63 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -446,7 +446,19 @@ module Private {
         summary(c, inputContents, outputContents, preservesValue) and
         pred = summaryNodeInputState(c, inputContents) and
         succ = summaryNodeOutputState(c, outputContents)
+      |
+        preservesValue = true
+        or
+        preservesValue = false and not summary(c, inputContents, outputContents, true)
       )
+      or
+      // If flow through a method updates a parameter from some input A, and that
+      // parameter also is returned through B, then we'd like a combined flow from A
+      // to B as well. As an example, this simplifies modeling of fluent methods:
+      // for `StringBuilder.append(x)` with a specified value flow from qualifier to
+      // return value and taint flow from argument 0 to the qualifier, then this
+      // allows us to infer taint flow from argument 0 to the return value.
+      summaryPostUpdateNode(pred, succ) and preservesValue = true
     }
 
     /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index 9dc5d8f24b77..f9278ab815e7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -57,8 +57,7 @@ predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
     sink.(DataFlow::ImplicitVarargsArray).getCall() = arg.getCall()
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false) and
-  not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, true)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
 }
 
 /**

From e25305e3cc3396aed4dd694cbb615da141b5302b Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 14:25:54 +0200
Subject: [PATCH 365/433] Java: Introduce LoC summary metric query

---
 java/ql/src/Metrics/Summaries/LinesOfCode.ql        | 13 +++++++++++++
 java/ql/test/query-tests/Metrics/A.java             |  9 +++++++++
 .../test/query-tests/Metrics/LinesOfCode.expected   |  1 +
 java/ql/test/query-tests/Metrics/LinesOfCode.qlref  |  1 +
 4 files changed, 24 insertions(+)
 create mode 100644 java/ql/src/Metrics/Summaries/LinesOfCode.ql
 create mode 100644 java/ql/test/query-tests/Metrics/A.java
 create mode 100644 java/ql/test/query-tests/Metrics/LinesOfCode.expected
 create mode 100644 java/ql/test/query-tests/Metrics/LinesOfCode.qlref

diff --git a/java/ql/src/Metrics/Summaries/LinesOfCode.ql b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
new file mode 100644
index 000000000000..9a90242e3cb5
--- /dev/null
+++ b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
@@ -0,0 +1,13 @@
+/**
+ * @id java/summary/lines-of-code
+ * @name Total lines of code in the database
+ * @description The total number of lines of code across all files. This is a useful metric of the size of a database.
+ *              For all files that were seen during the build, this query counts the lines of code, excluding whitespace
+ *              or comments.
+ * @kind metric
+ * @tags summary
+ */
+
+import java
+
+select sum(File f, int i | i = f.getNumberOfLinesOfCode() | i)
diff --git a/java/ql/test/query-tests/Metrics/A.java b/java/ql/test/query-tests/Metrics/A.java
new file mode 100644
index 000000000000..2e4814169666
--- /dev/null
+++ b/java/ql/test/query-tests/Metrics/A.java
@@ -0,0 +1,9 @@
+public class A {
+  public void M() {
+    //some comment
+  }
+
+  /* public void M() {
+    //some comment
+  } */
+}
diff --git a/java/ql/test/query-tests/Metrics/LinesOfCode.expected b/java/ql/test/query-tests/Metrics/LinesOfCode.expected
new file mode 100644
index 000000000000..b5a514b9ffa6
--- /dev/null
+++ b/java/ql/test/query-tests/Metrics/LinesOfCode.expected
@@ -0,0 +1 @@
+| 4 |
diff --git a/java/ql/test/query-tests/Metrics/LinesOfCode.qlref b/java/ql/test/query-tests/Metrics/LinesOfCode.qlref
new file mode 100644
index 000000000000..4c00f1205cdf
--- /dev/null
+++ b/java/ql/test/query-tests/Metrics/LinesOfCode.qlref
@@ -0,0 +1 @@
+Metrics/Summaries/LinesOfCode.ql

From 2c9a6e7befafffd20bab6b5954656b11131c823b Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 21 Apr 2021 13:45:58 +0100
Subject: [PATCH 366/433] JS: Cache function-wrapping steps in type-tracking
 stage

---
 .../semmle/javascript/dataflow/DataFlow.qll   | 125 +--------------
 .../internal/FunctionWrapperSteps.qll         | 144 ++++++++++++++++++
 .../javascript/internal/CachedStages.qll      |   2 +
 3 files changed, 147 insertions(+), 124 deletions(-)
 create mode 100644 javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 76c42cd16cf4..2bcee954cbc0 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1682,130 +1682,7 @@ module DataFlow {
   import Configuration
   import TrackedNodes
   import TypeTracking
+  import internal.FunctionWrapperSteps
 
   predicate localTaintStep = TaintTracking::localTaintStep/2;
-
-  private predicate forwardsParameter(
-    DataFlow::FunctionNode function, int i, DataFlow::CallNode call
-  ) {
-    exists(DataFlow::ParameterNode parameter | parameter = function.getParameter(i) |
-      not parameter.isRestParameter() and
-      parameter.flowsTo(call.getArgument(i))
-      or
-      parameter.isRestParameter() and
-      parameter.flowsTo(call.getASpreadArgument())
-    )
-  }
-
-  /**
-   * Holds if the function in `succ` forwards all its arguments to a call to `pred` and returns
-   * its result. This can thus be seen as a step `pred -> succ` used for tracking function values
-   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
-   *
-   * Examples:
-   * ```js
-   * function f(x) {
-   *   return g(x); // step: g -> f
-   * }
-   *
-   * function doExec(x) {
-   *   console.log(x);
-   *   return exec(x); // step: exec -> doExec
-   * }
-   *
-   * function doEither(x, y) {
-   *   if (x > y) {
-   *     return foo(x, y); // step: foo -> doEither
-   *   } else {
-   *     return bar(x, y); // step: bar -> doEither
-   *   }
-   * }
-   *
-   * function wrapWithLogging(f) {
-   *   return (x) => {
-   *     console.log(x);
-   *     return f(x); // step: f -> anonymous function
-   *   }
-   * }
-   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
-   * ```
-   */
-  predicate functionForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
-      call.flowsTo(function.getReturnNode()) and
-      forall(int i | exists([call.getArgument(i), function.getParameter(i)]) |
-        forwardsParameter(function, i, call)
-      ) and
-      pred = call.getCalleeNode() and
-      succ = function
-    )
-    or
-    // Given a generic wrapper function like,
-    //
-    //   function wrap(f) { return (x, y) => f(x, y) };
-    //
-    // add steps through calls to that function: `g -> wrap(g)`
-    exists(DataFlow::FunctionNode wrapperFunction, SourceNode param, Node paramUse |
-      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
-      param.flowsTo(paramUse) and
-      functionForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
-    )
-  }
-
-  /**
-   * Holds if the function in `succ` forwards all its arguments to a call to `pred`.
-   * This can thus be seen as a step `pred -> succ` used for tracking function values
-   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
-   *
-   * This is similar to `functionForwardingStep` except the innermost forwarding call does not
-   * need flow to the return value; this can be useful for tracking callback-style functions
-   * where the result tends to be unused.
-   *
-   * Examples:
-   * ```js
-   * function f(x, callback) {
-   *   g(x, callback); // step: g -> f
-   * }
-   *
-   * function doExec(x, callback) {
-   *   console.log(x);
-   *   exec(x, callback); // step: exec -> doExec
-   * }
-   *
-   * function doEither(x, y) {
-   *   if (x > y) {
-   *     return foo(x, y); // step: foo -> doEither
-   *   } else {
-   *     return bar(x, y); // step: bar -> doEither
-   *   }
-   * }
-   *
-   * function wrapWithLogging(f) {
-   *   return (x) => {
-   *     console.log(x);
-   *     return f(x); // step: f -> anonymous function
-   *   }
-   * }
-   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
-   * ```
-   */
-  predicate functionOneWayForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
-      call.getContainer() = function.getFunction() and
-      forall(int i | exists(function.getParameter(i)) | forwardsParameter(function, i, call)) and
-      pred = call.getCalleeNode() and
-      succ = function
-    )
-    or
-    // Given a generic wrapper function like,
-    //
-    //   function wrap(f) { return (x, y) => f(x, y) };
-    //
-    // add steps through calls to that function: `g -> wrap(g)`
-    exists(DataFlow::FunctionNode wrapperFunction, SourceNode param, Node paramUse |
-      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
-      param.flowsTo(paramUse) and
-      functionOneWayForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
-    )
-  }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
new file mode 100644
index 000000000000..c0f8b36e645f
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
@@ -0,0 +1,144 @@
+private import javascript
+
+private import FlowSteps as FlowSteps
+private import semmle.javascript.internal.CachedStages
+
+cached
+private module Cached {
+  private predicate forwardsParameter(
+    DataFlow::FunctionNode function, int i, DataFlow::CallNode call
+  ) {
+    exists(DataFlow::ParameterNode parameter | parameter = function.getParameter(i) |
+      not parameter.isRestParameter() and
+      parameter.flowsTo(call.getArgument(i))
+      or
+      parameter.isRestParameter() and
+      parameter.flowsTo(call.getASpreadArgument())
+    )
+  }
+
+  cached
+  private module Stage {
+    // Forces the module to be computed as part of the type-tracking stage.
+    cached
+    predicate forceStage() {
+      Stages::TypeTracking::ref()
+    }
+  }
+
+  /**
+   * Holds if the function in `succ` forwards all its arguments to a call to `pred` and returns
+   * its result. This can thus be seen as a step `pred -> succ` used for tracking function values
+   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
+   *
+   * Examples:
+   * ```js
+   * function f(x) {
+   *   return g(x); // step: g -> f
+   * }
+   *
+   * function doExec(x) {
+   *   console.log(x);
+   *   return exec(x); // step: exec -> doExec
+   * }
+   *
+   * function doEither(x, y) {
+   *   if (x > y) {
+   *     return foo(x, y); // step: foo -> doEither
+   *   } else {
+   *     return bar(x, y); // step: bar -> doEither
+   *   }
+   * }
+   *
+   * function wrapWithLogging(f) {
+   *   return (x) => {
+   *     console.log(x);
+   *     return f(x); // step: f -> anonymous function
+   *   }
+   * }
+   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
+   * ```
+   */
+  cached
+  predicate functionForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
+      call.flowsTo(function.getReturnNode()) and
+      forall(int i | exists([call.getArgument(i), function.getParameter(i)]) |
+        forwardsParameter(function, i, call)
+      ) and
+      pred = call.getCalleeNode() and
+      succ = function
+    )
+    or
+    // Given a generic wrapper function like,
+    //
+    //   function wrap(f) { return (x, y) => f(x, y) };
+    //
+    // add steps through calls to that function: `g -> wrap(g)`
+    exists(DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse |
+      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
+      param.flowsTo(paramUse) and
+      functionForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
+    )
+  }
+
+  /**
+   * Holds if the function in `succ` forwards all its arguments to a call to `pred`.
+   * This can thus be seen as a step `pred -> succ` used for tracking function values
+   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
+   *
+   * This is similar to `functionForwardingStep` except the innermost forwarding call does not
+   * need flow to the return value; this can be useful for tracking callback-style functions
+   * where the result tends to be unused.
+   *
+   * Examples:
+   * ```js
+   * function f(x, callback) {
+   *   g(x, callback); // step: g -> f
+   * }
+   *
+   * function doExec(x, callback) {
+   *   console.log(x);
+   *   exec(x, callback); // step: exec -> doExec
+   * }
+   *
+   * function doEither(x, y) {
+   *   if (x > y) {
+   *     return foo(x, y); // step: foo -> doEither
+   *   } else {
+   *     return bar(x, y); // step: bar -> doEither
+   *   }
+   * }
+   *
+   * function wrapWithLogging(f) {
+   *   return (x) => {
+   *     console.log(x);
+   *     return f(x); // step: f -> anonymous function
+   *   }
+   * }
+   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
+   * ```
+   */
+  cached
+  predicate functionOneWayForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
+      call.getContainer() = function.getFunction() and
+      forall(int i | exists(function.getParameter(i)) | forwardsParameter(function, i, call)) and
+      pred = call.getCalleeNode() and
+      succ = function
+    )
+    or
+    // Given a generic wrapper function like,
+    //
+    //   function wrap(f) { return (x, y) => f(x, y) };
+    //
+    // add steps through calls to that function: `g -> wrap(g)`
+    exists(DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse |
+      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
+      param.flowsTo(paramUse) and
+      functionOneWayForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
+    )
+  }
+}
+
+import Cached
diff --git a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
index 6980a6eef7f2..a48cb8ed5e03 100644
--- a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
+++ b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
@@ -196,6 +196,8 @@ module Stages {
       exists(any(DataFlow::TypeTracker t).append(_))
       or
       exists(any(DataFlow::TypeBackTracker t).prepend(_))
+      or
+      DataFlow::functionForwardingStep(_, _)
     }
   }
 

From 9c72e73a8297d72f6665e63e696d7a31656a39aa Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Wed, 21 Apr 2021 14:55:37 +0100
Subject: [PATCH 367/433] Make ExecTainted easier to extend

To add a method that executes a command, you can now define a class
extending ExecMethod.
---
 java/ql/src/semmle/code/java/JDK.qll              |  5 +++--
 .../semmle/code/java/frameworks/apache/Exec.qll   |  5 +++--
 .../semmle/code/java/security/ExternalProcess.qll | 15 +++++++--------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/java/ql/src/semmle/code/java/JDK.qll b/java/ql/src/semmle/code/java/JDK.qll
index 7bc072e177cb..4d9e2bbc2d79 100644
--- a/java/ql/src/semmle/code/java/JDK.qll
+++ b/java/ql/src/semmle/code/java/JDK.qll
@@ -3,6 +3,7 @@
  */
 
 import Member
+import semmle.code.java.security.ExternalProcess
 
 // --- Standard types ---
 /** The class `java.lang.Object`. */
@@ -179,7 +180,7 @@ class TypeFile extends Class {
 /**
  * Any of the methods named `command` on class `java.lang.ProcessBuilder`.
  */
-class MethodProcessBuilderCommand extends Method {
+class MethodProcessBuilderCommand extends ExecMethod {
   MethodProcessBuilderCommand() {
     hasName("command") and
     getDeclaringType() instanceof TypeProcessBuilder
@@ -189,7 +190,7 @@ class MethodProcessBuilderCommand extends Method {
 /**
  * Any method named `exec` on class `java.lang.Runtime`.
  */
-class MethodRuntimeExec extends Method {
+class MethodRuntimeExec extends ExecMethod {
   MethodRuntimeExec() {
     hasName("exec") and
     getDeclaringType() instanceof TypeRuntime
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
index e24428d6fdc2..b12887e56349 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
@@ -1,18 +1,19 @@
 /* Definitions related to the Apache Commons Exec library. */
 import semmle.code.java.Type
+import semmle.code.java.security.ExternalProcess
 
 library class TypeCommandLine extends Class {
   TypeCommandLine() { hasQualifiedName("org.apache.commons.exec", "CommandLine") }
 }
 
-library class MethodCommandLineParse extends Method {
+library class MethodCommandLineParse extends ExecMethod {
   MethodCommandLineParse() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("parse")
   }
 }
 
-library class MethodCommandLineAddArguments extends Method {
+library class MethodCommandLineAddArguments extends ExecMethod {
   MethodCommandLineAddArguments() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("addArguments")
diff --git a/java/ql/src/semmle/code/java/security/ExternalProcess.qll b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
index 93d7acd81530..6b098a2d0e86 100644
--- a/java/ql/src/semmle/code/java/security/ExternalProcess.qll
+++ b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
@@ -3,6 +3,11 @@ import semmle.code.java.Member
 import semmle.code.java.JDK
 import semmle.code.java.frameworks.apache.Exec
 
+/**
+ * A method that executes a command.
+ */
+abstract class ExecMethod extends Method { }
+
 /**
  * An expression used as an argument to a call that executes an external command. For calls to
  * varargs method calls, this only includes the first argument, which will be the command
@@ -10,15 +15,9 @@ import semmle.code.java.frameworks.apache.Exec
  */
 class ArgumentToExec extends Expr {
   ArgumentToExec() {
-    exists(MethodAccess execCall, Method method |
+    exists(MethodAccess execCall, ExecMethod method |
       execCall.getArgument(0) = this and
-      method = execCall.getMethod() and
-      (
-        method instanceof MethodRuntimeExec or
-        method instanceof MethodProcessBuilderCommand or
-        method instanceof MethodCommandLineParse or
-        method instanceof MethodCommandLineAddArguments
-      )
+      method = execCall.getMethod()
     )
     or
     exists(ConstructorCall expr, Constructor cons |

From a0f5e45ae9cd379b7410d86bb691ef04662a6b5e Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 14:53:36 +0200
Subject: [PATCH 368/433] C#: Fix special case of default argument value
 extraction

---
 .../Semmle.Extraction.CSharp/Entities/Expression.cs    | 10 ++++++++++
 .../errorrecovery/DiagnosticsAndErrors.expected        |  1 +
 2 files changed, 11 insertions(+)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index 6d36dded8019..103ea8cacdab 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -193,6 +193,16 @@ private static bool ContainsPattern(SyntaxNode node) =>
                 return Default.CreateGenerated(cx, parent, childIndex, location, parameter.Type.IsReferenceType ? ValueAsString(null) : null);
             }
 
+            if (parameter.Type.SpecialType == SpecialType.System_Object)
+            {
+                // this can happen in VB.NET
+                cx.ExtractionError($"Extracting default argument value 'object {parameter.Name} = default' instead of 'object {parameter.Name} = {defaultValue}'. The latter is not supported in C#.",
+                    null, null, severity: Util.Logging.Severity.Warning);
+
+                // we're generating a default expression:
+                return Default.CreateGenerated(cx, parent, childIndex, location, ValueAsString(null));
+            }
+
             // const literal:
             return Literal.CreateGenerated(cx, parent, childIndex, parameter.Type, defaultValue, location);
         }
diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected b/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
index ff6d7e236a41..13bdd30b1c40 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
@@ -1,2 +1,3 @@
 compilationMessages
 extractorMessages
+| file://:0:0:0:0 | Extracting default argument value 'object RecordNumber = default' instead of 'object RecordNumber = -1'. The latter is not supported in C#. |

From 0bc4b0421dcf66e25c2391f988d09e18a66c7ae5 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Wed, 21 Apr 2021 12:12:01 -0400
Subject: [PATCH 369/433] C++: Remove unnecessary cast

---
 .../ir/implementation/aliased_ssa/internal/AliasAnalysis.qll    | 2 +-
 .../ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll  | 2 +-
 .../ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
index b745554f8df6..e26d61b9792c 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -9,7 +9,7 @@ private class IntValue = Ints::IntValue;
  * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
  */
 private CallInstruction getPrimaryCall(Instruction instr) {
-  result = instr.(CallInstruction)
+  result = instr
   or
   result = instr.(SideEffectInstruction).getPrimaryInstruction()
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index b745554f8df6..e26d61b9792c 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -9,7 +9,7 @@ private class IntValue = Ints::IntValue;
  * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
  */
 private CallInstruction getPrimaryCall(Instruction instr) {
-  result = instr.(CallInstruction)
+  result = instr
   or
   result = instr.(SideEffectInstruction).getPrimaryInstruction()
 }
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index b745554f8df6..e26d61b9792c 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -9,7 +9,7 @@ private class IntValue = Ints::IntValue;
  * effect. If `instr` is a `CallInstruction`, gets that same `CallInstruction`.
  */
 private CallInstruction getPrimaryCall(Instruction instr) {
-  result = instr.(CallInstruction)
+  result = instr
   or
   result = instr.(SideEffectInstruction).getPrimaryInstruction()
 }

From c113cfd8b72a7002bf187a9c017429fa8dbde5e4 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 21 Apr 2021 21:13:07 +0100
Subject: [PATCH 370/433] JS: Autoformat

---
 .../dataflow/internal/FunctionWrapperSteps.qll      | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
index c0f8b36e645f..de4f9da6c167 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
@@ -1,5 +1,4 @@
 private import javascript
-
 private import FlowSteps as FlowSteps
 private import semmle.javascript.internal.CachedStages
 
@@ -21,9 +20,7 @@ private module Cached {
   private module Stage {
     // Forces the module to be computed as part of the type-tracking stage.
     cached
-    predicate forceStage() {
-      Stages::TypeTracking::ref()
-    }
+    predicate forceStage() { Stages::TypeTracking::ref() }
   }
 
   /**
@@ -75,7 +72,9 @@ private module Cached {
     //   function wrap(f) { return (x, y) => f(x, y) };
     //
     // add steps through calls to that function: `g -> wrap(g)`
-    exists(DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse |
+    exists(
+      DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse
+    |
       FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
       param.flowsTo(paramUse) and
       functionForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
@@ -133,7 +132,9 @@ private module Cached {
     //   function wrap(f) { return (x, y) => f(x, y) };
     //
     // add steps through calls to that function: `g -> wrap(g)`
-    exists(DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse |
+    exists(
+      DataFlow::FunctionNode wrapperFunction, DataFlow::SourceNode param, DataFlow::Node paramUse
+    |
       FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
       param.flowsTo(paramUse) and
       functionOneWayForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())

From bb7934b381fd216973ff9ccd85436ec929d7702c Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 21 Apr 2021 21:20:12 +0100
Subject: [PATCH 371/433] JS: Change note

---
 javascript/change-notes/2021-04-21-rate-limiting-fixes.md | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 javascript/change-notes/2021-04-21-rate-limiting-fixes.md

diff --git a/javascript/change-notes/2021-04-21-rate-limiting-fixes.md b/javascript/change-notes/2021-04-21-rate-limiting-fixes.md
new file mode 100644
index 000000000000..44328a7f59be
--- /dev/null
+++ b/javascript/change-notes/2021-04-21-rate-limiting-fixes.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Tracking of HTTP route handlers has improved, which may lead to additional
+  security results, and fewer false-positive results from the `js/missing-rate-limiting` query.
\ No newline at end of file

From e98bfe921e02668b8546e359ec698be084e309d2 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 21 Apr 2021 22:14:50 +0100
Subject: [PATCH 372/433] JS: QLDoc

---
 .../semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
index de4f9da6c167..1069833eeea0 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
@@ -1,3 +1,4 @@
+/** Provides predicates for tracking functions through wrapper functions. */
 private import javascript
 private import FlowSteps as FlowSteps
 private import semmle.javascript.internal.CachedStages

From 383210096c85c4e03b621e0c35e77b5ae1b69466 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Wed, 21 Apr 2021 18:09:44 -0400
Subject: [PATCH 373/433] C++: Isolate models from AST dataflow's
 reference/object conflation

`DataFlowFunction` models treat references a pointers - an explicit level of indirection. The AST dataflow library generally treats references as if they were the referred-to object. This commit removes a workaround in the dataflow model for unary `operator*` on smart pointers, and makes the AST dataflow library adjust the results of querying the model so that a returned reference only gets flow that was modeled as going to the dereference of the return value.

This fixes some missing flow in IR dataflow, and recovers some (presumably) missing reverse taint flow in AST taint tracking as well.
---
 .../cpp/dataflow/internal/DataFlowUtil.qll    |  7 +-
 .../dataflow/taint-tests/localTaint.expected  | 69 +++++++++++--------
 .../dataflow/taint-tests/smart_pointer.cpp    |  6 +-
 3 files changed, 49 insertions(+), 33 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 690f24fc59a9..558b43cb0da7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -694,7 +694,12 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
           fromExpr = call.getQualifier()
         ) and
         call.getTarget() = f and
-        outModel.isReturnValue()
+        // AST dataflow treats a reference as if it were the referred-to object, while the dataflow
+        // models treat references as pointers. If the return type of the call is a reference, then
+        // look for data flow the the referred-to object, rather than the reference itself.
+        if call.getType().getUnspecifiedType() instanceof ReferenceType
+        then outModel.isReturnValueDeref()
+        else outModel.isReturnValue()
       )
     )
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index b003dc5a12bc..ce939661c92d 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3228,6 +3228,7 @@
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
+| smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:18:11:18:11 | ref arg p | TAINT |
 | smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:11:18:11 | p | smart_pointer.cpp:18:10:18:10 | call to operator* | TAINT |
 | smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
@@ -3240,6 +3241,7 @@
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
+| smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:30:11:30:11 | ref arg p | TAINT |
 | smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:11:30:11 | p | smart_pointer.cpp:30:10:30:10 | call to operator* | TAINT |
 | smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
@@ -3248,6 +3250,7 @@
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:37:6:37:6 | ref arg p | TAINT |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
@@ -3262,6 +3265,7 @@
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:45:6:45:6 | ref arg p | TAINT |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
@@ -3291,6 +3295,7 @@
 | smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:71:4:71:6 | ptr |  |
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
 | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ref arg ptr | TAINT |
 | smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
 | smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* |  |
 | smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
@@ -3371,6 +3376,7 @@
 | smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:121:4:121:6 | ptr |  |
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:120:48:120:50 | ptr |  |
 | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ref arg ptr | TAINT |
 | smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
 | smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
 | smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
@@ -3394,9 +3400,11 @@
 | smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 | TAINT |
 | smart_pointer.cpp:126:12:126:12 | q | smart_pointer.cpp:126:13:126:13 | call to operator-> |  |
 | smart_pointer.cpp:128:13:128:13 | call to operator* | smart_pointer.cpp:128:13:128:15 | call to shared_ptr | TAINT |
+| smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] | smart_pointer.cpp:128:14:128:15 | ref arg p2 | TAINT |
 | smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
 | smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:14:128:15 | ref arg p2 | TAINT |
 | smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 |  |
 | smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
@@ -3409,6 +3417,7 @@
 | smart_pointer.cpp:129:9:129:9 | call to operator* | smart_pointer.cpp:129:8:129:8 | call to operator* | TAINT |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
 | smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | ref arg p2 | TAINT |
 | smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:8:129:8 | call to operator* |  |
 | smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:9:129:9 | call to operator* | TAINT |
 | smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
@@ -3429,6 +3438,7 @@
 | smart_pointer.cpp:134:12:134:12 | q | smart_pointer.cpp:134:13:134:13 | call to operator-> |  |
 | smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:136:18:136:19 | ref arg p2 | TAINT |
 | smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 |  |
 | smart_pointer.cpp:136:18:136:19 | p2 | smart_pointer.cpp:136:17:136:17 | call to operator* | TAINT |
 | smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
@@ -3437,6 +3447,7 @@
 | smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
 | smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | ref arg p2 | TAINT |
 | smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:8:137:8 | call to operator* |  |
 | smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:9:137:9 | call to operator* | TAINT |
 | smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
@@ -3532,13 +3543,13 @@
 | standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:120:2:120:3 | it |  |
 | standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:121:7:121:8 | it |  |
 | standalone_iterators.cpp:117:7:117:8 | it [post update] | standalone_iterators.cpp:122:7:122:8 | c1 |  |
-| standalone_iterators.cpp:118:2:118:3 | it | standalone_iterators.cpp:118:5:118:5 | call to operator+= |  |
+| standalone_iterators.cpp:118:2:118:3 | it | standalone_iterators.cpp:118:5:118:5 | call to operator+= | TAINT |
 | standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:119:7:119:8 | it |  |
 | standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:120:2:120:3 | it |  |
 | standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it |  |
 | standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:122:7:122:8 | c1 |  |
 | standalone_iterators.cpp:118:8:118:8 | 1 | standalone_iterators.cpp:118:2:118:3 | ref arg it | TAINT |
-| standalone_iterators.cpp:120:2:120:3 | it | standalone_iterators.cpp:120:5:120:5 | call to operator+= |  |
+| standalone_iterators.cpp:120:2:120:3 | it | standalone_iterators.cpp:120:5:120:5 | call to operator+= | TAINT |
 | standalone_iterators.cpp:120:2:120:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it |  |
 | standalone_iterators.cpp:120:8:120:13 | call to source | standalone_iterators.cpp:120:2:120:3 | ref arg it | TAINT |
 | stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
@@ -3655,12 +3666,12 @@
 | stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
 | stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
 | stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
-| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward | TAINT |
 | stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
 | stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
 | stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
@@ -3673,12 +3684,12 @@
 | stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
 | stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
 | stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
-| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward | TAINT |
 | string.cpp:25:12:25:17 | call to source | string.cpp:29:7:29:7 | a |  |
 | string.cpp:26:16:26:20 | 123 | string.cpp:26:16:26:21 | call to basic_string | TAINT |
 | string.cpp:26:16:26:21 | call to basic_string | string.cpp:30:7:30:7 | b |  |
@@ -4231,13 +4242,13 @@
 | string.cpp:407:9:407:10 | i6 | string.cpp:407:8:407:8 | call to operator* | TAINT |
 | string.cpp:408:8:408:9 | i2 | string.cpp:408:3:408:9 | ... = ... |  |
 | string.cpp:408:8:408:9 | i2 | string.cpp:409:10:409:11 | i7 |  |
-| string.cpp:409:10:409:11 | i7 | string.cpp:409:12:409:12 | call to operator+= |  |
+| string.cpp:409:10:409:11 | i7 | string.cpp:409:12:409:12 | call to operator+= | TAINT |
 | string.cpp:409:12:409:12 | call to operator+= | string.cpp:409:8:409:8 | call to operator* | TAINT |
 | string.cpp:409:12:409:12 | ref arg call to operator+= | string.cpp:409:10:409:11 | ref arg i7 | TAINT |
 | string.cpp:409:14:409:14 | 1 | string.cpp:409:10:409:11 | ref arg i7 | TAINT |
 | string.cpp:410:8:410:9 | i2 | string.cpp:410:3:410:9 | ... = ... |  |
 | string.cpp:410:8:410:9 | i2 | string.cpp:411:10:411:11 | i8 |  |
-| string.cpp:411:10:411:11 | i8 | string.cpp:411:12:411:12 | call to operator-= |  |
+| string.cpp:411:10:411:11 | i8 | string.cpp:411:12:411:12 | call to operator-= | TAINT |
 | string.cpp:411:12:411:12 | call to operator-= | string.cpp:411:8:411:8 | call to operator* | TAINT |
 | string.cpp:411:12:411:12 | ref arg call to operator-= | string.cpp:411:10:411:11 | ref arg i8 | TAINT |
 | string.cpp:411:14:411:14 | 1 | string.cpp:411:10:411:11 | ref arg i8 | TAINT |
@@ -4652,7 +4663,7 @@
 | stringstream.cpp:33:7:33:9 | ref arg ss3 | stringstream.cpp:39:7:39:9 | ss3 |  |
 | stringstream.cpp:33:7:33:9 | ref arg ss3 | stringstream.cpp:44:7:44:9 | ss3 |  |
 | stringstream.cpp:33:7:33:9 | ss3 | stringstream.cpp:33:11:33:11 | call to operator<< |  |
-| stringstream.cpp:33:11:33:11 | call to operator<< | stringstream.cpp:33:20:33:20 | call to operator<< |  |
+| stringstream.cpp:33:11:33:11 | call to operator<< | stringstream.cpp:33:20:33:20 | call to operator<< | TAINT |
 | stringstream.cpp:33:11:33:11 | ref arg call to operator<< | stringstream.cpp:33:7:33:9 | ref arg ss3 | TAINT |
 | stringstream.cpp:33:14:33:18 | 123 | stringstream.cpp:33:7:33:9 | ref arg ss3 | TAINT |
 | stringstream.cpp:33:14:33:18 | 123 | stringstream.cpp:33:11:33:11 | call to operator<< | TAINT |
@@ -4661,7 +4672,7 @@
 | stringstream.cpp:34:7:34:9 | ref arg ss4 | stringstream.cpp:40:7:40:9 | ss4 |  |
 | stringstream.cpp:34:7:34:9 | ref arg ss4 | stringstream.cpp:45:7:45:9 | ss4 |  |
 | stringstream.cpp:34:7:34:9 | ss4 | stringstream.cpp:34:11:34:11 | call to operator<< |  |
-| stringstream.cpp:34:11:34:11 | call to operator<< | stringstream.cpp:34:23:34:23 | call to operator<< |  |
+| stringstream.cpp:34:11:34:11 | call to operator<< | stringstream.cpp:34:23:34:23 | call to operator<< | TAINT |
 | stringstream.cpp:34:11:34:11 | ref arg call to operator<< | stringstream.cpp:34:7:34:9 | ref arg ss4 | TAINT |
 | stringstream.cpp:34:14:34:19 | call to source | stringstream.cpp:34:7:34:9 | ref arg ss4 | TAINT |
 | stringstream.cpp:34:14:34:19 | call to source | stringstream.cpp:34:11:34:11 | call to operator<< | TAINT |
@@ -4942,7 +4953,7 @@
 | stringstream.cpp:147:7:147:9 | ref arg ss2 | stringstream.cpp:179:7:179:9 | ss2 |  |
 | stringstream.cpp:147:7:147:9 | ss2 | stringstream.cpp:147:11:147:11 | call to operator>> |  |
 | stringstream.cpp:147:7:147:9 | ss2 | stringstream.cpp:147:14:147:15 | ref arg s3 | TAINT |
-| stringstream.cpp:147:11:147:11 | call to operator>> | stringstream.cpp:147:17:147:17 | call to operator>> |  |
+| stringstream.cpp:147:11:147:11 | call to operator>> | stringstream.cpp:147:17:147:17 | call to operator>> | TAINT |
 | stringstream.cpp:147:11:147:11 | call to operator>> | stringstream.cpp:147:20:147:21 | ref arg s4 | TAINT |
 | stringstream.cpp:147:11:147:11 | ref arg call to operator>> | stringstream.cpp:147:7:147:9 | ref arg ss2 | TAINT |
 | stringstream.cpp:147:14:147:15 | ref arg s3 | stringstream.cpp:150:7:150:8 | s3 |  |
@@ -4974,7 +4985,7 @@
 | stringstream.cpp:155:7:155:9 | ref arg ss2 | stringstream.cpp:179:7:179:9 | ss2 |  |
 | stringstream.cpp:155:7:155:9 | ss2 | stringstream.cpp:155:11:155:11 | call to operator>> |  |
 | stringstream.cpp:155:7:155:9 | ss2 | stringstream.cpp:155:14:155:15 | ref arg b3 | TAINT |
-| stringstream.cpp:155:11:155:11 | call to operator>> | stringstream.cpp:155:17:155:17 | call to operator>> |  |
+| stringstream.cpp:155:11:155:11 | call to operator>> | stringstream.cpp:155:17:155:17 | call to operator>> | TAINT |
 | stringstream.cpp:155:11:155:11 | call to operator>> | stringstream.cpp:155:20:155:21 | ref arg b4 | TAINT |
 | stringstream.cpp:155:11:155:11 | ref arg call to operator>> | stringstream.cpp:155:7:155:9 | ref arg ss2 | TAINT |
 | stringstream.cpp:155:14:155:15 | ref arg b3 | stringstream.cpp:158:7:158:8 | b3 |  |
@@ -5296,7 +5307,7 @@
 | stringstream.cpp:245:15:245:17 | ss1 | stringstream.cpp:245:7:245:13 | call to getline |  |
 | stringstream.cpp:245:15:245:17 | ss1 | stringstream.cpp:245:20:245:21 | ref arg s6 | TAINT |
 | stringstream.cpp:245:20:245:21 | ref arg s6 | stringstream.cpp:248:7:248:8 | s6 |  |
-| stringstream.cpp:250:15:250:21 | call to getline | stringstream.cpp:250:7:250:13 | call to getline |  |
+| stringstream.cpp:250:15:250:21 | call to getline | stringstream.cpp:250:7:250:13 | call to getline | TAINT |
 | stringstream.cpp:250:15:250:21 | call to getline | stringstream.cpp:250:33:250:34 | ref arg s8 | TAINT |
 | stringstream.cpp:250:15:250:21 | ref arg call to getline | stringstream.cpp:250:23:250:25 | ref arg ss2 | TAINT |
 | stringstream.cpp:250:23:250:25 | ss2 | stringstream.cpp:250:15:250:21 | call to getline |  |
@@ -5500,7 +5511,7 @@
 | swap1.cpp:100:9:100:17 | ref arg call to move | swap1.cpp:103:10:103:10 | x |  |
 | swap1.cpp:100:19:100:19 | x | swap1.cpp:100:5:100:5 | ref arg y | TAINT |
 | swap1.cpp:100:19:100:19 | x | swap1.cpp:100:7:100:7 | call to operator= | TAINT |
-| swap1.cpp:100:19:100:19 | x | swap1.cpp:100:9:100:17 | call to move |  |
+| swap1.cpp:100:19:100:19 | x | swap1.cpp:100:9:100:17 | call to move | TAINT |
 | swap1.cpp:108:23:108:31 | move_from | swap1.cpp:109:5:109:13 | move_from |  |
 | swap1.cpp:108:23:108:31 | move_from | swap1.cpp:111:10:111:18 | move_from |  |
 | swap1.cpp:108:23:108:31 | move_from | swap1.cpp:113:41:113:49 | move_from |  |
@@ -5513,7 +5524,7 @@
 | swap1.cpp:113:31:113:39 | call to move | swap1.cpp:113:31:113:51 | call to Class | TAINT |
 | swap1.cpp:113:31:113:39 | ref arg call to move | swap1.cpp:113:41:113:49 | move_from [inner post update] |  |
 | swap1.cpp:113:31:113:51 | call to Class | swap1.cpp:115:10:115:16 | move_to |  |
-| swap1.cpp:113:41:113:49 | move_from | swap1.cpp:113:31:113:39 | call to move |  |
+| swap1.cpp:113:41:113:49 | move_from | swap1.cpp:113:31:113:39 | call to move | TAINT |
 | swap1.cpp:113:41:113:49 | move_from | swap1.cpp:113:31:113:51 | call to Class |  |
 | swap1.cpp:120:23:120:23 | x | swap1.cpp:122:5:122:5 | x |  |
 | swap1.cpp:120:23:120:23 | x | swap1.cpp:124:10:124:10 | x |  |
@@ -5547,7 +5558,7 @@
 | swap1.cpp:142:5:142:5 | ref arg y | swap1.cpp:144:10:144:10 | y |  |
 | swap1.cpp:142:19:142:27 | ref arg call to move | swap1.cpp:142:29:142:29 | x [inner post update] |  |
 | swap1.cpp:142:19:142:27 | ref arg call to move | swap1.cpp:145:10:145:10 | x |  |
-| swap1.cpp:142:29:142:29 | x | swap1.cpp:142:19:142:27 | call to move |  |
+| swap1.cpp:142:29:142:29 | x | swap1.cpp:142:19:142:27 | call to move | TAINT |
 | swap2.cpp:14:17:14:17 | t | swap2.cpp:14:17:14:17 | t |  |
 | swap2.cpp:14:17:14:17 | t | swap2.cpp:14:17:14:17 | t |  |
 | swap2.cpp:14:17:14:17 | t | swap2.cpp:14:56:14:56 | t |  |
@@ -5679,7 +5690,7 @@
 | swap2.cpp:100:9:100:17 | ref arg call to move | swap2.cpp:103:10:103:10 | x |  |
 | swap2.cpp:100:19:100:19 | x | swap2.cpp:100:5:100:5 | ref arg y | TAINT |
 | swap2.cpp:100:19:100:19 | x | swap2.cpp:100:7:100:7 | call to operator= | TAINT |
-| swap2.cpp:100:19:100:19 | x | swap2.cpp:100:9:100:17 | call to move |  |
+| swap2.cpp:100:19:100:19 | x | swap2.cpp:100:9:100:17 | call to move | TAINT |
 | swap2.cpp:108:23:108:31 | move_from | swap2.cpp:109:5:109:13 | move_from |  |
 | swap2.cpp:108:23:108:31 | move_from | swap2.cpp:111:10:111:18 | move_from |  |
 | swap2.cpp:108:23:108:31 | move_from | swap2.cpp:113:41:113:49 | move_from |  |
@@ -5692,7 +5703,7 @@
 | swap2.cpp:113:31:113:39 | call to move | swap2.cpp:113:31:113:51 | call to Class | TAINT |
 | swap2.cpp:113:31:113:39 | ref arg call to move | swap2.cpp:113:41:113:49 | move_from [inner post update] |  |
 | swap2.cpp:113:31:113:51 | call to Class | swap2.cpp:115:10:115:16 | move_to |  |
-| swap2.cpp:113:41:113:49 | move_from | swap2.cpp:113:31:113:39 | call to move |  |
+| swap2.cpp:113:41:113:49 | move_from | swap2.cpp:113:31:113:39 | call to move | TAINT |
 | swap2.cpp:113:41:113:49 | move_from | swap2.cpp:113:31:113:51 | call to Class |  |
 | swap2.cpp:120:23:120:23 | x | swap2.cpp:122:5:122:5 | x |  |
 | swap2.cpp:120:23:120:23 | x | swap2.cpp:124:10:124:10 | x |  |
@@ -5726,7 +5737,7 @@
 | swap2.cpp:142:5:142:5 | ref arg y | swap2.cpp:144:10:144:10 | y |  |
 | swap2.cpp:142:19:142:27 | ref arg call to move | swap2.cpp:142:29:142:29 | x [inner post update] |  |
 | swap2.cpp:142:19:142:27 | ref arg call to move | swap2.cpp:145:10:145:10 | x |  |
-| swap2.cpp:142:29:142:29 | x | swap2.cpp:142:19:142:27 | call to move |  |
+| swap2.cpp:142:29:142:29 | x | swap2.cpp:142:19:142:27 | call to move | TAINT |
 | taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 |  |
 | taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 |  |
 | taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 |  |
@@ -7950,7 +7961,7 @@
 | vector.cpp:527:9:527:10 | ref arg it | vector.cpp:529:9:529:10 | it |  |
 | vector.cpp:527:9:527:10 | ref arg it | vector.cpp:530:3:530:4 | it |  |
 | vector.cpp:527:9:527:10 | ref arg it | vector.cpp:531:9:531:10 | it |  |
-| vector.cpp:528:3:528:4 | it | vector.cpp:528:6:528:6 | call to operator+= |  |
+| vector.cpp:528:3:528:4 | it | vector.cpp:528:6:528:6 | call to operator+= | TAINT |
 | vector.cpp:528:3:528:4 | ref arg it | vector.cpp:529:9:529:10 | it |  |
 | vector.cpp:528:3:528:4 | ref arg it | vector.cpp:530:3:530:4 | it |  |
 | vector.cpp:528:3:528:4 | ref arg it | vector.cpp:531:9:531:10 | it |  |
@@ -7958,7 +7969,7 @@
 | vector.cpp:529:9:529:10 | it | vector.cpp:529:8:529:8 | call to operator* | TAINT |
 | vector.cpp:529:9:529:10 | ref arg it | vector.cpp:530:3:530:4 | it |  |
 | vector.cpp:529:9:529:10 | ref arg it | vector.cpp:531:9:531:10 | it |  |
-| vector.cpp:530:3:530:4 | it | vector.cpp:530:6:530:6 | call to operator+= |  |
+| vector.cpp:530:3:530:4 | it | vector.cpp:530:6:530:6 | call to operator+= | TAINT |
 | vector.cpp:530:3:530:4 | ref arg it | vector.cpp:531:9:531:10 | it |  |
 | vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT |
 | vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index 39cff39e3edc..28e44779009b 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -9,7 +9,7 @@ template<typename T> void sink(std::unique_ptr<T>&);
 
 void test_make_shared() {
     std::shared_ptr<int> p = std::make_shared<int>(source());
-    sink(*p); // $ ast MISSING: ir
+    sink(*p); // $ ast,ir
     sink(p); // $ ast,ir
 }
 
@@ -21,7 +21,7 @@ void test_make_shared_array() {
 
 void test_make_unique() {
     std::unique_ptr<int> p = std::make_unique<int>(source());
-    sink(*p); // $ ast MISSING: ir
+    sink(*p); // $ ast,ir
     sink(p); // $ ast,ir
 }
 
@@ -101,7 +101,7 @@ void taint_x(A* pa) {
 void reverse_taint_smart_pointer() {
   std::unique_ptr<A> p = std::unique_ptr<A>(new A);
   taint_x(p.get());
-  sink(p->x); // $ ast MISSING: ir
+  sink(p->x); // $ ast,ir
 }
 
 struct C {

From fe8deeaf6ba4915c0390c4dda3ba223a0f0aee8a Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 21 Apr 2021 23:13:57 +0100
Subject: [PATCH 374/433] JS: Autoformat

---
 .../semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
index 1069833eeea0..dda1ac7ae34f 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/FunctionWrapperSteps.qll
@@ -1,4 +1,5 @@
 /** Provides predicates for tracking functions through wrapper functions. */
+
 private import javascript
 private import FlowSteps as FlowSteps
 private import semmle.javascript.internal.CachedStages

From cac1bef6ea6c72631e8e74b50af900c9e1c70f91 Mon Sep 17 00:00:00 2001
From: Robert Marsh <rdmarsh@semmle.com>
Date: Wed, 21 Apr 2021 11:58:14 -0700
Subject: [PATCH 375/433] C++: deprecate cpp/return-stack-allocated-object

---
 cpp/change-notes/2021-04-21-return-stack-allocated-object.md | 2 ++
 cpp/ql/src/Critical/ReturnStackAllocatedObject.ql            | 2 ++
 2 files changed, 4 insertions(+)
 create mode 100644 cpp/change-notes/2021-04-21-return-stack-allocated-object.md

diff --git a/cpp/change-notes/2021-04-21-return-stack-allocated-object.md b/cpp/change-notes/2021-04-21-return-stack-allocated-object.md
new file mode 100644
index 000000000000..1876f4cf5f7a
--- /dev/null
+++ b/cpp/change-notes/2021-04-21-return-stack-allocated-object.md
@@ -0,0 +1,2 @@
+codescanning
+* The 'Pointer to stack object used as return value' (cpp/return-stack-allocated-object) query has been deprecated, and any uses should be replaced with `Returning stack-allocated memory` (cpp/return-stack-allocated-memory).
\ No newline at end of file
diff --git a/cpp/ql/src/Critical/ReturnStackAllocatedObject.ql b/cpp/ql/src/Critical/ReturnStackAllocatedObject.ql
index 353e51daa71a..e3873e487dd2 100644
--- a/cpp/ql/src/Critical/ReturnStackAllocatedObject.ql
+++ b/cpp/ql/src/Critical/ReturnStackAllocatedObject.ql
@@ -7,6 +7,8 @@
  * @tags reliability
  *       security
  *       external/cwe/cwe-562
+ * @deprecated This query is not suitable for production use and has been deprecated. Use
+ *             cpp/return-stack-allocated-memory instead.
  */
 
 import semmle.code.cpp.pointsto.PointsTo

From 9c936867faa7cd92fc23b626211fc52ec0730679 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tam=C3=A1s=20Vajk?= <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 09:00:31 +0200
Subject: [PATCH 376/433] Exclude code from XML files

Co-authored-by: yo-h <55373593+yo-h@users.noreply.github.com>
---
 java/ql/src/Metrics/Summaries/LinesOfCode.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/Metrics/Summaries/LinesOfCode.ql b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
index 9a90242e3cb5..d6db7c6ee6b0 100644
--- a/java/ql/src/Metrics/Summaries/LinesOfCode.ql
+++ b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
@@ -10,4 +10,4 @@
 
 import java
 
-select sum(File f, int i | i = f.getNumberOfLinesOfCode() | i)
+select sum(CompilationUnit f | f.fromSource() | f.getNumberOfLinesOfCode())

From 5149ffdd16f46b0dddb60552d162fd772e9a45df Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 12:01:09 +0200
Subject: [PATCH 377/433] C#: Add extraction error diagnostic query

---
 .../Diagnostics/DiagnosticExtractionErrors.ql  | 18 ++++++++++++++++++
 .../DiagnosticExtractorErrors.expected         |  0
 .../DiagnosticExtractorErrors.qlref            |  1 +
 .../test/library-tests/diagnostics/Program.cs  | 17 +++++++++++++++++
 4 files changed, 36 insertions(+)
 create mode 100644 csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
 create mode 100644 csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
 create mode 100644 csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref
 create mode 100644 csharp/ql/test/library-tests/diagnostics/Program.cs

diff --git a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
new file mode 100644
index 000000000000..e2fdf2751a43
--- /dev/null
+++ b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Extraction errors
+ * @description List all errors reported by the extractor. The returned issues are
+ *              limited to those files where there are no compilation errors. This
+ *              indicates a bug or limitation in the extractor, and could lead to
+ *              inaccurate results.
+ * @kind diagnostic
+ * @id cs/diagnostics/extraction-errors
+ */
+
+import csharp
+import semmle.code.csharp.commons.Diagnostics
+
+from ExtractorError error
+where not exists(CompilerError ce | ce.getLocation().getFile() = error.getLocation().getFile())
+select error,
+  "Unexpected " + error.getOrigin() + " error: " + error.getText() + " in " +
+    error.getLocation().getFile(), 3
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref
new file mode 100644
index 000000000000..7068705cc1be
--- /dev/null
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref
@@ -0,0 +1 @@
+Diagnostics/DiagnosticExtractionErrors.ql
diff --git a/csharp/ql/test/library-tests/diagnostics/Program.cs b/csharp/ql/test/library-tests/diagnostics/Program.cs
new file mode 100644
index 000000000000..7f0a7e57d1cd
--- /dev/null
+++ b/csharp/ql/test/library-tests/diagnostics/Program.cs
@@ -0,0 +1,17 @@
+// semmle-extractor-options: --standalone
+
+using System;
+
+class Class
+{
+    static void Main(string[] args)
+    {
+        int z = GetParamLength(__arglist(1, 2));
+    }
+
+    public static int GetParamLength(__arglist)
+    {
+        ArgIterator iterator = new ArgIterator(__arglist);
+        return iterator.GetRemainingCount();
+    }
+}

From 353d43a03930efd657638ad8a39e11d4eecbdfc2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 12:38:55 +0200
Subject: [PATCH 378/433] Log model errors even in standalone extraction

---
 csharp/extractor/Semmle.Extraction/Context.cs | 22 ++++++++++++++-----
 .../Diagnostics/DiagnosticExtractionErrors.ql |  9 ++++++--
 .../DiagnosticExtractorErrors.expected        |  2 ++
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index c0580db96a7d..a60d82c6952a 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -376,6 +376,19 @@ private void ExtractionError(Message msg)
             Extractor.Message(msg);
         }
 
+        private void ExtractionError(InternalError error)
+        {
+            ExtractionError(new Message(error.Message, error.EntityText, CreateLocation(error.Location), error.StackTrace, Severity.Error));
+        }
+
+        private void ReportError(InternalError error)
+        {
+            if (!Extractor.Standalone)
+                throw error;
+
+            ExtractionError(error);
+        }
+
         /// <summary>
         /// Signal an error in the program model.
         /// </summary>
@@ -383,8 +396,7 @@ private void ExtractionError(Message msg)
         /// <param name="msg">The error message.</param>
         public void ModelError(SyntaxNode node, string msg)
         {
-            if (!Extractor.Standalone)
-                throw new InternalError(node, msg);
+            ReportError(new InternalError(node, msg));
         }
 
         /// <summary>
@@ -394,8 +406,7 @@ public void ModelError(SyntaxNode node, string msg)
         /// <param name="msg">The error message.</param>
         public void ModelError(ISymbol symbol, string msg)
         {
-            if (!Extractor.Standalone)
-                throw new InternalError(symbol, msg);
+            ReportError(new InternalError(symbol, msg));
         }
 
         /// <summary>
@@ -404,8 +415,7 @@ public void ModelError(ISymbol symbol, string msg)
         /// <param name="msg">The error message.</param>
         public void ModelError(string msg)
         {
-            if (!Extractor.Standalone)
-                throw new InternalError(msg);
+            ReportError(new InternalError(msg));
         }
 
         /// <summary>
diff --git a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
index e2fdf2751a43..91a3c76b2546 100644
--- a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
+++ b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -11,8 +11,13 @@
 import csharp
 import semmle.code.csharp.commons.Diagnostics
 
+private string getLocation(ExtractorError error) {
+  if error.getLocation().getFile().fromSource()
+  then result = " in " + error.getLocation().getFile()
+  else result = ""
+}
+
 from ExtractorError error
 where not exists(CompilerError ce | ce.getLocation().getFile() = error.getLocation().getFile())
 select error,
-  "Unexpected " + error.getOrigin() + " error: " + error.getText() + " in " +
-    error.getLocation().getFile(), 3
+  "Unexpected " + error.getOrigin() + " error" + getLocation(error) + ": " + error.getText(), 3
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
index e69de29bb2d1..d83e9827256a 100644
--- a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
@@ -0,0 +1,2 @@
+| Program.cs:9:32:9:46 | Unable to resolve target for call. (Compilation error?) | Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 3 |
+| file://:0:0:0:0 | Unhandled literal type | Unexpected C# extractor error: Unhandled literal type | 3 |

From b05e211e2133ec4eaa910393fa5e8282c8f632a2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 13:48:53 +0200
Subject: [PATCH 379/433] Fix failing test

---
 .../errorrecovery/DiagnosticsAndErrors.expected        | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected b/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
index 13bdd30b1c40..917d625c10c3 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/DiagnosticsAndErrors.expected
@@ -1,3 +1,13 @@
 compilationMessages
 extractorMessages
+| errors.cs:8:1:8:22 | Namespace not found |
+| errors.cs:24:31:24:32 | Failed to determine type |
+| errors.cs:24:31:24:40 | Failed to determine type |
+| errors.cs:24:31:24:40 | Unable to resolve target for call. (Compilation error?) |
+| errors.cs:24:38:24:39 | Failed to determine type |
+| errors.cs:57:20:57:20 | Failed to determine type |
+| errors.cs:93:45:93:45 | Failed to determine type |
+| errors.cs:93:45:93:45 | Failed to resolve name |
+| errors.cs:94:45:94:45 | Failed to determine type |
+| errors.cs:94:45:94:45 | Failed to resolve name |
 | file://:0:0:0:0 | Extracting default argument value 'object RecordNumber = default' instead of 'object RecordNumber = -1'. The latter is not supported in C#. |

From ff9327a03572d4774308dad1f640af9b73ea5736 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 21 Apr 2021 14:41:53 +0200
Subject: [PATCH 380/433] Add diagnostic query to get correctly extracted files

---
 .../Diagnostics/DiagnosticNoExtractionErrors.ql    | 14 ++++++++++++++
 csharp/ql/test/library-tests/diagnostics/A.cs      |  4 ++++
 .../DiagnosticNoExtractorErrors.expected           |  1 +
 .../diagnostics/DiagnosticNoExtractorErrors.qlref  |  1 +
 4 files changed, 20 insertions(+)
 create mode 100644 csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
 create mode 100644 csharp/ql/test/library-tests/diagnostics/A.cs
 create mode 100644 csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.expected
 create mode 100644 csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.qlref

diff --git a/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
new file mode 100644
index 000000000000..11ef3b327fa0
--- /dev/null
+++ b/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Successfully extracted files
+ * @description A list of all files in the source code directory that were extracted
+ *              without encountering an extraction error in the file.
+ * @kind diagnostic
+ * @id cs/diagnostics/successfully-extracted-files
+ */
+
+import csharp
+import semmle.code.csharp.commons.Diagnostics
+
+from File file
+where file.fromSource() and not exists(ExtractorError e | e.getLocation().getFile() = file)
+select file, ""
diff --git a/csharp/ql/test/library-tests/diagnostics/A.cs b/csharp/ql/test/library-tests/diagnostics/A.cs
new file mode 100644
index 000000000000..21a5b7f52616
--- /dev/null
+++ b/csharp/ql/test/library-tests/diagnostics/A.cs
@@ -0,0 +1,4 @@
+public class A
+{
+    public void M() { }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.expected
new file mode 100644
index 000000000000..17e4dc54b7dd
--- /dev/null
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.expected
@@ -0,0 +1 @@
+| A.cs:0:0:0:0 | A.cs |  |
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.qlref b/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.qlref
new file mode 100644
index 000000000000..7994e050699f
--- /dev/null
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticNoExtractorErrors.qlref
@@ -0,0 +1 @@
+Diagnostics/DiagnosticNoExtractionErrors.ql

From 64354bbfaac18b9845033af46e01c9cf86d431db Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 09:23:59 +0200
Subject: [PATCH 381/433] Fix test results after rebase

---
 .../library-tests/diagnostics/DiagnosticExtractorErrors.expected | 1 -
 1 file changed, 1 deletion(-)

diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
index d83e9827256a..f1f4d9750a8d 100644
--- a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
@@ -1,2 +1 @@
 | Program.cs:9:32:9:46 | Unable to resolve target for call. (Compilation error?) | Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 3 |
-| file://:0:0:0:0 | Unhandled literal type | Unexpected C# extractor error: Unhandled literal type | 3 |

From 1a708affbfb30b137746359ba0dcc555cc86fbcc Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 10:08:33 +0200
Subject: [PATCH 382/433] Include compilation errors in diagnostic check

---
 .../Diagnostics/DiagnosticExtractionErrors.ql | 56 +++++++++++++++----
 .../DiagnosticNoExtractionErrors.ql           |  7 ++-
 .../DiagnosticExtractorErrors.expected        |  2 +-
 3 files changed, 50 insertions(+), 15 deletions(-)

diff --git a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
index 91a3c76b2546..f19fcc6416ac 100644
--- a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
+++ b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -1,9 +1,7 @@
 /**
  * @name Extraction errors
- * @description List all errors reported by the extractor. The returned issues are
- *              limited to those files where there are no compilation errors. This
- *              indicates a bug or limitation in the extractor, and could lead to
- *              inaccurate results.
+ * @description List all errors reported by the extractor or the compiler. Extractor errors are
+ *              limited to those files where there are no compilation errors.
  * @kind diagnostic
  * @id cs/diagnostics/extraction-errors
  */
@@ -11,13 +9,47 @@
 import csharp
 import semmle.code.csharp.commons.Diagnostics
 
-private string getLocation(ExtractorError error) {
-  if error.getLocation().getFile().fromSource()
-  then result = " in " + error.getLocation().getFile()
-  else result = ""
+private newtype TDiagnosticError =
+  TCompilerError(CompilerError c) or
+  TExtractorError(ExtractorError e)
+
+abstract private class DiagnosticError extends TDiagnosticError {
+  string getMessage() { none() }
+
+  string toString() { none() }
+
+  string getLocation(Location l) {
+    if l.getFile().fromSource() then result = " in " + l.getFile() else result = ""
+  }
+}
+
+private class DiagnosticCompilerError extends DiagnosticError {
+  CompilerError c;
+
+  DiagnosticCompilerError() { this = TCompilerError(c) }
+
+  override string getMessage() {
+    result = "Compiler error" + getLocation(c.getLocation()) + ": " + c.getMessage()
+  }
+
+  override string toString() { result = c.toString() }
+}
+
+private class DiagnosticExtractorError extends DiagnosticError {
+  ExtractorError e;
+
+  DiagnosticExtractorError() {
+    this = TExtractorError(e) and
+    not exists(CompilerError ce | ce.getLocation().getFile() = e.getLocation().getFile())
+  }
+
+  override string getMessage() {
+    result =
+      "Unexpected " + e.getOrigin() + " error" + getLocation(e.getLocation()) + ": " + e.getText()
+  }
+
+  override string toString() { result = e.toString() }
 }
 
-from ExtractorError error
-where not exists(CompilerError ce | ce.getLocation().getFile() = error.getLocation().getFile())
-select error,
-  "Unexpected " + error.getOrigin() + " error" + getLocation(error) + ": " + error.getText(), 3
+from DiagnosticError error
+select error.getMessage(), 3
diff --git a/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
index 11ef3b327fa0..cb86e293efcb 100644
--- a/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
+++ b/csharp/ql/src/Diagnostics/DiagnosticNoExtractionErrors.ql
@@ -1,7 +1,7 @@
 /**
  * @name Successfully extracted files
  * @description A list of all files in the source code directory that were extracted
- *              without encountering an extraction error in the file.
+ *              without encountering an extraction or compiler error in the file.
  * @kind diagnostic
  * @id cs/diagnostics/successfully-extracted-files
  */
@@ -10,5 +10,8 @@ import csharp
 import semmle.code.csharp.commons.Diagnostics
 
 from File file
-where file.fromSource() and not exists(ExtractorError e | e.getLocation().getFile() = file)
+where
+  file.fromSource() and
+  not exists(ExtractorError e | e.getLocation().getFile() = file) and
+  not exists(CompilerError e | e.getLocation().getFile() = file)
 select file, ""
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
index f1f4d9750a8d..e47e78cdce94 100644
--- a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
@@ -1 +1 @@
-| Program.cs:9:32:9:46 | Unable to resolve target for call. (Compilation error?) | Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 3 |
+| Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 3 |

From 1dab1590ea268cb6370f022efa7d5e4c5277f7d0 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 10:18:31 +0200
Subject: [PATCH 383/433] C#: Adjust 'fromSource' to hold only on files passed
 to the compiler as a source file

---
 .../extractor/Semmle.Extraction.CSharp/Entities/File.cs  | 9 +++++----
 .../Semmle.Extraction/Entities/GeneratedFile.cs          | 2 +-
 csharp/extractor/Semmle.Extraction/FileSourceKind.cs     | 9 +++++++++
 csharp/extractor/Semmle.Extraction/Tuples.cs             | 4 ++--
 csharp/ql/src/semmle/code/csharp/File.qll                | 2 +-
 5 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 csharp/extractor/Semmle.Extraction/FileSourceKind.cs

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
index f22edb158aab..a853065ad04f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
@@ -17,14 +17,15 @@ protected File(Context cx, string path)
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.files(this, TransformedPath.Value, TransformedPath.NameWithoutExtension, TransformedPath.Extension);
+            var trees = Context.Compilation.SyntaxTrees.Where(t => t.FilePath == originalPath);
+            var isSource = trees.Any();
+
+            trapFile.files(this, TransformedPath.Value, TransformedPath.NameWithoutExtension, TransformedPath.Extension, isSource ? FileSourceKind.FromSource : FileSourceKind.Unknown);
 
             if (TransformedPath.ParentDirectory is PathTransformer.ITransformedPath dir)
                 trapFile.containerparent(Extraction.Entities.Folder.Create(Context, dir), this);
 
-            var trees = Context.Compilation.SyntaxTrees.Where(t => t.FilePath == originalPath);
-
-            if (trees.Any())
+            if (isSource)
             {
                 foreach (var text in trees.Select(tree => tree.GetText()))
                 {
diff --git a/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs b/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
index db458e574a57..d6fc07c4fa3d 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
@@ -10,7 +10,7 @@ private GeneratedFile(Context cx) : base(cx, "") { }
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.files(this, "", "", "");
+            trapFile.files(this, "", "", "", FileSourceKind.Unknown);
         }
 
         public override void WriteId(TextWriter trapFile)
diff --git a/csharp/extractor/Semmle.Extraction/FileSourceKind.cs b/csharp/extractor/Semmle.Extraction/FileSourceKind.cs
new file mode 100644
index 000000000000..1edce1943b38
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/FileSourceKind.cs
@@ -0,0 +1,9 @@
+namespace Semmle.Extraction
+{
+    public enum FileSourceKind
+    {
+        Unknown = 0,
+        FromSource = 1,
+        FromLibrary = 2
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Tuples.cs b/csharp/extractor/Semmle.Extraction/Tuples.cs
index 49c14df76434..6d40a2049477 100644
--- a/csharp/extractor/Semmle.Extraction/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction/Tuples.cs
@@ -18,9 +18,9 @@ internal static void extractor_messages(this System.IO.TextWriter trapFile, Extr
             trapFile.WriteTuple("extractor_messages", error, (int)severity, origin, errorMessage, entityText, location, stackTrace);
         }
 
-        public static void files(this System.IO.TextWriter trapFile, File file, string fullName, string name, string extension)
+        public static void files(this System.IO.TextWriter trapFile, File file, string fullName, string name, string extension, FileSourceKind kind)
         {
-            trapFile.WriteTuple("files", file, fullName, name, extension, 0);
+            trapFile.WriteTuple("files", file, fullName, name, extension, (int)kind);
         }
 
         internal static void folders(this System.IO.TextWriter trapFile, Folder folder, string path, string name)
diff --git a/csharp/ql/src/semmle/code/csharp/File.qll b/csharp/ql/src/semmle/code/csharp/File.qll
index 86656af41243..8ebc4aebe2b2 100644
--- a/csharp/ql/src/semmle/code/csharp/File.qll
+++ b/csharp/ql/src/semmle/code/csharp/File.qll
@@ -192,7 +192,7 @@ class File extends Container, @file {
   override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
 
   /** Holds if this file contains source code. */
-  predicate fromSource() { this.getNumberOfLinesOfCode() > 0 }
+  predicate fromSource() { files(this, _, _, _, 1) }
 
   /** Holds if this file is a library. */
   predicate fromLibrary() {

From 9f1704560b754523626bf8e74e7f64c842faaeb5 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Wed, 21 Apr 2021 15:39:23 +0100
Subject: [PATCH 384/433] Include constructors in abstract class

---
 java/ql/src/semmle/code/java/JDK.qll            | 17 +++++++++++++++--
 .../semmle/code/java/frameworks/apache/Exec.qll |  8 ++++++--
 .../code/java/security/ExternalProcess.qll      | 17 +++++++----------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/java/ql/src/semmle/code/java/JDK.qll b/java/ql/src/semmle/code/java/JDK.qll
index 4d9e2bbc2d79..3e67fd8dfa61 100644
--- a/java/ql/src/semmle/code/java/JDK.qll
+++ b/java/ql/src/semmle/code/java/JDK.qll
@@ -180,21 +180,34 @@ class TypeFile extends Class {
 /**
  * Any of the methods named `command` on class `java.lang.ProcessBuilder`.
  */
-class MethodProcessBuilderCommand extends ExecMethod {
+class ProcessBuilderConstructor extends Constructor, ExecCallable {
+  ProcessBuilderConstructor() { this.getDeclaringType() instanceof TypeProcessBuilder }
+
+  override int getAnExecutedArgument() { result = 0 }
+}
+
+/**
+ * Any of the methods named `command` on class `java.lang.ProcessBuilder`.
+ */
+class MethodProcessBuilderCommand extends Method, ExecCallable {
   MethodProcessBuilderCommand() {
     hasName("command") and
     getDeclaringType() instanceof TypeProcessBuilder
   }
+
+  override int getAnExecutedArgument() { result = 0 }
 }
 
 /**
  * Any method named `exec` on class `java.lang.Runtime`.
  */
-class MethodRuntimeExec extends ExecMethod {
+class MethodRuntimeExec extends Method, ExecCallable {
   MethodRuntimeExec() {
     hasName("exec") and
     getDeclaringType() instanceof TypeRuntime
   }
+
+  override int getAnExecutedArgument() { result = 0 }
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
index b12887e56349..49976c020a80 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
@@ -6,16 +6,20 @@ library class TypeCommandLine extends Class {
   TypeCommandLine() { hasQualifiedName("org.apache.commons.exec", "CommandLine") }
 }
 
-library class MethodCommandLineParse extends ExecMethod {
+library class MethodCommandLineParse extends Method, ExecCallable {
   MethodCommandLineParse() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("parse")
   }
+
+  override int getAnExecutedArgument() { result = 0 }
 }
 
-library class MethodCommandLineAddArguments extends ExecMethod {
+library class MethodCommandLineAddArguments extends Method, ExecCallable {
   MethodCommandLineAddArguments() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("addArguments")
   }
+
+  override int getAnExecutedArgument() { result = 0 }
 }
diff --git a/java/ql/src/semmle/code/java/security/ExternalProcess.qll b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
index 6b098a2d0e86..e60efc42543a 100644
--- a/java/ql/src/semmle/code/java/security/ExternalProcess.qll
+++ b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
@@ -6,7 +6,9 @@ import semmle.code.java.frameworks.apache.Exec
 /**
  * A method that executes a command.
  */
-abstract class ExecMethod extends Method { }
+abstract class ExecCallable extends Callable {
+  abstract int getAnExecutedArgument();
+}
 
 /**
  * An expression used as an argument to a call that executes an external command. For calls to
@@ -15,15 +17,10 @@ abstract class ExecMethod extends Method { }
  */
 class ArgumentToExec extends Expr {
   ArgumentToExec() {
-    exists(MethodAccess execCall, ExecMethod method |
-      execCall.getArgument(0) = this and
-      method = execCall.getMethod()
-    )
-    or
-    exists(ConstructorCall expr, Constructor cons |
-      expr.getConstructor() = cons and
-      cons.getDeclaringType().hasQualifiedName("java.lang", "ProcessBuilder") and
-      expr.getArgument(0) = this
+    exists(Call execCall, ExecCallable execCallable, int i |
+      execCall.getArgument(i) = this and
+      execCallable = execCall.getCallee() and
+      i = execCallable.getAnExecutedArgument()
     )
   }
 }

From e448dcb7256400570cfb4408fc26ffe7121b004b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Wed, 21 Apr 2021 16:11:18 +0100
Subject: [PATCH 385/433] Avoid bad join order

We want to avoid joining on `i` first.
---
 java/ql/src/semmle/code/java/security/ExternalProcess.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/semmle/code/java/security/ExternalProcess.qll b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
index e60efc42543a..46b3e8c65df6 100644
--- a/java/ql/src/semmle/code/java/security/ExternalProcess.qll
+++ b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
@@ -18,7 +18,7 @@ abstract class ExecCallable extends Callable {
 class ArgumentToExec extends Expr {
   ArgumentToExec() {
     exists(Call execCall, ExecCallable execCallable, int i |
-      execCall.getArgument(i) = this and
+      execCall.getArgument(pragma[only_bind_into](i)) = this and
       execCallable = execCall.getCallee() and
       i = execCallable.getAnExecutedArgument()
     )

From 4b8d4f5bbd903e07e03c4f570b6a562ac3de5804 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Wed, 21 Apr 2021 16:12:21 +0100
Subject: [PATCH 386/433] Update docs

---
 java/ql/src/semmle/code/java/JDK.qll                     | 2 +-
 java/ql/src/semmle/code/java/frameworks/apache/Exec.qll  | 9 ++++++---
 .../ql/src/semmle/code/java/security/ExternalProcess.qll | 5 ++++-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/java/ql/src/semmle/code/java/JDK.qll b/java/ql/src/semmle/code/java/JDK.qll
index 3e67fd8dfa61..1e6d730943ac 100644
--- a/java/ql/src/semmle/code/java/JDK.qll
+++ b/java/ql/src/semmle/code/java/JDK.qll
@@ -178,7 +178,7 @@ class TypeFile extends Class {
 
 // --- Standard methods ---
 /**
- * Any of the methods named `command` on class `java.lang.ProcessBuilder`.
+ * Any constructor of class `java.lang.ProcessBuilder`.
  */
 class ProcessBuilderConstructor extends Constructor, ExecCallable {
   ProcessBuilderConstructor() { this.getDeclaringType() instanceof TypeProcessBuilder }
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
index 49976c020a80..978154d3274b 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Exec.qll
@@ -2,11 +2,13 @@
 import semmle.code.java.Type
 import semmle.code.java.security.ExternalProcess
 
-library class TypeCommandLine extends Class {
+/** The class `org.apache.commons.exec.CommandLine`. */
+private class TypeCommandLine extends Class {
   TypeCommandLine() { hasQualifiedName("org.apache.commons.exec", "CommandLine") }
 }
 
-library class MethodCommandLineParse extends Method, ExecCallable {
+/** The `parse()` method of the class `org.apache.commons.exec.CommandLine`. */
+private class MethodCommandLineParse extends Method, ExecCallable {
   MethodCommandLineParse() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("parse")
@@ -15,7 +17,8 @@ library class MethodCommandLineParse extends Method, ExecCallable {
   override int getAnExecutedArgument() { result = 0 }
 }
 
-library class MethodCommandLineAddArguments extends Method, ExecCallable {
+/** The `addArguments()` method of the class `org.apache.commons.exec.CommandLine`. */
+private class MethodCommandLineAddArguments extends Method, ExecCallable {
   MethodCommandLineAddArguments() {
     getDeclaringType() instanceof TypeCommandLine and
     hasName("addArguments")
diff --git a/java/ql/src/semmle/code/java/security/ExternalProcess.qll b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
index 46b3e8c65df6..4cccdb2a1bdd 100644
--- a/java/ql/src/semmle/code/java/security/ExternalProcess.qll
+++ b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
@@ -4,9 +4,12 @@ import semmle.code.java.JDK
 import semmle.code.java.frameworks.apache.Exec
 
 /**
- * A method that executes a command.
+ * A callable that executes a command.
  */
 abstract class ExecCallable extends Callable {
+  /**
+   * Gets the index of an argument that will be part of the command that is executed.
+   */
   abstract int getAnExecutedArgument();
 }
 

From 8a01799fb8fd049d18bee768a51107680c4b3534 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
Date: Thu, 22 Apr 2021 09:46:49 +0100
Subject: [PATCH 387/433] Make imports private

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
---
 java/ql/src/semmle/code/java/security/ExternalProcess.qll | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/security/ExternalProcess.qll b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
index 4cccdb2a1bdd..fe5e46d5efbf 100644
--- a/java/ql/src/semmle/code/java/security/ExternalProcess.qll
+++ b/java/ql/src/semmle/code/java/security/ExternalProcess.qll
@@ -1,7 +1,10 @@
 /* Definitions related to external processes. */
 import semmle.code.java.Member
-import semmle.code.java.JDK
-import semmle.code.java.frameworks.apache.Exec
+
+private module Instances {
+  private import semmle.code.java.JDK
+  private import semmle.code.java.frameworks.apache.Exec
+}
 
 /**
  * A callable that executes a command.

From a8a920c8f02fef08b3200473f502c6c4adac2cd7 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:01:12 +0200
Subject: [PATCH 388/433] Add change note

---
 csharp/change-notes/2021-04-22-console-read-local-source.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 csharp/change-notes/2021-04-22-console-read-local-source.md

diff --git a/csharp/change-notes/2021-04-22-console-read-local-source.md b/csharp/change-notes/2021-04-22-console-read-local-source.md
new file mode 100644
index 000000000000..9fbb5f2ff32a
--- /dev/null
+++ b/csharp/change-notes/2021-04-22-console-read-local-source.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* `System.Console.Read` methods have been added as data flow sources of local user input.
\ No newline at end of file

From 180904e9f6425db8e37d25abb2a780b78316bd6f Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:14:51 +0200
Subject: [PATCH 389/433] Revert "Java: Convert Google HTTP client API parseAs 
 sink to CSV format"

This reverts commit 3e53484bb3b942c58f2bf1b90301a9779ebc34aa.
---
 .../code/java/dataflow/ExternalFlow.qll       |  1 -
 .../frameworks/google/GoogleHttpClientApi.qll | 22 ++++++++++++-------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 154ec98f2ad8..ba329d99f21b 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -76,7 +76,6 @@ private module Frameworks {
   private import semmle.code.java.frameworks.ApacheHttp
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
-  private import semmle.code.java.frameworks.google.GoogleHttpClientApi
   private import semmle.code.java.security.ResponseSplitting
   private import semmle.code.java.security.XSS
 }
diff --git a/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll b/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
index 07e30711b449..ccc446892f12 100644
--- a/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
+++ b/java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
@@ -2,7 +2,14 @@ import java
 import semmle.code.java.Serializability
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.DataFlow5
-private import semmle.code.java.dataflow.ExternalFlow
+
+/** The method `parseAs` in `com.google.api.client.http.HttpResponse`. */
+private class ParseAsMethod extends Method {
+  ParseAsMethod() {
+    this.getDeclaringType().hasQualifiedName("com.google.api.client.http", "HttpResponse") and
+    this.hasName("parseAs")
+  }
+}
 
 private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configuration {
   TypeLiteralToParseAsFlowConfiguration() {
@@ -11,17 +18,16 @@ private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configura
 
   override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof TypeLiteral }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "google-parse-as") }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      ma.getAnArgument() = sink.asExpr() and
+      ma.getMethod() instanceof ParseAsMethod
+    )
+  }
 
   TypeLiteral getSourceWithFlowToParseAs() { hasFlow(DataFlow::exprNode(result), _) }
 }
 
-private class ParseAsSinkModel extends SinkModelCsv {
-  override predicate row(string row) {
-    row = ["com.google.api.client.http;HttpResponse;false;parseAs;;;Argument;google-parse-as"]
-  }
-}
-
 /** A field that is deserialized by `HttpResponse.parseAs`. */
 class HttpResponseParseAsDeserializableField extends DeserializableField {
   HttpResponseParseAsDeserializableField() {

From 9b1c54e81b66d65e35f4cca6729e08cb337ed3c3 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:17:25 +0200
Subject: [PATCH 390/433] Add argument indices to HTTP header splitting sinks

---
 java/ql/src/semmle/code/java/security/ResponseSplitting.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
index 040174d50b50..abc1d2723c99 100644
--- a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
+++ b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
@@ -17,8 +17,8 @@ private class HeaderSplittingSinkModel extends SinkModelCsv {
     row =
       [
         "javax.servlet.http;HttpServletResponse;false;addCookie;;;Argument[0];header-splitting",
-        "javax.servlet.http;HttpServletResponse;false;addHeader;;;Argument;header-splitting",
-        "javax.servlet.http;HttpServletResponse;false;setHeader;;;Argument;header-splitting",
+        "javax.servlet.http;HttpServletResponse;false;addHeader;;;Argument[0..1];header-splitting",
+        "javax.servlet.http;HttpServletResponse;false;setHeader;;;Argument[0..1];header-splitting",
         "javax.ws.rs.core;ResponseBuilder;false;header;;;Argument[1];header-splitting"
       ]
   }

From 6c78a247f2e4516a2e94963c3c2c2f3bb6ae390d Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:20:39 +0200
Subject: [PATCH 391/433] Revert erroneous refactoring in header splitting sink
 base class

---
 java/ql/src/semmle/code/java/security/ResponseSplitting.qll | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
index abc1d2723c99..70af02efc6dc 100644
--- a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
+++ b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll
@@ -8,8 +8,10 @@ import semmle.code.java.frameworks.JaxWS
 private import semmle.code.java.dataflow.ExternalFlow
 
 /** A sink that is vulnerable to an HTTP header splitting attack. */
-class HeaderSplittingSink extends DataFlow::Node {
-  HeaderSplittingSink() { sinkNode(this, "header-splitting") }
+abstract class HeaderSplittingSink extends DataFlow::Node { }
+
+private class DefaultHeaderSplittingSink extends HeaderSplittingSink {
+  DefaultHeaderSplittingSink() { sinkNode(this, "header-splitting") }
 }
 
 private class HeaderSplittingSinkModel extends SinkModelCsv {

From 1caa5c47800ca3d3db58b4fda63b6e4b2b450bb5 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:22:18 +0200
Subject: [PATCH 392/433] Adjust hostname verifier sink identifier name

---
 .../ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql | 2 +-
 java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll        | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
index 058a1f9e1695..d1fe8aee0750 100644
--- a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
+++ b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
@@ -50,7 +50,7 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
     source.asExpr().(ClassInstanceExpr).getConstructedType() instanceof TrustAllHostnameVerifier
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname") }
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname-verifier") }
 
   override predicate isBarrier(DataFlow::Node barrier) {
     // ignore nodes that are in functions that intentionally disable hostname verification
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index ba329d99f21b..b699f0922f39 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -209,8 +209,8 @@ private predicate sinkModelCsv(string row) {
       // Bean validation
       "javax.validation;ConstraintValidatorContext;true;buildConstraintViolationWithTemplate;;;Argument[0];bean-validation",
       // Set hostname
-      "javax.net.ssl;HttpsURLConnection;true;setDefaultHostnameVerifier;;;Argument[0];set-hostname",
-      "javax.net.ssl;HttpsURLConnection;true;setHostnameVerifier;;;Argument[0];set-hostname"
+      "javax.net.ssl;HttpsURLConnection;true;setDefaultHostnameVerifier;;;Argument[0];set-hostname-verifier",
+      "javax.net.ssl;HttpsURLConnection;true;setHostnameVerifier;;;Argument[0];set-hostname-verifier"
     ]
 }
 

From 7134eb9079e7798db2c497a441912574ec15e477 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 11:37:41 +0200
Subject: [PATCH 393/433] Improve documentation of csv sink models

---
 java/ql/src/Security/CWE/CWE-022/ZipSlip.ql            |  9 ++++++++-
 .../src/Security/CWE/CWE-094/InsecureBeanValidation.ql | 10 +++++++++-
 .../Security/CWE/CWE-297/UnsafeHostnameVerification.ql |  9 ++++++++-
 java/ql/src/semmle/code/java/security/XSS.qll          |  1 +
 4 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql b/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
index 80de02d70679..6342a444a646 100644
--- a/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
+++ b/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
@@ -124,7 +124,7 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {
     source.asExpr().(MethodAccess).getMethod() instanceof ArchiveEntryNameMethod
   }
 
-  override predicate isSink(Node sink) { sinkNode(sink, "create-file") }
+  override predicate isSink(Node sink) { sink instanceof FileCreationSink }
 
   override predicate isAdditionalTaintStep(Node n1, Node n2) {
     filePathStep(n1, n2) or fileTaintStep(n1, n2)
@@ -146,6 +146,13 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {
   }
 }
 
+/**
+ * A sink that represents a file creation, such as a file write, copy or move operation.
+ */
+private class FileCreationSink extends DataFlow::Node {
+  FileCreationSink() { sinkNode(this, "create-file") }
+}
+
 from PathNode source, PathNode sink
 where any(ZipSlipConfiguration c).hasFlowPath(source, sink)
 select source.getNode(), source, sink,
diff --git a/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql b/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
index e4ee42008a17..aef404aabd13 100644
--- a/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
+++ b/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
@@ -60,7 +60,15 @@ class BeanValidationConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "bean-validation") }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof BeanValidationSink }
+}
+
+/**
+ * A bean validation sink, such as method `buildConstraintViolationWithTemplate`
+ * declared on a subtype of `javax.validation.ConstraintValidatorContext`.
+ */
+private class BeanValidationSink extends DataFlow::Node {
+  BeanValidationSink() { sinkNode(this, "bean-validation") }
 }
 
 from BeanValidationConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
diff --git a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
index d1fe8aee0750..0bf7a164826a 100644
--- a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
+++ b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
@@ -50,7 +50,7 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
     source.asExpr().(ClassInstanceExpr).getConstructedType() instanceof TrustAllHostnameVerifier
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname-verifier") }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof HostnameVerifierSink }
 
   override predicate isBarrier(DataFlow::Node barrier) {
     // ignore nodes that are in functions that intentionally disable hostname verification
@@ -78,6 +78,13 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
   }
 }
 
+/**
+ * A sink that sets the `HostnameVerifier` on `HttpsURLConnection`.
+ */
+private class HostnameVerifierSink extends DataFlow::Node {
+  HostnameVerifierSink() { sinkNode(this, "set-hostname-verifier") }
+}
+
 bindingset[result]
 private string getAFlagName() {
   result
diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll
index 9791eed203b8..486e8053953c 100644
--- a/java/ql/src/semmle/code/java/security/XSS.qll
+++ b/java/ql/src/semmle/code/java/security/XSS.qll
@@ -29,6 +29,7 @@ class XssAdditionalTaintStep extends Unit {
   abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
 }
 
+/** CSV sink models representing methods susceptible to XSS attacks. */
 private class DefaultXssSinkModel extends SinkModelCsv {
   override predicate row(string row) {
     row =

From b36d35bf1ef38194d20acd74aa6c4854d497844a Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 14:16:10 +0200
Subject: [PATCH 394/433] Revert "C#: Adjust 'fromSource' to hold only on files
 passed to the compiler as a source file"

This reverts commit 1dab1590ea268cb6370f022efa7d5e4c5277f7d0.
---
 .../extractor/Semmle.Extraction.CSharp/Entities/File.cs  | 9 ++++-----
 .../Semmle.Extraction/Entities/GeneratedFile.cs          | 2 +-
 csharp/extractor/Semmle.Extraction/FileSourceKind.cs     | 9 ---------
 csharp/extractor/Semmle.Extraction/Tuples.cs             | 4 ++--
 csharp/ql/src/semmle/code/csharp/File.qll                | 2 +-
 5 files changed, 8 insertions(+), 18 deletions(-)
 delete mode 100644 csharp/extractor/Semmle.Extraction/FileSourceKind.cs

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
index a853065ad04f..f22edb158aab 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/File.cs
@@ -17,15 +17,14 @@ protected File(Context cx, string path)
 
         public override void Populate(TextWriter trapFile)
         {
-            var trees = Context.Compilation.SyntaxTrees.Where(t => t.FilePath == originalPath);
-            var isSource = trees.Any();
-
-            trapFile.files(this, TransformedPath.Value, TransformedPath.NameWithoutExtension, TransformedPath.Extension, isSource ? FileSourceKind.FromSource : FileSourceKind.Unknown);
+            trapFile.files(this, TransformedPath.Value, TransformedPath.NameWithoutExtension, TransformedPath.Extension);
 
             if (TransformedPath.ParentDirectory is PathTransformer.ITransformedPath dir)
                 trapFile.containerparent(Extraction.Entities.Folder.Create(Context, dir), this);
 
-            if (isSource)
+            var trees = Context.Compilation.SyntaxTrees.Where(t => t.FilePath == originalPath);
+
+            if (trees.Any())
             {
                 foreach (var text in trees.Select(tree => tree.GetText()))
                 {
diff --git a/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs b/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
index d6fc07c4fa3d..db458e574a57 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/GeneratedFile.cs
@@ -10,7 +10,7 @@ private GeneratedFile(Context cx) : base(cx, "") { }
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.files(this, "", "", "", FileSourceKind.Unknown);
+            trapFile.files(this, "", "", "");
         }
 
         public override void WriteId(TextWriter trapFile)
diff --git a/csharp/extractor/Semmle.Extraction/FileSourceKind.cs b/csharp/extractor/Semmle.Extraction/FileSourceKind.cs
deleted file mode 100644
index 1edce1943b38..000000000000
--- a/csharp/extractor/Semmle.Extraction/FileSourceKind.cs
+++ /dev/null
@@ -1,9 +0,0 @@
-namespace Semmle.Extraction
-{
-    public enum FileSourceKind
-    {
-        Unknown = 0,
-        FromSource = 1,
-        FromLibrary = 2
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction/Tuples.cs b/csharp/extractor/Semmle.Extraction/Tuples.cs
index 6d40a2049477..49c14df76434 100644
--- a/csharp/extractor/Semmle.Extraction/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction/Tuples.cs
@@ -18,9 +18,9 @@ internal static void extractor_messages(this System.IO.TextWriter trapFile, Extr
             trapFile.WriteTuple("extractor_messages", error, (int)severity, origin, errorMessage, entityText, location, stackTrace);
         }
 
-        public static void files(this System.IO.TextWriter trapFile, File file, string fullName, string name, string extension, FileSourceKind kind)
+        public static void files(this System.IO.TextWriter trapFile, File file, string fullName, string name, string extension)
         {
-            trapFile.WriteTuple("files", file, fullName, name, extension, (int)kind);
+            trapFile.WriteTuple("files", file, fullName, name, extension, 0);
         }
 
         internal static void folders(this System.IO.TextWriter trapFile, Folder folder, string path, string name)
diff --git a/csharp/ql/src/semmle/code/csharp/File.qll b/csharp/ql/src/semmle/code/csharp/File.qll
index 8ebc4aebe2b2..86656af41243 100644
--- a/csharp/ql/src/semmle/code/csharp/File.qll
+++ b/csharp/ql/src/semmle/code/csharp/File.qll
@@ -192,7 +192,7 @@ class File extends Container, @file {
   override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
 
   /** Holds if this file contains source code. */
-  predicate fromSource() { files(this, _, _, _, 1) }
+  predicate fromSource() { this.getNumberOfLinesOfCode() > 0 }
 
   /** Holds if this file is a library. */
   predicate fromLibrary() {

From ed42c878b057d4f9cfc44b43d56b2ba64cd90068 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 22 Apr 2021 14:17:16 +0200
Subject: [PATCH 395/433] Adjust 'fromSource' to hold only on '.cs' files

---
 csharp/ql/src/semmle/code/csharp/File.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/File.qll b/csharp/ql/src/semmle/code/csharp/File.qll
index 86656af41243..d8b23bb61f44 100644
--- a/csharp/ql/src/semmle/code/csharp/File.qll
+++ b/csharp/ql/src/semmle/code/csharp/File.qll
@@ -192,7 +192,7 @@ class File extends Container, @file {
   override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
 
   /** Holds if this file contains source code. */
-  predicate fromSource() { this.getNumberOfLinesOfCode() > 0 }
+  predicate fromSource() { files(this, _, _, "cs", _) }
 
   /** Holds if this file is a library. */
   predicate fromLibrary() {

From 5d0a4cae90e03e2098f2cd1e2a3febd8e1148f7a Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Thu, 22 Apr 2021 16:51:36 -0400
Subject: [PATCH 396/433] C++: Add `{AllAliased}` side effects for smart
 pointers

Smart pointer constructors, assignments, and `reset()` can actually have fairly large side effects, especially with custom deleters, destructors for objects being destroyed, and so on. I've re-introduced `{AllAliased}` side effects for these functions. There was no immediate effect on analysis results.
---
 .../semmle/code/cpp/models/implementations/SmartPointer.qll   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index ebe0de3fd6e4..7f9639f63732 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -106,9 +106,9 @@ private class SmartPtrSetterFunction extends MemberFunction, AliasFunction, Side
     )
   }
 
-  override predicate hasOnlySpecificReadSideEffects() { this instanceof Constructor }
+  override predicate hasOnlySpecificReadSideEffects() { none() }
 
-  override predicate hasOnlySpecificWriteSideEffects() { this instanceof ConstMemberFunction }
+  override predicate hasOnlySpecificWriteSideEffects() { none() }
 
   override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
     // Always write to the destination smart pointer itself.

From 3b04bedee0c951b318bab322a4df7261ab888efa Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Thu, 22 Apr 2021 17:19:00 -0400
Subject: [PATCH 397/433] Stub out additional bits of Alias model for C#

---
 .../internal/AliasAnalysisImports.qll         | 275 ++++++++++++++++++
 1 file changed, 275 insertions(+)

diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll
index 7992aa9ed146..e0bf271dcc72 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll
@@ -3,6 +3,276 @@ import experimental.ir.implementation.IRConfiguration
 import experimental.ir.internal.IntegerConstant as Ints
 
 module AliasModels {
+  class ParameterIndex = int;
+
+  /**
+   * An input to a function. This can be:
+   * - The value of one of the function's parameters
+   * - The value pointed to by one of function's pointer or reference parameters
+   * - The value of the function's `this` pointer
+   * - The value pointed to by the function's `this` pointer
+   */
+  abstract class FunctionInput extends string {
+    FunctionInput() { none() }
+
+    /**
+     * Holds if this is the input value of the parameter with index `index`.
+     *
+     * Example:
+     * ```
+     * void func(int n, char* p, float& r);
+     * ```
+     * - `isParameter(0)` holds for the `FunctionInput` that represents the value of `n` (with type
+     *   `int`) on entry to the function.
+     * - `isParameter(1)` holds for the `FunctionInput` that represents the value of `p` (with type
+     *   `char*`) on entry to the function.
+     * - `isParameter(2)` holds for the `FunctionInput` that represents the "value" of the reference
+     *   `r` (with type `float&`) on entry to the function, _not_ the value of the referred-to
+     *   `float`.
+     */
+    predicate isParameter(ParameterIndex index) { none() }
+
+    /**
+     * Holds if this is the input value of the parameter with index `index`.
+     * DEPRECATED: Use `isParameter(index)` instead.
+     */
+    deprecated final predicate isInParameter(ParameterIndex index) { isParameter(index) }
+
+    /**
+     * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
+     * value referred to by a reference parameter to a function, where the parameter has index
+     * `index`.
+     *
+     * Example:
+     * ```
+     * void func(int n, char* p, float& r);
+     * ```
+     * - `isParameterDeref(1)` holds for the `FunctionInput` that represents the value of `*p` (with
+     *   type `char`) on entry to the function.
+     * - `isParameterDeref(2)` holds for the `FunctionInput` that represents the value of `r` (with type
+     *   `float`) on entry to the function.
+     * - There is no `FunctionInput` for which `isParameterDeref(0)` holds, because `n` is neither a
+     *   pointer nor a reference.
+     */
+    predicate isParameterDeref(ParameterIndex index) { none() }
+
+    /**
+     * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
+     * value referred to by a reference parameter to a function, where the parameter has index
+     * `index`.
+     * DEPRECATED: Use `isParameterDeref(index)` instead.
+     */
+    deprecated final predicate isInParameterPointer(ParameterIndex index) {
+      isParameterDeref(index)
+    }
+
+    /**
+     * Holds if this is the input value pointed to by the `this` pointer of an instance member
+     * function.
+     *
+     * Example:
+     * ```
+     * struct C {
+     *   void mfunc(int n, char* p, float& r) const;
+     * };
+     * ```
+     * - `isQualifierObject()` holds for the `FunctionInput` that represents the value of `*this`
+     *   (with type `C const`) on entry to the function.
+     */
+    predicate isQualifierObject() { none() }
+
+    /**
+     * Holds if this is the input value pointed to by the `this` pointer of an instance member
+     * function.
+     * DEPRECATED: Use `isQualifierObject()` instead.
+     */
+    deprecated final predicate isInQualifier() { isQualifierObject() }
+
+    /**
+     * Holds if this is the input value of the `this` pointer of an instance member function.
+     *
+     * Example:
+     * ```
+     * struct C {
+     *   void mfunc(int n, char* p, float& r) const;
+     * };
+     * ```
+     * - `isQualifierAddress()` holds for the `FunctionInput` that represents the value of `this`
+     *   (with type `C const *`) on entry to the function.
+     */
+    predicate isQualifierAddress() { none() }
+
+    /**
+     * Holds if `i >= 0` and `isParameter(i)` holds for this value, or
+     * if `i = -1` and `isQualifierAddress()` holds for this value.
+     */
+    final predicate isParameterOrQualifierAddress(ParameterIndex i) {
+      i >= 0 and this.isParameter(i)
+      or
+      i = -1 and this.isQualifierAddress()
+    }
+
+    /**
+     * Holds if this is the input value pointed to by the return value of a
+     * function, if the function returns a pointer, or the input value referred
+     * to by the return value of a function, if the function returns a reference.
+     *
+     * Example:
+     * ```
+     * char* getPointer();
+     * float& getReference();
+     * int getInt();
+     * ```
+     * - `isReturnValueDeref()` holds for the `FunctionInput` that represents the
+     *   value of `*getPointer()` (with type `char`).
+     * - `isReturnValueDeref()` holds for the `FunctionInput` that represents the
+     *   value of `getReference()` (with type `float`).
+     * - There is no `FunctionInput` of `getInt()` for which
+     *   `isReturnValueDeref()` holds because the return type of `getInt()` is
+     *   neither a pointer nor a reference.
+     *
+     * Note that data flows in through function return values are relatively
+     * rare, but they do occur when a function returns a reference to itself,
+     * part of itself, or one of its other inputs.
+     */
+    predicate isReturnValueDeref() { none() }
+
+    /**
+     * Holds if `i >= 0` and `isParameterDeref(i)` holds for this value, or
+     * if `i = -1` and `isQualifierObject()` holds for this value.
+     */
+    final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
+      i >= 0 and this.isParameterDeref(i)
+      or
+      i = -1 and this.isQualifierObject()
+    }
+  }
+
+  /**
+   * An output from a function. This can be:
+   * - The value pointed to by one of function's pointer or reference parameters
+   * - The value pointed to by the function's `this` pointer
+   * - The function's return value
+   * - The value pointed to by the function's return value, if the return value is a pointer or
+   *   reference
+   */
+  abstract class FunctionOutput extends string {
+    FunctionOutput() { none() }
+
+    /**
+     * Holds if this is the output value pointed to by a pointer parameter to a function, or the
+     * output value referred to by a reference parameter to a function, where the parameter has
+     * index `index`.
+     *
+     * Example:
+     * ```
+     * void func(int n, char* p, float& r);
+     * ```
+     * - `isParameterDeref(1)` holds for the `FunctionOutput` that represents the value of `*p` (with
+     *   type `char`) on return from the function.
+     * - `isParameterDeref(2)` holds for the `FunctionOutput` that represents the value of `r` (with
+     *   type `float`) on return from the function.
+     * - There is no `FunctionOutput` for which `isParameterDeref(0)` holds, because `n` is neither a
+     *   pointer nor a reference.
+     */
+    predicate isParameterDeref(ParameterIndex i) { none() }
+
+    /**
+     * Holds if this is the output value pointed to by a pointer parameter to a function, or the
+     * output value referred to by a reference parameter to a function, where the parameter has
+     * index `index`.
+     * DEPRECATED: Use `isParameterDeref(index)` instead.
+     */
+    deprecated final predicate isOutParameterPointer(ParameterIndex index) {
+      isParameterDeref(index)
+    }
+
+    /**
+     * Holds if this is the output value pointed to by the `this` pointer of an instance member
+     *   function.
+     *
+     * Example:
+     * ```
+     * struct C {
+     *   void mfunc(int n, char* p, float& r);
+     * };
+     * ```
+     * - `isQualifierObject()` holds for the `FunctionOutput` that represents the value of `*this`
+     *   (with type `C`) on return from the function.
+     */
+    predicate isQualifierObject() { none() }
+
+    /**
+     * Holds if this is the output value pointed to by the `this` pointer of an instance member
+     * function.
+     * DEPRECATED: Use `isQualifierObject()` instead.
+     */
+    deprecated final predicate isOutQualifier() { isQualifierObject() }
+
+    /**
+     * Holds if this is the value returned by a function.
+     *
+     * Example:
+     * ```
+     * int getInt();
+     * char* getPointer();
+     * float& getReference();
+     * ```
+     * - `isReturnValue()` holds for the `FunctionOutput` that represents the value returned by
+     *   `getInt()` (with type `int`).
+     * - `isReturnValue()` holds for the `FunctionOutput` that represents the value returned by
+     *   `getPointer()` (with type `char*`).
+     * - `isReturnValue()` holds for the `FunctionOutput` that represents the "value" of the reference
+     *   returned by `getReference()` (with type `float&`), _not_ the value of the referred-to
+     *   `float`.
+     */
+    predicate isReturnValue() { none() }
+
+    /**
+     * Holds if this is the value returned by a function.
+     * DEPRECATED: Use `isReturnValue()` instead.
+     */
+    deprecated final predicate isOutReturnValue() { isReturnValue() }
+
+    /**
+     * Holds if this is the output value pointed to by the return value of a function, if the function
+     * returns a pointer, or the output value referred to by the return value of a function, if the
+     * function returns a reference.
+     *
+     * Example:
+     * ```
+     * char* getPointer();
+     * float& getReference();
+     * int getInt();
+     * ```
+     * - `isReturnValueDeref()` holds for the `FunctionOutput` that represents the value of
+     *   `*getPointer()` (with type `char`).
+     * - `isReturnValueDeref()` holds for the `FunctionOutput` that represents the value of
+     *   `getReference()` (with type `float`).
+     * - There is no `FunctionOutput` of `getInt()` for which `isReturnValueDeref()` holds because the
+     *   return type of `getInt()` is neither a pointer nor a reference.
+     */
+    predicate isReturnValueDeref() { none() }
+
+    /**
+     * Holds if this is the output value pointed to by the return value of a function, if the function
+     * returns a pointer, or the output value referred to by the return value of a function, if the
+     * function returns a reference.
+     * DEPRECATED: Use `isReturnValueDeref()` instead.
+     */
+    deprecated final predicate isOutReturnPointer() { isReturnValueDeref() }
+
+    /**
+     * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is the value, or
+     * if `i = -1` and `isQualifierObject()` holds for this value.
+     */
+    final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
+      i >= 0 and this.isParameterDeref(i)
+      or
+      i = -1 and this.isQualifierObject()
+    }
+  }
+
   /**
    * Models the aliasing behavior of a library function.
    */
@@ -44,5 +314,10 @@ module AliasModels {
      * Holds if the function always returns the value of the parameter at the specified index.
      */
     abstract predicate parameterIsAlwaysReturned(int index);
+
+    /**
+     * Holds if the address passed in via `input` is always propagated to `output`.
+     */
+    abstract predicate hasAddressFlow(FunctionInput input, FunctionOutput output);
   }
 }

From 6e059ea002441b63da26006b4f5fdc2b8ae1df30 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Fri, 23 Apr 2021 09:58:15 +0200
Subject: [PATCH 398/433] C++: Remove reference to obsolete issue CPP-383

---
 .../src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
index dc08f588e43d..94417a0e6403 100644
--- a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
@@ -118,7 +118,7 @@ private predicate isFunction(Element el) {
 
 /**
  * Holds if `fc` is a `FunctionCall` with no return value for `getTarget`. This
- * can happen due to extractor issue CPP-383.
+ * can happen in case of rare database inconsistencies.
  */
 pragma[noopt]
 private predicate callHasNoTarget(@funbindexpr fc) {

From 6de5b3021e54f2d7777396334d97a1081e4cf006 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Fri, 23 Apr 2021 09:58:39 +0200
Subject: [PATCH 399/433] C++: Replace Jira ticket reference with GH issue

---
 cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll        | 3 ++-
 .../src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll | 3 ++-
 cpp/ql/src/semmle/code/cpp/exprs/Expr.qll                      | 3 ++-
 .../cpp/ir/implementation/raw/internal/TranslatedElement.qll   | 3 ++-
 .../ir/implementation/raw/internal/TranslatedElement.qll       | 3 ++-
 5 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll
index b47618de2e92..31ef5570451b 100644
--- a/cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll
@@ -1307,7 +1307,8 @@ private predicate conditionJumps(Expr test, boolean truth, Node n2, Pos p2) {
   )
 }
 
-// Factored out for performance. See QL-796.
+// Pulled out for performance. See
+// https://github.com/github/codeql-coreql-team/issues/1044.
 private predicate normalGroupMemberBaseCase(Node memberNode, Pos memberPos, Node atNode) {
   memberNode = atNode and
   memberPos.isAt() and
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
index 94417a0e6403..476f626e8749 100644
--- a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
@@ -128,7 +128,8 @@ private predicate callHasNoTarget(@funbindexpr fc) {
   )
 }
 
-// This base case is pulled out to work around QL-796
+// Pulled out for performance. See
+// https://github.com/github/codeql-coreql-team/issues/1044.
 private predicate potentiallyReturningFunctionCall_base(FunctionCall fc) {
   fc.isVirtual()
   or
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll b/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll
index e02a72fe680a..86f538e5d4e5 100644
--- a/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll
@@ -1271,7 +1271,8 @@ private predicate convparents(Expr child, int idx, Element parent) {
   )
 }
 
-// Pulled out for performance. See QL-796.
+// Pulled out for performance. See
+// https://github.com/github/codeql-coreql-team/issues/1044.
 private predicate hasNoConversions(Expr e) { not e.hasConversion() }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
index eca659914b02..81c69cf0ea22 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -42,7 +42,8 @@ IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
  */
 predicate isIRConstant(Expr expr) { exists(expr.getValue()) }
 
-// Pulled out to work around QL-796
+// Pulled out for performance. See
+// https://github.com/github/codeql-coreql-team/issues/1044.
 private predicate isOrphan(Expr expr) { not exists(getRealParent(expr)) }
 
 /**
diff --git a/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedElement.qll b/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedElement.qll
index 81d7b71b9524..04e05dc98140 100644
--- a/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedElement.qll
@@ -57,7 +57,8 @@ private Element getRealParent(Expr expr) { result = expr.getParent() }
  */
 predicate isIRConstant(Expr expr) { exists(expr.getValue()) }
 
-// Pulled out to work around QL-796
+// Pulled out for performance. See
+// https://github.com/github/codeql-coreql-team/issues/1044.
 private predicate isOrphan(Expr expr) { not exists(getRealParent(expr)) }
 
 /**

From 4c597dd467bc515542afb12fc69675440aeaa5a7 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 22 Apr 2021 15:02:31 +0200
Subject: [PATCH 400/433] C#: Improve performance of guards library

---
 .../semmle/code/csharp/controlflow/Guards.qll | 224 ++++++++++++------
 .../semmle/code/csharp/dataflow/Nullness.qll  |  15 +-
 .../internal/rangeanalysis/RangeUtils.qll     |   2 +-
 .../guards/BooleanGuardedExpr.expected        |  32 ---
 .../guards/GuardedControlFlowNode.expected    |  32 ---
 .../controlflow/guards/GuardedExpr.expected   |  32 ---
 6 files changed, 162 insertions(+), 175 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index bdcfa6ac4b75..8a721da5293d 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -36,7 +36,7 @@ class Guard extends Expr {
    * Holds if basic block `bb` is guarded by this expression having value `v`.
    */
   predicate controlsBasicBlock(BasicBlock bb, AbstractValue v) {
-    Internal::guardControls(this, _, bb, v)
+    Internal::guardControls(this, bb, v)
   }
 
   /**
@@ -50,6 +50,12 @@ class Guard extends Expr {
       polarity = v.getValue()
     )
   }
+
+  /**
+   * Gets a valid value for this guard. For example, if this guard is a test, then
+   * it can have Boolean values `true` and `false`.
+   */
+  AbstractValue getAValue() { isGuard(this, result) }
 }
 
 /** An abstract value. */
@@ -967,13 +973,6 @@ module Internal {
     e = any(BinaryArithmeticOperation bao | result = bao.getAnOperand())
   }
 
-  /** Same as `this.getAChildExpr*()`, but avoids `fastTC`. */
-  private Expr getAChildExprStar(Guard g) {
-    result = g
-    or
-    result = getAChildExprStar(g).getAChildExpr()
-  }
-
   private Expr stripConditionalExpr(Expr e) {
     e =
       any(ConditionalExpr ce |
@@ -1009,8 +1008,11 @@ module Internal {
 
     /** Holds if pre-basic-block `bb` only is reached when guard `g` has abstract value `v`. */
     predicate preControls(Guard g, PreBasicBlocks::PreBasicBlock bb, AbstractValue v) {
-      exists(AbstractValue v0, Guard g0 | preControlsDirect(g0, bb, v0) |
-        preImpliesSteps(g0, v0, g, v)
+      preControlsDirect(g, bb, v)
+      or
+      exists(AbstractValue v0, Guard g0 |
+        preControls(g0, bb, v0) and
+        preImpliesStep(g0, v0, g, v)
       )
     }
 
@@ -1038,6 +1040,23 @@ module Internal {
       }
     }
 
+    private predicate canReturnBool(Callable c, Expr ret) {
+      canReturn(c, ret) and
+      c.getReturnType() instanceof BoolType
+    }
+
+    private predicate boolReturnImplies(Expr ret, BooleanValue retVal, Guard g, AbstractValue v) {
+      canReturnBool(_, ret) and
+      isGuard(ret, retVal) and
+      g = ret and
+      v = retVal
+      or
+      exists(Guard g0, AbstractValue v0 |
+        boolReturnImplies(ret, retVal, g0, v0) and
+        preImpliesStep(g0, v0, g, v)
+      )
+    }
+
     /**
      * Holds if `ret` is an expression returned by the callable to which parameter
      * `p` belongs, and `ret` having Boolean value `retVal` allows the conclusion
@@ -1046,14 +1065,14 @@ module Internal {
     private predicate validReturnInCustomNullCheck(
       Expr ret, Parameter p, BooleanValue retVal, boolean isNull
     ) {
-      exists(Callable c | canReturn(c, ret) |
-        p.getCallable() = c and
-        c.getReturnType() instanceof BoolType
+      exists(Callable c |
+        canReturnBool(c, ret) and
+        p.getCallable() = c
       ) and
       exists(PreSsaImplicitParameterDefinition def | p = def.getParameter() |
         def.nullGuardedReturn(ret, isNull)
         or
-        exists(NullValue nv | preImpliesSteps(ret, retVal, def.getARead(), nv) |
+        exists(NullValue nv | boolReturnImplies(ret, retVal, def.getARead(), nv) |
           if nv.isNull() then isNull = true else isNull = false
         )
       )
@@ -1691,6 +1710,79 @@ module Internal {
 
   import PreCFG
 
+  private predicate interestingDescendantCandidate(Expr e) {
+    guardControls(e, _, _)
+    or
+    e instanceof AccessOrCallExpr
+  }
+
+  /**
+   * An (interesting) descendant of a guard that controls some basic block.
+   *
+   * This class exists purely for performance reasons: It allows us to big-step
+   * through the child hierarchy in `guardControlsSub()` instead of using
+   * `getAChildExpr()`.
+   */
+  private class ControlGuardDescendant extends Expr {
+    ControlGuardDescendant() {
+      guardControls(this, _, _)
+      or
+      any(ControlGuardDescendant other).interestingDescendant(this)
+    }
+
+    private predicate descendant(Expr e) {
+      e = this.getAChildExpr()
+      or
+      exists(Expr mid |
+        descendant(mid) and
+        not interestingDescendantCandidate(mid) and
+        e = mid.getAChildExpr()
+      )
+    }
+
+    /** Holds if `e` is an interesting descendant of this descendant. */
+    predicate interestingDescendant(Expr e) {
+      descendant(e) and
+      interestingDescendantCandidate(e)
+    }
+  }
+
+  /**
+   * Holds if `g` controls basic block `bb`, and `sub` is some (interesting)
+   * sub expression of `g`.
+   *
+   * Sub expressions inside nested logical operations that themselve control `bb`
+   * are not included, since these will be sub expressions of their immediately
+   * enclosing logical operation. (This restriction avoids a quadratic blow-up.)
+   *
+   * For example, in
+   *
+   * ```csharp
+   * if (a && (b && c))
+   *     BLOCK
+   * ```
+   *
+   * `a` is included as a sub expression of `a && (b && c)` (which controls `BLOCK`),
+   * while `b` and `c` are only included as sub expressions of `b && c` (which also
+   * controls `BLOCK`).
+   */
+  pragma[nomagic]
+  private predicate guardControlsSub(Guard g, BasicBlock bb, ControlGuardDescendant sub) {
+    guardControls(g, bb, _) and
+    sub = g
+    or
+    exists(ControlGuardDescendant mid |
+      guardControlsSub(g, bb, mid) and
+      mid.interestingDescendant(sub)
+    |
+      not guardControls(sub, bb, _)
+      or
+      not mid instanceof UnaryLogicalOperation and
+      not mid instanceof BinaryLogicalOperation and
+      not mid instanceof BitwiseOperation
+    )
+  }
+
   /**
    * A helper class for calculating structurally equal access/call expressions.
    */
@@ -1710,13 +1802,13 @@ module Internal {
 
     /**
      * Holds if access/call expression `e` (targeting declaration `target`)
-     * is a sub expression of a condition that controls whether basic block
+     * is a sub expression of a guard that controls whether basic block
      * `bb` is reached.
      */
     pragma[noinline]
     private predicate candidateAux(AccessOrCallExpr e, Declaration target, BasicBlock bb) {
       target = e.getTarget() and
-      exists(Guard g | e = getAChildExprStar(g) | guardControls(g, _, bb, _))
+      guardControlsSub(_, bb, e)
     }
   }
 
@@ -1727,49 +1819,67 @@ module Internal {
 
     /**
      * Holds if basic block `bb` only is reached when guard `g` has abstract value `v`.
-     *
-     * `cb` records all of the possible condition blocks for `g` that a path from the
-     * callable entry point to `bb` may go through.
      */
     cached
-    predicate guardControls(Guard g, ConditionBlock cb, BasicBlock bb, AbstractValue v) {
+    predicate guardControls(Guard g, BasicBlock bb, AbstractValue v) {
+      exists(ControlFlowElement cfe, ConditionalSuccessor cs |
+        v.branch(cfe, cs, g) and cfe.controlsBlock(bb, cs, _)
+      )
+      or
       exists(AbstractValue v0, Guard g0 |
-        impliesSteps(g0, v0, g, v) and
-        exists(ControlFlowElement cfe, ConditionalSuccessor cs |
-          v0.branch(cfe, cs, g0) and cfe.controlsBlock(bb, cs, cb)
-        )
+        guardControls(g0, bb, v0) and
+        impliesStep(g0, v0, g, v)
       )
     }
 
-    pragma[noinline]
+    pragma[nomagic]
+    private predicate guardControlsSubSame(Guard g, BasicBlock bb, ControlGuardDescendant sub) {
+      guardControlsSub(g, bb, sub) and
+      any(ConditionOnExprComparisonConfig c).same(sub, _)
+    }
+
+    pragma[nomagic]
     private predicate nodeIsGuardedBySameSubExpr0(
-      ControlFlow::Node guardedCfn, AccessOrCallExpr guarded, Guard g, ConditionBlock cb,
+      ControlFlow::Node guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
       AccessOrCallExpr sub, AbstractValue v
     ) {
       Stages::GuardsStage::forceCachingInSameStage() and
       guardedCfn = guarded.getAControlFlowNode() and
-      guardControls(g, cb, guardedCfn.getBasicBlock(), v) and
-      exists(ConditionOnExprComparisonConfig c | c.same(sub, guarded))
+      guardedBB = guardedCfn.getBasicBlock() and
+      guardControls(g, guardedBB, v) and
+      guardControlsSubSame(g, guardedBB, sub) and
+      any(ConditionOnExprComparisonConfig c).same(sub, guarded)
     }
 
-    pragma[noinline]
+    pragma[nomagic]
     private predicate nodeIsGuardedBySameSubExpr(
-      ControlFlow::Node guardedCfn, AccessOrCallExpr guarded, Guard g, ConditionBlock cb,
+      ControlFlow::Node guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
       AccessOrCallExpr sub, AbstractValue v
     ) {
-      nodeIsGuardedBySameSubExpr0(guardedCfn, guarded, g, cb, sub, v) and
-      sub = getAChildExprStar(g)
+      nodeIsGuardedBySameSubExpr0(guardedCfn, guardedBB, guarded, g, sub, v) and
+      guardControlsSub(g, guardedBB, sub)
     }
 
-    pragma[noinline]
+    pragma[nomagic]
+    private predicate nodeIsGuardedBySameSubExprSsaDef0(
+      ControlFlow::Node cfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
+      ControlFlow::Node subCfn, BasicBlock subCfnBB, AccessOrCallExpr sub, AbstractValue v,
+      Ssa::Definition def
+    ) {
+      nodeIsGuardedBySameSubExpr(cfn, guardedBB, guarded, g, sub, v) and
+      def = sub.getAnSsaQualifier(subCfn) and
+      subCfnBB = subCfn.getBasicBlock()
+    }
+
+    pragma[nomagic]
     private predicate nodeIsGuardedBySameSubExprSsaDef(
-      ControlFlow::Node cfn, AccessOrCallExpr guarded, Guard g, ControlFlow::Node subCfn,
+      ControlFlow::Node guardedCfn, AccessOrCallExpr guarded, Guard g, ControlFlow::Node subCfn,
       AccessOrCallExpr sub, AbstractValue v, Ssa::Definition def
     ) {
-      exists(ConditionBlock cb |
-        nodeIsGuardedBySameSubExpr(cfn, guarded, g, cb, sub, v) and
-        subCfn.getBasicBlock().dominates(cb) and
-        def = sub.getAnSsaQualifier(subCfn)
+      exists(BasicBlock guardedBB, BasicBlock subCfnBB |
+        nodeIsGuardedBySameSubExprSsaDef0(guardedCfn, guardedBB, guarded, g, subCfn, subCfnBB, sub,
+          v, def) and
+        subCfnBB.getASuccessor*() = guardedBB
       )
     }
 
@@ -1789,7 +1899,7 @@ module Internal {
       AccessOrCallExpr guarded, Guard g, AccessOrCallExpr sub, AbstractValue v
     ) {
       forex(ControlFlow::Node cfn | cfn = guarded.getAControlFlowNode() |
-        nodeIsGuardedBySameSubExpr(cfn, guarded, g, _, sub, v)
+        nodeIsGuardedBySameSubExpr(cfn, _, guarded, g, sub, v)
       )
     }
 
@@ -1814,7 +1924,7 @@ module Internal {
     predicate isGuardedByNode(
       ControlFlow::Nodes::ElementNode guarded, Guard g, AccessOrCallExpr sub, AbstractValue v
     ) {
-      nodeIsGuardedBySameSubExpr(guarded, _, g, _, sub, v) and
+      nodeIsGuardedBySameSubExpr(guarded, _, _, g, sub, v) and
       forall(ControlFlow::Node subCfn, Ssa::Definition def |
         nodeIsGuardedBySameSubExprSsaDef(guarded, _, g, subCfn, sub, v, def)
       |
@@ -1860,40 +1970,6 @@ module Internal {
   }
 
   import Cached
-
-  /**
-   * Holds if the assumption that `g1` has abstract value `v1` implies that
-   * `g2` has abstract value `v2`, using zero or more steps of reasoning. That is,
-   * the evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
-   *
-   * This predicate does not rely on the control flow graph.
-   */
-  predicate preImpliesSteps(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
-    g1 = g2 and
-    v1 = v2 and
-    isGuard(g1, v1)
-    or
-    exists(Expr mid, AbstractValue vMid | preImpliesSteps(g1, v1, mid, vMid) |
-      preImpliesStep(mid, vMid, g2, v2)
-    )
-  }
-
-  /**
-   * Holds if the assumption that `g1` has abstract value `v1` implies that
-   * `g2` has abstract value `v2`, using zero or more steps of reasoning. That is,
-   * the evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
-   *
-   * This predicate relies on the control flow graph.
-   */
-  predicate impliesSteps(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
-    g1 = g2 and
-    v1 = v2 and
-    isGuard(g1, v1)
-    or
-    exists(Expr mid, AbstractValue vMid | impliesSteps(g1, v1, mid, vMid) |
-      impliesStep(mid, vMid, g2, v2)
-    )
-  }
 }
 
 private import Internal
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index 15133668d00a..131480a8b592 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -128,12 +128,19 @@ private predicate dereferenceAt(BasicBlock bb, int i, Ssa::Definition def, Deref
  * has abstract value `vDef`.
  */
 private predicate exprImpliesSsaDef(
-  Expr e, G::AbstractValue vExpr, Ssa::Definition def, G::AbstractValue vDef
+  G::Guard e, G::AbstractValue vExpr, Ssa::Definition def, G::AbstractValue vDef
 ) {
-  exists(G::Guard g | G::Internal::impliesSteps(e, vExpr, g, vDef) |
-    g = def.getARead()
+  vExpr = e.getAValue() and
+  vExpr = vDef and
+  (
+    e = def.getARead()
     or
-    g = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess()
+    e = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess()
+  )
+  or
+  exists(Expr e0, G::AbstractValue vExpr0 |
+    exprImpliesSsaDef(e0, vExpr0, def, vDef) and
+    G::Internal::impliesStep(e, vExpr, e0, vExpr0)
   )
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
index 70ff26c1c586..2f8e93a4b750 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
@@ -122,7 +122,7 @@ private module Impl {
     )
     or
     exists(G::AbstractValue v0 |
-      G::Internal::impliesSteps(result, v, eqFlowCondAbs(def, e, delta, isEq, v0), v0)
+      G::Internal::impliesStep(result, v, eqFlowCondAbs(def, e, delta, isEq, v0), v0)
     )
   }
 
diff --git a/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
index 120e3e2c5ced..40d144f37194 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
@@ -5,16 +5,12 @@
 | Assert.cs:53:27:53:27 | access to local variable s | Assert.cs:52:24:52:32 | ... == ... | Assert.cs:52:24:52:24 | access to local variable s | false |
 | Assert.cs:59:36:59:36 | access to parameter b | Assert.cs:58:20:58:20 | access to parameter b | Assert.cs:58:20:58:20 | access to parameter b | false |
 | Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:31 | ... != ... | Assert.cs:59:23:59:23 | access to local variable s | true |
-| Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:36 | ... && ... | Assert.cs:59:23:59:23 | access to local variable s | true |
 | Assert.cs:66:37:66:37 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | false |
 | Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:32 | ... == ... | Assert.cs:66:24:66:24 | access to local variable s | false |
-| Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:37 | ... \|\| ... | Assert.cs:66:24:66:24 | access to local variable s | false |
 | Assert.cs:73:36:73:36 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | true |
 | Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:31 | ... == ... | Assert.cs:73:23:73:23 | access to local variable s | true |
-| Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:36 | ... && ... | Assert.cs:73:23:73:23 | access to local variable s | true |
 | Assert.cs:80:37:80:37 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | true |
 | Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:32 | ... != ... | Assert.cs:80:24:80:24 | access to local variable s | false |
-| Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:37 | ... \|\| ... | Assert.cs:80:24:80:24 | access to local variable s | false |
 | Assert.cs:94:16:94:17 | access to parameter b1 | Assert.cs:93:25:93:26 | access to parameter b1 | Assert.cs:93:25:93:26 | access to parameter b1 | true |
 | Assert.cs:94:23:94:24 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | false |
 | Collections.cs:52:17:52:20 | access to parameter args | Collections.cs:50:13:50:27 | ... == ... | Collections.cs:50:13:50:16 | access to parameter args | false |
@@ -22,39 +18,17 @@
 | Collections.cs:54:13:54:16 | access to parameter args | Collections.cs:50:13:50:27 | ... == ... | Collections.cs:50:13:50:16 | access to parameter args | false |
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:68:13:68:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:12:13:12:24 | ... > ... | Guards.cs:12:13:12:13 | access to parameter s | true |
 | Guards.cs:26:31:26:31 | access to parameter s | Guards.cs:24:13:24:21 | ... != ... | Guards.cs:24:13:24:13 | access to parameter s | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:36 | !... | Guards.cs:32:35:32:35 | access to parameter x | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:35:32:35 | access to parameter x | true |
 | Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:14:32:36 | call to method IsNullOrEmpty | Guards.cs:32:35:32:35 | access to parameter x | false |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:42:32:42 | access to parameter y | true |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:40:32:51 | !... | Guards.cs:32:42:32:42 | access to parameter y | true |
 | Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:42:32:50 | ... == ... | Guards.cs:32:42:32:42 | access to parameter y | false |
 | Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:21 | ... == ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:26:35:26 | access to parameter y | false |
 | Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:26:35:34 | ... == ... | Guards.cs:35:26:35:26 | access to parameter y | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:13:38:37 | !... | Guards.cs:38:15:38:15 | access to parameter x | true |
 | Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:23 | ... == ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:13:38:37 | !... | Guards.cs:38:28:38:28 | access to parameter y | true |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:28:38:28 | access to parameter y | false |
 | Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:28:38:36 | ... == ... | Guards.cs:38:28:38:28 | access to parameter y | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:13:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:14:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:15:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
 | Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:25 | ... != ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:13:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:14:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:15:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:30:41:38 | ... != ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:48:31:48:40 | access to field Field | Guards.cs:47:13:47:25 | ... != ... | Guards.cs:47:13:47:17 | access to field Field | true |
 | Guards.cs:55:27:55:27 | access to parameter g | Guards.cs:53:13:53:27 | ... == ... | Guards.cs:53:13:53:13 | access to parameter g | false |
@@ -85,16 +59,11 @@
 | Guards.cs:138:20:138:20 | access to parameter s | Guards.cs:137:13:137:25 | ... is ... | Guards.cs:137:13:137:13 | access to parameter s | true |
 | Guards.cs:139:16:139:16 | access to parameter s | Guards.cs:137:13:137:25 | ... is ... | Guards.cs:137:13:137:13 | access to parameter s | false |
 | Guards.cs:146:16:146:16 | access to parameter o | Guards.cs:144:13:144:25 | ... is ... | Guards.cs:144:13:144:13 | access to parameter o | false |
-| Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:13:168:41 | !... | Guards.cs:168:40:168:40 | access to parameter x | true |
 | Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:14:168:41 | call to method IsNullOrWhiteSpace | Guards.cs:168:40:168:40 | access to parameter x | false |
-| Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:13:189:25 | !... | Guards.cs:189:24:189:24 | access to parameter s | true |
 | Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:14:189:25 | call to method NullTest1 | Guards.cs:189:24:189:24 | access to parameter s | false |
-| Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:13:191:25 | !... | Guards.cs:191:24:191:24 | access to parameter s | true |
 | Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:14:191:25 | call to method NullTest2 | Guards.cs:191:24:191:24 | access to parameter s | false |
-| Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:13:193:25 | !... | Guards.cs:193:24:193:24 | access to parameter s | true |
 | Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:14:193:25 | call to method NullTest3 | Guards.cs:193:24:193:24 | access to parameter s | false |
 | Guards.cs:196:31:196:31 | access to parameter s | Guards.cs:195:13:195:27 | call to method NotNullTest4 | Guards.cs:195:26:195:26 | access to parameter s | true |
-| Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:13:197:29 | !... | Guards.cs:197:28:197:28 | access to parameter s | true |
 | Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:14:197:29 | call to method NullTestWrong | Guards.cs:197:28:197:28 | access to parameter s | false |
 | Guards.cs:205:13:205:13 | access to parameter o | Guards.cs:203:13:203:21 | ... != ... | Guards.cs:203:13:203:13 | access to parameter o | true |
 | Guards.cs:208:17:208:17 | access to parameter o | Guards.cs:203:13:203:21 | ... != ... | Guards.cs:203:13:203:13 | access to parameter o | true |
@@ -102,7 +71,6 @@
 | Guards.cs:271:13:271:14 | access to parameter o1 | Guards.cs:270:13:270:42 | call to operator == | Guards.cs:270:13:270:14 | access to parameter o1 | true |
 | Guards.cs:342:27:342:27 | access to parameter b | Guards.cs:341:20:341:20 | access to parameter b | Guards.cs:341:20:341:20 | access to parameter b | false |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
-| Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | access to parameter o | Splitting.cs:12:17:12:25 | ... != ... | Splitting.cs:12:17:12:17 | access to parameter o | true |
 | Splitting.cs:23:24:23:24 | access to parameter o | Splitting.cs:22:17:22:25 | ... != ... | Splitting.cs:22:17:22:17 | access to parameter o | true |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected b/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
index 3db5997056c0..404c01975560 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
@@ -17,7 +17,6 @@
 | Assert.cs:59:36:59:36 | [b (line 56): true] access to parameter b | Assert.cs:58:20:58:32 | ... ? ... : ... | Assert.cs:58:20:58:20 | access to parameter b | non-null |
 | Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:23 | access to local variable s | Assert.cs:59:23:59:23 | access to local variable s | non-null |
 | Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:31 | ... != ... | Assert.cs:59:23:59:23 | access to local variable s | true |
-| Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:36 | ... && ... | Assert.cs:59:23:59:23 | access to local variable s | true |
 | Assert.cs:66:37:66:37 | [b (line 63): false] access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | false |
 | Assert.cs:66:37:66:37 | [b (line 63): false] access to parameter b | Assert.cs:65:20:65:32 | ... ? ... : ... | Assert.cs:65:20:65:20 | access to parameter b | non-null |
 | Assert.cs:66:37:66:37 | [b (line 63): true] access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | false |
@@ -25,7 +24,6 @@
 | Assert.cs:66:37:66:37 | [b (line 63): true] access to parameter b | Assert.cs:65:20:65:32 | ... ? ... : ... | Assert.cs:65:20:65:20 | access to parameter b | non-null |
 | Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:24 | access to local variable s | Assert.cs:66:24:66:24 | access to local variable s | non-null |
 | Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:32 | ... == ... | Assert.cs:66:24:66:24 | access to local variable s | false |
-| Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:37 | ... \|\| ... | Assert.cs:66:24:66:24 | access to local variable s | false |
 | Assert.cs:73:36:73:36 | [b (line 70): false] access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | false |
 | Assert.cs:73:36:73:36 | [b (line 70): false] access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | true |
 | Assert.cs:73:36:73:36 | [b (line 70): false] access to parameter b | Assert.cs:72:20:72:32 | ... ? ... : ... | Assert.cs:72:20:72:20 | access to parameter b | null |
@@ -33,7 +31,6 @@
 | Assert.cs:73:36:73:36 | [b (line 70): true] access to parameter b | Assert.cs:72:20:72:32 | ... ? ... : ... | Assert.cs:72:20:72:20 | access to parameter b | null |
 | Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:23 | access to local variable s | Assert.cs:73:23:73:23 | access to local variable s | null |
 | Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:31 | ... == ... | Assert.cs:73:23:73:23 | access to local variable s | true |
-| Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:36 | ... && ... | Assert.cs:73:23:73:23 | access to local variable s | true |
 | Assert.cs:80:37:80:37 | [b (line 77): false] access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | false |
 | Assert.cs:80:37:80:37 | [b (line 77): false] access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | true |
 | Assert.cs:80:37:80:37 | [b (line 77): false] access to parameter b | Assert.cs:79:20:79:32 | ... ? ... : ... | Assert.cs:79:20:79:20 | access to parameter b | null |
@@ -41,7 +38,6 @@
 | Assert.cs:80:37:80:37 | [b (line 77): true] access to parameter b | Assert.cs:79:20:79:32 | ... ? ... : ... | Assert.cs:79:20:79:20 | access to parameter b | null |
 | Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:24 | access to local variable s | Assert.cs:80:24:80:24 | access to local variable s | null |
 | Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:32 | ... != ... | Assert.cs:80:24:80:24 | access to local variable s | false |
-| Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:37 | ... \|\| ... | Assert.cs:80:24:80:24 | access to local variable s | false |
 | Assert.cs:93:33:93:34 | [assertion failure, b1 (line 91): false] access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | false |
 | Assert.cs:93:33:93:34 | [assertion failure, b1 (line 91): false] access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | true |
 | Assert.cs:93:33:93:34 | [assertion failure, b1 (line 91): true] access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | true |
@@ -56,49 +52,27 @@
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:68:13:68:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:96:31:96:34 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | non-empty |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:12:13:12:24 | ... > ... | Guards.cs:12:13:12:13 | access to parameter s | true |
 | Guards.cs:26:31:26:31 | access to parameter s | Guards.cs:24:13:24:13 | access to parameter s | Guards.cs:24:13:24:13 | access to parameter s | non-null |
 | Guards.cs:26:31:26:31 | access to parameter s | Guards.cs:24:13:24:21 | ... != ... | Guards.cs:24:13:24:13 | access to parameter s | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:36 | !... | Guards.cs:32:35:32:35 | access to parameter x | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:35:32:35 | access to parameter x | true |
 | Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:14:32:36 | call to method IsNullOrEmpty | Guards.cs:32:35:32:35 | access to parameter x | false |
 | Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:35:32:35 | access to parameter x | Guards.cs:32:35:32:35 | access to parameter x | non-null |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:42:32:42 | access to parameter y | true |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:40:32:51 | !... | Guards.cs:32:42:32:42 | access to parameter y | true |
 | Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:42:32:42 | access to parameter y | Guards.cs:32:42:32:42 | access to parameter y | non-null |
 | Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:42:32:50 | ... == ... | Guards.cs:32:42:32:42 | access to parameter y | false |
 | Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:13 | access to parameter x | Guards.cs:35:13:35:13 | access to parameter x | non-null |
 | Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:21 | ... == ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:26:35:26 | access to parameter y | false |
 | Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:26:35:26 | access to parameter y | Guards.cs:35:26:35:26 | access to parameter y | non-null |
 | Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:26:35:34 | ... == ... | Guards.cs:35:26:35:26 | access to parameter y | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:13:38:37 | !... | Guards.cs:38:15:38:15 | access to parameter x | true |
 | Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:15 | access to parameter x | Guards.cs:38:15:38:15 | access to parameter x | non-null |
 | Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:23 | ... == ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:13:38:37 | !... | Guards.cs:38:28:38:28 | access to parameter y | true |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:28:38:28 | access to parameter y | false |
 | Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:28:38:28 | access to parameter y | Guards.cs:38:28:38:28 | access to parameter y | non-null |
 | Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:28:38:36 | ... == ... | Guards.cs:38:28:38:28 | access to parameter y | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:13:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:14:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:15:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
 | Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:17 | access to parameter x | Guards.cs:41:17:41:17 | access to parameter x | non-null |
 | Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:25 | ... != ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:13:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:14:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:15:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:30:41:30 | access to parameter y | Guards.cs:41:30:41:30 | access to parameter y | non-null |
 | Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:30:41:38 | ... != ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:48:31:48:40 | access to field Field | Guards.cs:47:13:47:17 | access to field Field | Guards.cs:47:13:47:17 | access to field Field | non-null |
@@ -193,21 +167,16 @@
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-match access to type Action<Object> |
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-match null |
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-null |
-| Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:13:168:41 | !... | Guards.cs:168:40:168:40 | access to parameter x | true |
 | Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:14:168:41 | call to method IsNullOrWhiteSpace | Guards.cs:168:40:168:40 | access to parameter x | false |
 | Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:40:168:40 | access to parameter x | Guards.cs:168:40:168:40 | access to parameter x | non-null |
-| Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:13:189:25 | !... | Guards.cs:189:24:189:24 | access to parameter s | true |
 | Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:14:189:25 | call to method NullTest1 | Guards.cs:189:24:189:24 | access to parameter s | false |
 | Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:24:189:24 | access to parameter s | Guards.cs:189:24:189:24 | access to parameter s | non-null |
-| Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:13:191:25 | !... | Guards.cs:191:24:191:24 | access to parameter s | true |
 | Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:14:191:25 | call to method NullTest2 | Guards.cs:191:24:191:24 | access to parameter s | false |
 | Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:24:191:24 | access to parameter s | Guards.cs:191:24:191:24 | access to parameter s | non-null |
-| Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:13:193:25 | !... | Guards.cs:193:24:193:24 | access to parameter s | true |
 | Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:14:193:25 | call to method NullTest3 | Guards.cs:193:24:193:24 | access to parameter s | false |
 | Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:24:193:24 | access to parameter s | Guards.cs:193:24:193:24 | access to parameter s | non-null |
 | Guards.cs:196:31:196:31 | access to parameter s | Guards.cs:195:13:195:27 | call to method NotNullTest4 | Guards.cs:195:26:195:26 | access to parameter s | true |
 | Guards.cs:196:31:196:31 | access to parameter s | Guards.cs:195:26:195:26 | access to parameter s | Guards.cs:195:26:195:26 | access to parameter s | non-null |
-| Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:13:197:29 | !... | Guards.cs:197:28:197:28 | access to parameter s | true |
 | Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:14:197:29 | call to method NullTestWrong | Guards.cs:197:28:197:28 | access to parameter s | false |
 | Guards.cs:205:13:205:13 | access to parameter o | Guards.cs:203:13:203:13 | access to parameter o | Guards.cs:203:13:203:13 | access to parameter o | non-null |
 | Guards.cs:205:13:205:13 | access to parameter o | Guards.cs:203:13:203:21 | ... != ... | Guards.cs:203:13:203:13 | access to parameter o | true |
@@ -241,7 +210,6 @@
 | Guards.cs:342:27:342:27 | [b (line 339): true] access to parameter b | Guards.cs:341:20:341:32 | ... ? ... : ... | Guards.cs:341:20:341:20 | access to parameter b | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
-| Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | non-null |
 | Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | [b (line 9): true] access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | non-null |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
index aad97097f21f..bd5e3dbf1a14 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
@@ -14,22 +14,18 @@
 | Assert.cs:59:36:59:36 | access to parameter b | Assert.cs:58:20:58:32 | ... ? ... : ... | Assert.cs:58:20:58:20 | access to parameter b | non-null |
 | Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:23 | access to local variable s | Assert.cs:59:23:59:23 | access to local variable s | non-null |
 | Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:31 | ... != ... | Assert.cs:59:23:59:23 | access to local variable s | true |
-| Assert.cs:60:27:60:27 | access to local variable s | Assert.cs:59:23:59:36 | ... && ... | Assert.cs:59:23:59:23 | access to local variable s | true |
 | Assert.cs:66:37:66:37 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | Assert.cs:65:20:65:20 | access to parameter b | false |
 | Assert.cs:66:37:66:37 | access to parameter b | Assert.cs:65:20:65:32 | ... ? ... : ... | Assert.cs:65:20:65:20 | access to parameter b | non-null |
 | Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:24 | access to local variable s | Assert.cs:66:24:66:24 | access to local variable s | non-null |
 | Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:32 | ... == ... | Assert.cs:66:24:66:24 | access to local variable s | false |
-| Assert.cs:67:27:67:27 | access to local variable s | Assert.cs:66:24:66:37 | ... \|\| ... | Assert.cs:66:24:66:24 | access to local variable s | false |
 | Assert.cs:73:36:73:36 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | Assert.cs:72:20:72:20 | access to parameter b | true |
 | Assert.cs:73:36:73:36 | access to parameter b | Assert.cs:72:20:72:32 | ... ? ... : ... | Assert.cs:72:20:72:20 | access to parameter b | null |
 | Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:23 | access to local variable s | Assert.cs:73:23:73:23 | access to local variable s | null |
 | Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:31 | ... == ... | Assert.cs:73:23:73:23 | access to local variable s | true |
-| Assert.cs:74:27:74:27 | access to local variable s | Assert.cs:73:23:73:36 | ... && ... | Assert.cs:73:23:73:23 | access to local variable s | true |
 | Assert.cs:80:37:80:37 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | Assert.cs:79:20:79:20 | access to parameter b | true |
 | Assert.cs:80:37:80:37 | access to parameter b | Assert.cs:79:20:79:32 | ... ? ... : ... | Assert.cs:79:20:79:20 | access to parameter b | null |
 | Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:24 | access to local variable s | Assert.cs:80:24:80:24 | access to local variable s | null |
 | Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:32 | ... != ... | Assert.cs:80:24:80:24 | access to local variable s | false |
-| Assert.cs:81:27:81:27 | access to local variable s | Assert.cs:80:24:80:37 | ... \|\| ... | Assert.cs:80:24:80:24 | access to local variable s | false |
 | Assert.cs:94:16:94:17 | access to parameter b1 | Assert.cs:93:25:93:26 | access to parameter b1 | Assert.cs:93:25:93:26 | access to parameter b1 | true |
 | Assert.cs:94:23:94:24 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | Assert.cs:93:29:93:30 | access to parameter b2 | false |
 | Collections.cs:52:17:52:20 | access to parameter args | Collections.cs:50:13:50:16 | access to parameter args | Collections.cs:50:13:50:16 | access to parameter args | non-empty |
@@ -40,49 +36,27 @@
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:68:13:68:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:96:31:96:34 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | non-empty |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:13:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | false |
-| Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:14:10:25 | !... | Guards.cs:10:16:10:16 | access to parameter s | true |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:12:13:12:24 | ... > ... | Guards.cs:12:13:12:13 | access to parameter s | true |
 | Guards.cs:26:31:26:31 | access to parameter s | Guards.cs:24:13:24:13 | access to parameter s | Guards.cs:24:13:24:13 | access to parameter s | non-null |
 | Guards.cs:26:31:26:31 | access to parameter s | Guards.cs:24:13:24:21 | ... != ... | Guards.cs:24:13:24:13 | access to parameter s | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:36 | !... | Guards.cs:32:35:32:35 | access to parameter x | true |
-| Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:35:32:35 | access to parameter x | true |
 | Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:14:32:36 | call to method IsNullOrEmpty | Guards.cs:32:35:32:35 | access to parameter x | false |
 | Guards.cs:33:31:33:31 | access to parameter x | Guards.cs:32:35:32:35 | access to parameter x | Guards.cs:32:35:32:35 | access to parameter x | non-null |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:13:32:51 | ... & ... | Guards.cs:32:42:32:42 | access to parameter y | true |
-| Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:40:32:51 | !... | Guards.cs:32:42:32:42 | access to parameter y | true |
 | Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:42:32:42 | access to parameter y | Guards.cs:32:42:32:42 | access to parameter y | non-null |
 | Guards.cs:33:35:33:35 | access to parameter y | Guards.cs:32:42:32:50 | ... == ... | Guards.cs:32:42:32:42 | access to parameter y | false |
 | Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:13 | access to parameter x | Guards.cs:35:13:35:13 | access to parameter x | non-null |
 | Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:21 | ... == ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:32:36:32 | access to parameter x | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:13:35:13 | access to parameter x | false |
-| Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:13:35:34 | ... \|\| ... | Guards.cs:35:26:35:26 | access to parameter y | false |
 | Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:26:35:26 | access to parameter y | Guards.cs:35:26:35:26 | access to parameter y | non-null |
 | Guards.cs:36:36:36:36 | access to parameter y | Guards.cs:35:26:35:34 | ... == ... | Guards.cs:35:26:35:26 | access to parameter y | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:13:38:37 | !... | Guards.cs:38:15:38:15 | access to parameter x | true |
 | Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:15 | access to parameter x | Guards.cs:38:15:38:15 | access to parameter x | non-null |
 | Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:23 | ... == ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:31:39:31 | access to parameter x | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:15:38:15 | access to parameter x | false |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:13:38:37 | !... | Guards.cs:38:28:38:28 | access to parameter y | true |
-| Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:15:38:36 | ... \|\| ... | Guards.cs:38:28:38:28 | access to parameter y | false |
 | Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:28:38:28 | access to parameter y | Guards.cs:38:28:38:28 | access to parameter y | non-null |
 | Guards.cs:39:35:39:35 | access to parameter y | Guards.cs:38:28:38:36 | ... == ... | Guards.cs:38:28:38:28 | access to parameter y | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:13:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:14:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:15:41:39 | !... | Guards.cs:41:17:41:17 | access to parameter x | false |
 | Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:17 | access to parameter x | Guards.cs:41:17:41:17 | access to parameter x | non-null |
 | Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:25 | ... != ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:32:42:32 | access to parameter x | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:17:41:17 | access to parameter x | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:13:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:14:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | true |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:15:41:39 | !... | Guards.cs:41:30:41:30 | access to parameter y | false |
-| Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:17:41:38 | ... && ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:30:41:30 | access to parameter y | Guards.cs:41:30:41:30 | access to parameter y | non-null |
 | Guards.cs:42:36:42:36 | access to parameter y | Guards.cs:41:30:41:38 | ... != ... | Guards.cs:41:30:41:30 | access to parameter y | true |
 | Guards.cs:48:31:48:40 | access to field Field | Guards.cs:47:13:47:17 | access to field Field | Guards.cs:47:13:47:17 | access to field Field | non-null |
@@ -177,21 +151,16 @@
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-match access to type Action<Object> |
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-match null |
 | Guards.cs:162:24:162:24 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | Guards.cs:151:17:151:17 | access to parameter o | non-null |
-| Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:13:168:41 | !... | Guards.cs:168:40:168:40 | access to parameter x | true |
 | Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:14:168:41 | call to method IsNullOrWhiteSpace | Guards.cs:168:40:168:40 | access to parameter x | false |
 | Guards.cs:169:31:169:31 | access to parameter x | Guards.cs:168:40:168:40 | access to parameter x | Guards.cs:168:40:168:40 | access to parameter x | non-null |
-| Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:13:189:25 | !... | Guards.cs:189:24:189:24 | access to parameter s | true |
 | Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:14:189:25 | call to method NullTest1 | Guards.cs:189:24:189:24 | access to parameter s | false |
 | Guards.cs:190:31:190:31 | access to parameter s | Guards.cs:189:24:189:24 | access to parameter s | Guards.cs:189:24:189:24 | access to parameter s | non-null |
-| Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:13:191:25 | !... | Guards.cs:191:24:191:24 | access to parameter s | true |
 | Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:14:191:25 | call to method NullTest2 | Guards.cs:191:24:191:24 | access to parameter s | false |
 | Guards.cs:192:31:192:31 | access to parameter s | Guards.cs:191:24:191:24 | access to parameter s | Guards.cs:191:24:191:24 | access to parameter s | non-null |
-| Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:13:193:25 | !... | Guards.cs:193:24:193:24 | access to parameter s | true |
 | Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:14:193:25 | call to method NullTest3 | Guards.cs:193:24:193:24 | access to parameter s | false |
 | Guards.cs:194:31:194:31 | access to parameter s | Guards.cs:193:24:193:24 | access to parameter s | Guards.cs:193:24:193:24 | access to parameter s | non-null |
 | Guards.cs:196:31:196:31 | access to parameter s | Guards.cs:195:13:195:27 | call to method NotNullTest4 | Guards.cs:195:26:195:26 | access to parameter s | true |
 | Guards.cs:196:31:196:31 | access to parameter s | Guards.cs:195:26:195:26 | access to parameter s | Guards.cs:195:26:195:26 | access to parameter s | non-null |
-| Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:13:197:29 | !... | Guards.cs:197:28:197:28 | access to parameter s | true |
 | Guards.cs:198:31:198:31 | access to parameter s | Guards.cs:197:14:197:29 | call to method NullTestWrong | Guards.cs:197:28:197:28 | access to parameter s | false |
 | Guards.cs:205:13:205:13 | access to parameter o | Guards.cs:203:13:203:13 | access to parameter o | Guards.cs:203:13:203:13 | access to parameter o | non-null |
 | Guards.cs:205:13:205:13 | access to parameter o | Guards.cs:203:13:203:21 | ... != ... | Guards.cs:203:13:203:13 | access to parameter o | true |
@@ -222,7 +191,6 @@
 | Guards.cs:342:27:342:27 | access to parameter b | Guards.cs:341:20:341:32 | ... ? ... : ... | Guards.cs:341:20:341:20 | access to parameter b | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
-| Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | non-null |
 | Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | non-null |

From 956507b5fa10857d97cf13590b9570ba195eb787 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 22 Apr 2021 15:02:53 +0200
Subject: [PATCH 401/433] C#: Add guards stress test

---
 .../guards-large/GuardedExpr.expected         | 797 ++++++++++++++++++
 .../controlflow/guards-large/GuardedExpr.ql   |   5 +
 .../guards-large/GuardsStressTest.cs          | 443 ++++++++++
 3 files changed, 1245 insertions(+)
 create mode 100644 csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.expected
 create mode 100644 csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.ql
 create mode 100644 csharp/ql/test/library-tests/controlflow/guards-large/GuardsStressTest.cs

diff --git a/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.expected
new file mode 100644
index 000000000000..b390b5be6394
--- /dev/null
+++ b/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.expected
@@ -0,0 +1,797 @@
+| GuardsStressTest.cs:8:26:8:27 | access to field ch |
+| GuardsStressTest.cs:9:4:9:5 | access to field ch |
+| GuardsStressTest.cs:9:17:9:18 | access to field ch |
+| GuardsStressTest.cs:10:4:10:5 | access to field ch |
+| GuardsStressTest.cs:11:4:11:5 | access to field ch |
+| GuardsStressTest.cs:11:17:11:18 | access to field ch |
+| GuardsStressTest.cs:12:4:12:5 | access to field ch |
+| GuardsStressTest.cs:13:4:13:5 | access to field ch |
+| GuardsStressTest.cs:14:4:14:5 | access to field ch |
+| GuardsStressTest.cs:15:4:15:5 | access to field ch |
+| GuardsStressTest.cs:15:17:15:18 | access to field ch |
+| GuardsStressTest.cs:16:4:16:5 | access to field ch |
+| GuardsStressTest.cs:16:17:16:18 | access to field ch |
+| GuardsStressTest.cs:17:4:17:5 | access to field ch |
+| GuardsStressTest.cs:17:17:17:18 | access to field ch |
+| GuardsStressTest.cs:18:4:18:5 | access to field ch |
+| GuardsStressTest.cs:18:17:18:18 | access to field ch |
+| GuardsStressTest.cs:19:4:19:5 | access to field ch |
+| GuardsStressTest.cs:19:17:19:18 | access to field ch |
+| GuardsStressTest.cs:20:4:20:5 | access to field ch |
+| GuardsStressTest.cs:21:4:21:5 | access to field ch |
+| GuardsStressTest.cs:22:4:22:5 | access to field ch |
+| GuardsStressTest.cs:22:17:22:18 | access to field ch |
+| GuardsStressTest.cs:23:4:23:5 | access to field ch |
+| GuardsStressTest.cs:23:17:23:18 | access to field ch |
+| GuardsStressTest.cs:24:4:24:5 | access to field ch |
+| GuardsStressTest.cs:24:17:24:18 | access to field ch |
+| GuardsStressTest.cs:25:4:25:5 | access to field ch |
+| GuardsStressTest.cs:26:4:26:5 | access to field ch |
+| GuardsStressTest.cs:26:17:26:18 | access to field ch |
+| GuardsStressTest.cs:27:4:27:5 | access to field ch |
+| GuardsStressTest.cs:28:4:28:5 | access to field ch |
+| GuardsStressTest.cs:28:17:28:18 | access to field ch |
+| GuardsStressTest.cs:29:4:29:5 | access to field ch |
+| GuardsStressTest.cs:29:17:29:18 | access to field ch |
+| GuardsStressTest.cs:30:4:30:5 | access to field ch |
+| GuardsStressTest.cs:30:18:30:19 | access to field ch |
+| GuardsStressTest.cs:31:4:31:5 | access to field ch |
+| GuardsStressTest.cs:31:18:31:19 | access to field ch |
+| GuardsStressTest.cs:32:4:32:5 | access to field ch |
+| GuardsStressTest.cs:32:18:32:19 | access to field ch |
+| GuardsStressTest.cs:33:4:33:5 | access to field ch |
+| GuardsStressTest.cs:33:18:33:19 | access to field ch |
+| GuardsStressTest.cs:34:4:34:5 | access to field ch |
+| GuardsStressTest.cs:35:4:35:5 | access to field ch |
+| GuardsStressTest.cs:35:18:35:19 | access to field ch |
+| GuardsStressTest.cs:36:4:36:5 | access to field ch |
+| GuardsStressTest.cs:36:18:36:19 | access to field ch |
+| GuardsStressTest.cs:37:4:37:5 | access to field ch |
+| GuardsStressTest.cs:38:4:38:5 | access to field ch |
+| GuardsStressTest.cs:38:18:38:19 | access to field ch |
+| GuardsStressTest.cs:39:4:39:5 | access to field ch |
+| GuardsStressTest.cs:39:18:39:19 | access to field ch |
+| GuardsStressTest.cs:40:4:40:5 | access to field ch |
+| GuardsStressTest.cs:41:4:41:5 | access to field ch |
+| GuardsStressTest.cs:41:18:41:19 | access to field ch |
+| GuardsStressTest.cs:42:4:42:5 | access to field ch |
+| GuardsStressTest.cs:42:18:42:19 | access to field ch |
+| GuardsStressTest.cs:43:4:43:5 | access to field ch |
+| GuardsStressTest.cs:43:18:43:19 | access to field ch |
+| GuardsStressTest.cs:44:4:44:5 | access to field ch |
+| GuardsStressTest.cs:44:18:44:19 | access to field ch |
+| GuardsStressTest.cs:45:4:45:5 | access to field ch |
+| GuardsStressTest.cs:45:18:45:19 | access to field ch |
+| GuardsStressTest.cs:46:4:46:5 | access to field ch |
+| GuardsStressTest.cs:46:18:46:19 | access to field ch |
+| GuardsStressTest.cs:47:4:47:5 | access to field ch |
+| GuardsStressTest.cs:47:18:47:19 | access to field ch |
+| GuardsStressTest.cs:48:4:48:5 | access to field ch |
+| GuardsStressTest.cs:48:18:48:19 | access to field ch |
+| GuardsStressTest.cs:49:4:49:5 | access to field ch |
+| GuardsStressTest.cs:50:4:50:5 | access to field ch |
+| GuardsStressTest.cs:50:18:50:19 | access to field ch |
+| GuardsStressTest.cs:51:4:51:5 | access to field ch |
+| GuardsStressTest.cs:51:18:51:19 | access to field ch |
+| GuardsStressTest.cs:52:4:52:5 | access to field ch |
+| GuardsStressTest.cs:52:18:52:19 | access to field ch |
+| GuardsStressTest.cs:53:4:53:5 | access to field ch |
+| GuardsStressTest.cs:54:4:54:5 | access to field ch |
+| GuardsStressTest.cs:54:18:54:19 | access to field ch |
+| GuardsStressTest.cs:55:4:55:5 | access to field ch |
+| GuardsStressTest.cs:55:18:55:19 | access to field ch |
+| GuardsStressTest.cs:56:4:56:5 | access to field ch |
+| GuardsStressTest.cs:57:4:57:5 | access to field ch |
+| GuardsStressTest.cs:57:18:57:19 | access to field ch |
+| GuardsStressTest.cs:58:4:58:5 | access to field ch |
+| GuardsStressTest.cs:58:18:58:19 | access to field ch |
+| GuardsStressTest.cs:59:4:59:5 | access to field ch |
+| GuardsStressTest.cs:59:18:59:19 | access to field ch |
+| GuardsStressTest.cs:60:4:60:5 | access to field ch |
+| GuardsStressTest.cs:60:18:60:19 | access to field ch |
+| GuardsStressTest.cs:61:4:61:5 | access to field ch |
+| GuardsStressTest.cs:61:18:61:19 | access to field ch |
+| GuardsStressTest.cs:62:4:62:5 | access to field ch |
+| GuardsStressTest.cs:62:18:62:19 | access to field ch |
+| GuardsStressTest.cs:63:4:63:5 | access to field ch |
+| GuardsStressTest.cs:63:18:63:19 | access to field ch |
+| GuardsStressTest.cs:64:4:64:5 | access to field ch |
+| GuardsStressTest.cs:64:18:64:19 | access to field ch |
+| GuardsStressTest.cs:65:4:65:5 | access to field ch |
+| GuardsStressTest.cs:65:18:65:19 | access to field ch |
+| GuardsStressTest.cs:66:4:66:5 | access to field ch |
+| GuardsStressTest.cs:66:18:66:19 | access to field ch |
+| GuardsStressTest.cs:67:4:67:5 | access to field ch |
+| GuardsStressTest.cs:67:18:67:19 | access to field ch |
+| GuardsStressTest.cs:68:4:68:5 | access to field ch |
+| GuardsStressTest.cs:69:4:69:5 | access to field ch |
+| GuardsStressTest.cs:69:18:69:19 | access to field ch |
+| GuardsStressTest.cs:70:4:70:5 | access to field ch |
+| GuardsStressTest.cs:70:18:70:19 | access to field ch |
+| GuardsStressTest.cs:71:4:71:5 | access to field ch |
+| GuardsStressTest.cs:71:18:71:19 | access to field ch |
+| GuardsStressTest.cs:72:4:72:5 | access to field ch |
+| GuardsStressTest.cs:72:18:72:19 | access to field ch |
+| GuardsStressTest.cs:73:4:73:5 | access to field ch |
+| GuardsStressTest.cs:74:4:74:5 | access to field ch |
+| GuardsStressTest.cs:74:18:74:19 | access to field ch |
+| GuardsStressTest.cs:75:4:75:5 | access to field ch |
+| GuardsStressTest.cs:75:18:75:19 | access to field ch |
+| GuardsStressTest.cs:76:4:76:5 | access to field ch |
+| GuardsStressTest.cs:76:18:76:19 | access to field ch |
+| GuardsStressTest.cs:77:4:77:5 | access to field ch |
+| GuardsStressTest.cs:77:18:77:19 | access to field ch |
+| GuardsStressTest.cs:78:4:78:5 | access to field ch |
+| GuardsStressTest.cs:78:18:78:19 | access to field ch |
+| GuardsStressTest.cs:79:4:79:5 | access to field ch |
+| GuardsStressTest.cs:79:18:79:19 | access to field ch |
+| GuardsStressTest.cs:80:4:80:5 | access to field ch |
+| GuardsStressTest.cs:80:18:80:19 | access to field ch |
+| GuardsStressTest.cs:81:4:81:5 | access to field ch |
+| GuardsStressTest.cs:81:18:81:19 | access to field ch |
+| GuardsStressTest.cs:82:4:82:5 | access to field ch |
+| GuardsStressTest.cs:82:18:82:19 | access to field ch |
+| GuardsStressTest.cs:83:4:83:5 | access to field ch |
+| GuardsStressTest.cs:83:18:83:19 | access to field ch |
+| GuardsStressTest.cs:84:4:84:5 | access to field ch |
+| GuardsStressTest.cs:84:18:84:19 | access to field ch |
+| GuardsStressTest.cs:85:4:85:5 | access to field ch |
+| GuardsStressTest.cs:86:4:86:5 | access to field ch |
+| GuardsStressTest.cs:86:18:86:19 | access to field ch |
+| GuardsStressTest.cs:87:4:87:5 | access to field ch |
+| GuardsStressTest.cs:87:18:87:19 | access to field ch |
+| GuardsStressTest.cs:88:4:88:5 | access to field ch |
+| GuardsStressTest.cs:88:18:88:19 | access to field ch |
+| GuardsStressTest.cs:89:4:89:5 | access to field ch |
+| GuardsStressTest.cs:90:4:90:5 | access to field ch |
+| GuardsStressTest.cs:90:18:90:19 | access to field ch |
+| GuardsStressTest.cs:91:4:91:5 | access to field ch |
+| GuardsStressTest.cs:92:4:92:5 | access to field ch |
+| GuardsStressTest.cs:92:18:92:19 | access to field ch |
+| GuardsStressTest.cs:93:4:93:5 | access to field ch |
+| GuardsStressTest.cs:93:18:93:19 | access to field ch |
+| GuardsStressTest.cs:94:4:94:5 | access to field ch |
+| GuardsStressTest.cs:94:18:94:19 | access to field ch |
+| GuardsStressTest.cs:95:4:95:5 | access to field ch |
+| GuardsStressTest.cs:95:18:95:19 | access to field ch |
+| GuardsStressTest.cs:96:4:96:5 | access to field ch |
+| GuardsStressTest.cs:96:18:96:19 | access to field ch |
+| GuardsStressTest.cs:97:4:97:5 | access to field ch |
+| GuardsStressTest.cs:97:18:97:19 | access to field ch |
+| GuardsStressTest.cs:98:4:98:5 | access to field ch |
+| GuardsStressTest.cs:98:18:98:19 | access to field ch |
+| GuardsStressTest.cs:99:4:99:5 | access to field ch |
+| GuardsStressTest.cs:99:18:99:19 | access to field ch |
+| GuardsStressTest.cs:100:4:100:5 | access to field ch |
+| GuardsStressTest.cs:100:18:100:19 | access to field ch |
+| GuardsStressTest.cs:101:4:101:5 | access to field ch |
+| GuardsStressTest.cs:101:18:101:19 | access to field ch |
+| GuardsStressTest.cs:102:4:102:5 | access to field ch |
+| GuardsStressTest.cs:102:18:102:19 | access to field ch |
+| GuardsStressTest.cs:103:4:103:5 | access to field ch |
+| GuardsStressTest.cs:104:4:104:5 | access to field ch |
+| GuardsStressTest.cs:104:18:104:19 | access to field ch |
+| GuardsStressTest.cs:105:4:105:5 | access to field ch |
+| GuardsStressTest.cs:105:18:105:19 | access to field ch |
+| GuardsStressTest.cs:106:4:106:5 | access to field ch |
+| GuardsStressTest.cs:106:18:106:19 | access to field ch |
+| GuardsStressTest.cs:107:4:107:5 | access to field ch |
+| GuardsStressTest.cs:107:18:107:19 | access to field ch |
+| GuardsStressTest.cs:108:4:108:5 | access to field ch |
+| GuardsStressTest.cs:108:18:108:19 | access to field ch |
+| GuardsStressTest.cs:109:4:109:5 | access to field ch |
+| GuardsStressTest.cs:109:18:109:19 | access to field ch |
+| GuardsStressTest.cs:110:4:110:5 | access to field ch |
+| GuardsStressTest.cs:110:18:110:19 | access to field ch |
+| GuardsStressTest.cs:111:4:111:5 | access to field ch |
+| GuardsStressTest.cs:111:18:111:19 | access to field ch |
+| GuardsStressTest.cs:112:4:112:5 | access to field ch |
+| GuardsStressTest.cs:112:18:112:19 | access to field ch |
+| GuardsStressTest.cs:113:4:113:5 | access to field ch |
+| GuardsStressTest.cs:113:18:113:19 | access to field ch |
+| GuardsStressTest.cs:114:4:114:5 | access to field ch |
+| GuardsStressTest.cs:114:18:114:19 | access to field ch |
+| GuardsStressTest.cs:115:4:115:5 | access to field ch |
+| GuardsStressTest.cs:115:18:115:19 | access to field ch |
+| GuardsStressTest.cs:116:4:116:5 | access to field ch |
+| GuardsStressTest.cs:116:18:116:19 | access to field ch |
+| GuardsStressTest.cs:117:4:117:5 | access to field ch |
+| GuardsStressTest.cs:117:18:117:19 | access to field ch |
+| GuardsStressTest.cs:118:4:118:5 | access to field ch |
+| GuardsStressTest.cs:118:18:118:19 | access to field ch |
+| GuardsStressTest.cs:119:4:119:5 | access to field ch |
+| GuardsStressTest.cs:119:18:119:19 | access to field ch |
+| GuardsStressTest.cs:120:4:120:5 | access to field ch |
+| GuardsStressTest.cs:121:4:121:5 | access to field ch |
+| GuardsStressTest.cs:121:18:121:19 | access to field ch |
+| GuardsStressTest.cs:122:4:122:5 | access to field ch |
+| GuardsStressTest.cs:122:18:122:19 | access to field ch |
+| GuardsStressTest.cs:123:4:123:5 | access to field ch |
+| GuardsStressTest.cs:123:18:123:19 | access to field ch |
+| GuardsStressTest.cs:124:4:124:5 | access to field ch |
+| GuardsStressTest.cs:124:18:124:19 | access to field ch |
+| GuardsStressTest.cs:125:4:125:5 | access to field ch |
+| GuardsStressTest.cs:125:18:125:19 | access to field ch |
+| GuardsStressTest.cs:126:4:126:5 | access to field ch |
+| GuardsStressTest.cs:127:4:127:5 | access to field ch |
+| GuardsStressTest.cs:127:18:127:19 | access to field ch |
+| GuardsStressTest.cs:128:4:128:5 | access to field ch |
+| GuardsStressTest.cs:128:18:128:19 | access to field ch |
+| GuardsStressTest.cs:129:4:129:5 | access to field ch |
+| GuardsStressTest.cs:129:18:129:19 | access to field ch |
+| GuardsStressTest.cs:130:4:130:5 | access to field ch |
+| GuardsStressTest.cs:130:18:130:19 | access to field ch |
+| GuardsStressTest.cs:131:4:131:5 | access to field ch |
+| GuardsStressTest.cs:131:18:131:19 | access to field ch |
+| GuardsStressTest.cs:132:4:132:5 | access to field ch |
+| GuardsStressTest.cs:132:18:132:19 | access to field ch |
+| GuardsStressTest.cs:133:4:133:5 | access to field ch |
+| GuardsStressTest.cs:133:18:133:19 | access to field ch |
+| GuardsStressTest.cs:134:4:134:5 | access to field ch |
+| GuardsStressTest.cs:135:4:135:5 | access to field ch |
+| GuardsStressTest.cs:136:4:136:5 | access to field ch |
+| GuardsStressTest.cs:136:18:136:19 | access to field ch |
+| GuardsStressTest.cs:137:4:137:5 | access to field ch |
+| GuardsStressTest.cs:137:18:137:19 | access to field ch |
+| GuardsStressTest.cs:138:4:138:5 | access to field ch |
+| GuardsStressTest.cs:138:18:138:19 | access to field ch |
+| GuardsStressTest.cs:139:4:139:5 | access to field ch |
+| GuardsStressTest.cs:139:18:139:19 | access to field ch |
+| GuardsStressTest.cs:140:4:140:5 | access to field ch |
+| GuardsStressTest.cs:140:18:140:19 | access to field ch |
+| GuardsStressTest.cs:141:4:141:5 | access to field ch |
+| GuardsStressTest.cs:141:18:141:19 | access to field ch |
+| GuardsStressTest.cs:142:4:142:5 | access to field ch |
+| GuardsStressTest.cs:142:18:142:19 | access to field ch |
+| GuardsStressTest.cs:143:4:143:5 | access to field ch |
+| GuardsStressTest.cs:143:18:143:19 | access to field ch |
+| GuardsStressTest.cs:144:4:144:5 | access to field ch |
+| GuardsStressTest.cs:144:18:144:19 | access to field ch |
+| GuardsStressTest.cs:145:4:145:5 | access to field ch |
+| GuardsStressTest.cs:145:18:145:19 | access to field ch |
+| GuardsStressTest.cs:146:4:146:5 | access to field ch |
+| GuardsStressTest.cs:146:18:146:19 | access to field ch |
+| GuardsStressTest.cs:147:4:147:5 | access to field ch |
+| GuardsStressTest.cs:147:18:147:19 | access to field ch |
+| GuardsStressTest.cs:148:4:148:5 | access to field ch |
+| GuardsStressTest.cs:148:18:148:19 | access to field ch |
+| GuardsStressTest.cs:149:4:149:5 | access to field ch |
+| GuardsStressTest.cs:149:18:149:19 | access to field ch |
+| GuardsStressTest.cs:150:4:150:5 | access to field ch |
+| GuardsStressTest.cs:150:18:150:19 | access to field ch |
+| GuardsStressTest.cs:151:4:151:5 | access to field ch |
+| GuardsStressTest.cs:151:18:151:19 | access to field ch |
+| GuardsStressTest.cs:152:4:152:5 | access to field ch |
+| GuardsStressTest.cs:152:18:152:19 | access to field ch |
+| GuardsStressTest.cs:153:4:153:5 | access to field ch |
+| GuardsStressTest.cs:153:18:153:19 | access to field ch |
+| GuardsStressTest.cs:154:4:154:5 | access to field ch |
+| GuardsStressTest.cs:154:18:154:19 | access to field ch |
+| GuardsStressTest.cs:155:4:155:5 | access to field ch |
+| GuardsStressTest.cs:155:18:155:19 | access to field ch |
+| GuardsStressTest.cs:156:4:156:5 | access to field ch |
+| GuardsStressTest.cs:156:18:156:19 | access to field ch |
+| GuardsStressTest.cs:157:4:157:5 | access to field ch |
+| GuardsStressTest.cs:157:18:157:19 | access to field ch |
+| GuardsStressTest.cs:158:4:158:5 | access to field ch |
+| GuardsStressTest.cs:158:18:158:19 | access to field ch |
+| GuardsStressTest.cs:159:4:159:5 | access to field ch |
+| GuardsStressTest.cs:159:18:159:19 | access to field ch |
+| GuardsStressTest.cs:160:4:160:5 | access to field ch |
+| GuardsStressTest.cs:161:4:161:5 | access to field ch |
+| GuardsStressTest.cs:161:18:161:19 | access to field ch |
+| GuardsStressTest.cs:162:4:162:5 | access to field ch |
+| GuardsStressTest.cs:162:18:162:19 | access to field ch |
+| GuardsStressTest.cs:163:4:163:5 | access to field ch |
+| GuardsStressTest.cs:163:18:163:19 | access to field ch |
+| GuardsStressTest.cs:164:4:164:5 | access to field ch |
+| GuardsStressTest.cs:164:18:164:19 | access to field ch |
+| GuardsStressTest.cs:165:4:165:5 | access to field ch |
+| GuardsStressTest.cs:165:18:165:19 | access to field ch |
+| GuardsStressTest.cs:166:4:166:5 | access to field ch |
+| GuardsStressTest.cs:166:18:166:19 | access to field ch |
+| GuardsStressTest.cs:167:4:167:5 | access to field ch |
+| GuardsStressTest.cs:167:18:167:19 | access to field ch |
+| GuardsStressTest.cs:168:4:168:5 | access to field ch |
+| GuardsStressTest.cs:168:18:168:19 | access to field ch |
+| GuardsStressTest.cs:169:4:169:5 | access to field ch |
+| GuardsStressTest.cs:169:18:169:19 | access to field ch |
+| GuardsStressTest.cs:170:4:170:5 | access to field ch |
+| GuardsStressTest.cs:170:18:170:19 | access to field ch |
+| GuardsStressTest.cs:171:4:171:5 | access to field ch |
+| GuardsStressTest.cs:172:4:172:5 | access to field ch |
+| GuardsStressTest.cs:172:18:172:19 | access to field ch |
+| GuardsStressTest.cs:173:4:173:5 | access to field ch |
+| GuardsStressTest.cs:173:18:173:19 | access to field ch |
+| GuardsStressTest.cs:174:4:174:5 | access to field ch |
+| GuardsStressTest.cs:174:18:174:19 | access to field ch |
+| GuardsStressTest.cs:175:4:175:5 | access to field ch |
+| GuardsStressTest.cs:175:18:175:19 | access to field ch |
+| GuardsStressTest.cs:176:4:176:5 | access to field ch |
+| GuardsStressTest.cs:176:18:176:19 | access to field ch |
+| GuardsStressTest.cs:177:4:177:5 | access to field ch |
+| GuardsStressTest.cs:177:18:177:19 | access to field ch |
+| GuardsStressTest.cs:178:4:178:5 | access to field ch |
+| GuardsStressTest.cs:178:18:178:19 | access to field ch |
+| GuardsStressTest.cs:179:4:179:5 | access to field ch |
+| GuardsStressTest.cs:180:4:180:5 | access to field ch |
+| GuardsStressTest.cs:180:18:180:19 | access to field ch |
+| GuardsStressTest.cs:181:4:181:5 | access to field ch |
+| GuardsStressTest.cs:182:4:182:5 | access to field ch |
+| GuardsStressTest.cs:182:18:182:19 | access to field ch |
+| GuardsStressTest.cs:183:4:183:5 | access to field ch |
+| GuardsStressTest.cs:184:4:184:5 | access to field ch |
+| GuardsStressTest.cs:184:18:184:19 | access to field ch |
+| GuardsStressTest.cs:185:4:185:5 | access to field ch |
+| GuardsStressTest.cs:185:18:185:19 | access to field ch |
+| GuardsStressTest.cs:186:4:186:5 | access to field ch |
+| GuardsStressTest.cs:186:18:186:19 | access to field ch |
+| GuardsStressTest.cs:187:4:187:5 | access to field ch |
+| GuardsStressTest.cs:187:18:187:19 | access to field ch |
+| GuardsStressTest.cs:188:4:188:5 | access to field ch |
+| GuardsStressTest.cs:188:18:188:19 | access to field ch |
+| GuardsStressTest.cs:189:4:189:5 | access to field ch |
+| GuardsStressTest.cs:189:18:189:19 | access to field ch |
+| GuardsStressTest.cs:190:4:190:5 | access to field ch |
+| GuardsStressTest.cs:191:4:191:5 | access to field ch |
+| GuardsStressTest.cs:191:18:191:19 | access to field ch |
+| GuardsStressTest.cs:192:4:192:5 | access to field ch |
+| GuardsStressTest.cs:193:4:193:5 | access to field ch |
+| GuardsStressTest.cs:194:4:194:5 | access to field ch |
+| GuardsStressTest.cs:194:18:194:19 | access to field ch |
+| GuardsStressTest.cs:195:4:195:5 | access to field ch |
+| GuardsStressTest.cs:195:18:195:19 | access to field ch |
+| GuardsStressTest.cs:196:4:196:5 | access to field ch |
+| GuardsStressTest.cs:196:18:196:19 | access to field ch |
+| GuardsStressTest.cs:197:4:197:5 | access to field ch |
+| GuardsStressTest.cs:198:4:198:5 | access to field ch |
+| GuardsStressTest.cs:199:4:199:5 | access to field ch |
+| GuardsStressTest.cs:199:18:199:19 | access to field ch |
+| GuardsStressTest.cs:200:4:200:5 | access to field ch |
+| GuardsStressTest.cs:200:18:200:19 | access to field ch |
+| GuardsStressTest.cs:201:4:201:5 | access to field ch |
+| GuardsStressTest.cs:201:18:201:19 | access to field ch |
+| GuardsStressTest.cs:202:4:202:5 | access to field ch |
+| GuardsStressTest.cs:202:18:202:19 | access to field ch |
+| GuardsStressTest.cs:203:4:203:5 | access to field ch |
+| GuardsStressTest.cs:204:4:204:5 | access to field ch |
+| GuardsStressTest.cs:204:18:204:19 | access to field ch |
+| GuardsStressTest.cs:205:4:205:5 | access to field ch |
+| GuardsStressTest.cs:205:18:205:19 | access to field ch |
+| GuardsStressTest.cs:206:4:206:5 | access to field ch |
+| GuardsStressTest.cs:206:18:206:19 | access to field ch |
+| GuardsStressTest.cs:207:4:207:5 | access to field ch |
+| GuardsStressTest.cs:208:4:208:5 | access to field ch |
+| GuardsStressTest.cs:208:18:208:19 | access to field ch |
+| GuardsStressTest.cs:209:4:209:5 | access to field ch |
+| GuardsStressTest.cs:209:18:209:19 | access to field ch |
+| GuardsStressTest.cs:210:4:210:5 | access to field ch |
+| GuardsStressTest.cs:211:4:211:5 | access to field ch |
+| GuardsStressTest.cs:212:4:212:5 | access to field ch |
+| GuardsStressTest.cs:213:4:213:5 | access to field ch |
+| GuardsStressTest.cs:213:18:213:19 | access to field ch |
+| GuardsStressTest.cs:214:4:214:5 | access to field ch |
+| GuardsStressTest.cs:214:18:214:19 | access to field ch |
+| GuardsStressTest.cs:215:4:215:5 | access to field ch |
+| GuardsStressTest.cs:215:18:215:19 | access to field ch |
+| GuardsStressTest.cs:216:4:216:5 | access to field ch |
+| GuardsStressTest.cs:216:18:216:19 | access to field ch |
+| GuardsStressTest.cs:217:4:217:5 | access to field ch |
+| GuardsStressTest.cs:217:18:217:19 | access to field ch |
+| GuardsStressTest.cs:218:4:218:5 | access to field ch |
+| GuardsStressTest.cs:219:4:219:5 | access to field ch |
+| GuardsStressTest.cs:219:18:219:19 | access to field ch |
+| GuardsStressTest.cs:220:4:220:5 | access to field ch |
+| GuardsStressTest.cs:220:18:220:19 | access to field ch |
+| GuardsStressTest.cs:221:4:221:5 | access to field ch |
+| GuardsStressTest.cs:221:18:221:19 | access to field ch |
+| GuardsStressTest.cs:222:4:222:5 | access to field ch |
+| GuardsStressTest.cs:223:4:223:5 | access to field ch |
+| GuardsStressTest.cs:224:4:224:5 | access to field ch |
+| GuardsStressTest.cs:224:18:224:19 | access to field ch |
+| GuardsStressTest.cs:225:4:225:5 | access to field ch |
+| GuardsStressTest.cs:225:18:225:19 | access to field ch |
+| GuardsStressTest.cs:226:4:226:5 | access to field ch |
+| GuardsStressTest.cs:226:18:226:19 | access to field ch |
+| GuardsStressTest.cs:227:4:227:5 | access to field ch |
+| GuardsStressTest.cs:227:18:227:19 | access to field ch |
+| GuardsStressTest.cs:228:4:228:5 | access to field ch |
+| GuardsStressTest.cs:229:4:229:5 | access to field ch |
+| GuardsStressTest.cs:229:18:229:19 | access to field ch |
+| GuardsStressTest.cs:230:4:230:5 | access to field ch |
+| GuardsStressTest.cs:230:18:230:19 | access to field ch |
+| GuardsStressTest.cs:231:4:231:5 | access to field ch |
+| GuardsStressTest.cs:231:18:231:19 | access to field ch |
+| GuardsStressTest.cs:232:4:232:5 | access to field ch |
+| GuardsStressTest.cs:232:18:232:19 | access to field ch |
+| GuardsStressTest.cs:233:4:233:5 | access to field ch |
+| GuardsStressTest.cs:233:18:233:19 | access to field ch |
+| GuardsStressTest.cs:234:4:234:5 | access to field ch |
+| GuardsStressTest.cs:234:18:234:19 | access to field ch |
+| GuardsStressTest.cs:235:4:235:5 | access to field ch |
+| GuardsStressTest.cs:236:4:236:5 | access to field ch |
+| GuardsStressTest.cs:236:18:236:19 | access to field ch |
+| GuardsStressTest.cs:237:4:237:5 | access to field ch |
+| GuardsStressTest.cs:237:18:237:19 | access to field ch |
+| GuardsStressTest.cs:238:4:238:5 | access to field ch |
+| GuardsStressTest.cs:238:18:238:19 | access to field ch |
+| GuardsStressTest.cs:239:4:239:5 | access to field ch |
+| GuardsStressTest.cs:239:18:239:19 | access to field ch |
+| GuardsStressTest.cs:240:4:240:5 | access to field ch |
+| GuardsStressTest.cs:240:18:240:19 | access to field ch |
+| GuardsStressTest.cs:241:4:241:5 | access to field ch |
+| GuardsStressTest.cs:241:18:241:19 | access to field ch |
+| GuardsStressTest.cs:242:4:242:5 | access to field ch |
+| GuardsStressTest.cs:242:18:242:19 | access to field ch |
+| GuardsStressTest.cs:243:4:243:5 | access to field ch |
+| GuardsStressTest.cs:243:18:243:19 | access to field ch |
+| GuardsStressTest.cs:244:4:244:5 | access to field ch |
+| GuardsStressTest.cs:244:18:244:19 | access to field ch |
+| GuardsStressTest.cs:245:4:245:5 | access to field ch |
+| GuardsStressTest.cs:245:18:245:19 | access to field ch |
+| GuardsStressTest.cs:246:4:246:5 | access to field ch |
+| GuardsStressTest.cs:246:18:246:19 | access to field ch |
+| GuardsStressTest.cs:247:4:247:5 | access to field ch |
+| GuardsStressTest.cs:247:18:247:19 | access to field ch |
+| GuardsStressTest.cs:248:4:248:5 | access to field ch |
+| GuardsStressTest.cs:248:18:248:19 | access to field ch |
+| GuardsStressTest.cs:249:4:249:5 | access to field ch |
+| GuardsStressTest.cs:249:18:249:19 | access to field ch |
+| GuardsStressTest.cs:250:4:250:5 | access to field ch |
+| GuardsStressTest.cs:250:18:250:19 | access to field ch |
+| GuardsStressTest.cs:251:4:251:5 | access to field ch |
+| GuardsStressTest.cs:251:18:251:19 | access to field ch |
+| GuardsStressTest.cs:252:4:252:5 | access to field ch |
+| GuardsStressTest.cs:252:18:252:19 | access to field ch |
+| GuardsStressTest.cs:253:4:253:5 | access to field ch |
+| GuardsStressTest.cs:253:18:253:19 | access to field ch |
+| GuardsStressTest.cs:254:4:254:5 | access to field ch |
+| GuardsStressTest.cs:254:18:254:19 | access to field ch |
+| GuardsStressTest.cs:255:4:255:5 | access to field ch |
+| GuardsStressTest.cs:255:18:255:19 | access to field ch |
+| GuardsStressTest.cs:256:4:256:5 | access to field ch |
+| GuardsStressTest.cs:256:18:256:19 | access to field ch |
+| GuardsStressTest.cs:257:4:257:5 | access to field ch |
+| GuardsStressTest.cs:258:4:258:5 | access to field ch |
+| GuardsStressTest.cs:258:18:258:19 | access to field ch |
+| GuardsStressTest.cs:259:4:259:5 | access to field ch |
+| GuardsStressTest.cs:259:18:259:19 | access to field ch |
+| GuardsStressTest.cs:260:4:260:5 | access to field ch |
+| GuardsStressTest.cs:260:18:260:19 | access to field ch |
+| GuardsStressTest.cs:261:4:261:5 | access to field ch |
+| GuardsStressTest.cs:261:18:261:19 | access to field ch |
+| GuardsStressTest.cs:262:4:262:5 | access to field ch |
+| GuardsStressTest.cs:262:18:262:19 | access to field ch |
+| GuardsStressTest.cs:263:4:263:5 | access to field ch |
+| GuardsStressTest.cs:263:18:263:19 | access to field ch |
+| GuardsStressTest.cs:264:4:264:5 | access to field ch |
+| GuardsStressTest.cs:264:18:264:19 | access to field ch |
+| GuardsStressTest.cs:265:4:265:5 | access to field ch |
+| GuardsStressTest.cs:265:18:265:19 | access to field ch |
+| GuardsStressTest.cs:266:4:266:5 | access to field ch |
+| GuardsStressTest.cs:266:18:266:19 | access to field ch |
+| GuardsStressTest.cs:267:4:267:5 | access to field ch |
+| GuardsStressTest.cs:267:18:267:19 | access to field ch |
+| GuardsStressTest.cs:268:4:268:5 | access to field ch |
+| GuardsStressTest.cs:268:18:268:19 | access to field ch |
+| GuardsStressTest.cs:269:4:269:5 | access to field ch |
+| GuardsStressTest.cs:269:18:269:19 | access to field ch |
+| GuardsStressTest.cs:270:4:270:5 | access to field ch |
+| GuardsStressTest.cs:270:18:270:19 | access to field ch |
+| GuardsStressTest.cs:271:4:271:5 | access to field ch |
+| GuardsStressTest.cs:271:18:271:19 | access to field ch |
+| GuardsStressTest.cs:272:4:272:5 | access to field ch |
+| GuardsStressTest.cs:272:18:272:19 | access to field ch |
+| GuardsStressTest.cs:273:4:273:5 | access to field ch |
+| GuardsStressTest.cs:273:18:273:19 | access to field ch |
+| GuardsStressTest.cs:274:4:274:5 | access to field ch |
+| GuardsStressTest.cs:274:18:274:19 | access to field ch |
+| GuardsStressTest.cs:275:4:275:5 | access to field ch |
+| GuardsStressTest.cs:275:18:275:19 | access to field ch |
+| GuardsStressTest.cs:276:4:276:5 | access to field ch |
+| GuardsStressTest.cs:276:18:276:19 | access to field ch |
+| GuardsStressTest.cs:277:4:277:5 | access to field ch |
+| GuardsStressTest.cs:277:18:277:19 | access to field ch |
+| GuardsStressTest.cs:278:4:278:5 | access to field ch |
+| GuardsStressTest.cs:279:4:279:5 | access to field ch |
+| GuardsStressTest.cs:279:18:279:19 | access to field ch |
+| GuardsStressTest.cs:280:4:280:5 | access to field ch |
+| GuardsStressTest.cs:280:18:280:19 | access to field ch |
+| GuardsStressTest.cs:281:4:281:5 | access to field ch |
+| GuardsStressTest.cs:281:18:281:19 | access to field ch |
+| GuardsStressTest.cs:282:4:282:5 | access to field ch |
+| GuardsStressTest.cs:282:18:282:19 | access to field ch |
+| GuardsStressTest.cs:283:4:283:5 | access to field ch |
+| GuardsStressTest.cs:283:18:283:19 | access to field ch |
+| GuardsStressTest.cs:284:4:284:5 | access to field ch |
+| GuardsStressTest.cs:284:18:284:19 | access to field ch |
+| GuardsStressTest.cs:285:4:285:5 | access to field ch |
+| GuardsStressTest.cs:285:18:285:19 | access to field ch |
+| GuardsStressTest.cs:286:4:286:5 | access to field ch |
+| GuardsStressTest.cs:286:18:286:19 | access to field ch |
+| GuardsStressTest.cs:287:4:287:5 | access to field ch |
+| GuardsStressTest.cs:287:18:287:19 | access to field ch |
+| GuardsStressTest.cs:288:4:288:5 | access to field ch |
+| GuardsStressTest.cs:288:18:288:19 | access to field ch |
+| GuardsStressTest.cs:289:4:289:5 | access to field ch |
+| GuardsStressTest.cs:289:18:289:19 | access to field ch |
+| GuardsStressTest.cs:290:4:290:5 | access to field ch |
+| GuardsStressTest.cs:290:18:290:19 | access to field ch |
+| GuardsStressTest.cs:291:4:291:5 | access to field ch |
+| GuardsStressTest.cs:291:18:291:19 | access to field ch |
+| GuardsStressTest.cs:292:4:292:5 | access to field ch |
+| GuardsStressTest.cs:292:18:292:19 | access to field ch |
+| GuardsStressTest.cs:293:4:293:5 | access to field ch |
+| GuardsStressTest.cs:293:18:293:19 | access to field ch |
+| GuardsStressTest.cs:294:4:294:5 | access to field ch |
+| GuardsStressTest.cs:295:4:295:5 | access to field ch |
+| GuardsStressTest.cs:296:4:296:5 | access to field ch |
+| GuardsStressTest.cs:297:4:297:5 | access to field ch |
+| GuardsStressTest.cs:297:18:297:19 | access to field ch |
+| GuardsStressTest.cs:298:4:298:5 | access to field ch |
+| GuardsStressTest.cs:298:18:298:19 | access to field ch |
+| GuardsStressTest.cs:299:4:299:5 | access to field ch |
+| GuardsStressTest.cs:299:18:299:19 | access to field ch |
+| GuardsStressTest.cs:300:4:300:5 | access to field ch |
+| GuardsStressTest.cs:301:4:301:5 | access to field ch |
+| GuardsStressTest.cs:301:18:301:19 | access to field ch |
+| GuardsStressTest.cs:302:4:302:5 | access to field ch |
+| GuardsStressTest.cs:302:18:302:19 | access to field ch |
+| GuardsStressTest.cs:303:4:303:5 | access to field ch |
+| GuardsStressTest.cs:303:18:303:19 | access to field ch |
+| GuardsStressTest.cs:304:4:304:5 | access to field ch |
+| GuardsStressTest.cs:304:18:304:19 | access to field ch |
+| GuardsStressTest.cs:305:4:305:5 | access to field ch |
+| GuardsStressTest.cs:305:18:305:19 | access to field ch |
+| GuardsStressTest.cs:306:4:306:5 | access to field ch |
+| GuardsStressTest.cs:306:18:306:19 | access to field ch |
+| GuardsStressTest.cs:307:4:307:5 | access to field ch |
+| GuardsStressTest.cs:307:18:307:19 | access to field ch |
+| GuardsStressTest.cs:308:4:308:5 | access to field ch |
+| GuardsStressTest.cs:308:18:308:19 | access to field ch |
+| GuardsStressTest.cs:309:4:309:5 | access to field ch |
+| GuardsStressTest.cs:309:18:309:19 | access to field ch |
+| GuardsStressTest.cs:310:4:310:5 | access to field ch |
+| GuardsStressTest.cs:311:4:311:5 | access to field ch |
+| GuardsStressTest.cs:312:4:312:5 | access to field ch |
+| GuardsStressTest.cs:313:4:313:5 | access to field ch |
+| GuardsStressTest.cs:313:18:313:19 | access to field ch |
+| GuardsStressTest.cs:314:4:314:5 | access to field ch |
+| GuardsStressTest.cs:314:18:314:19 | access to field ch |
+| GuardsStressTest.cs:315:4:315:5 | access to field ch |
+| GuardsStressTest.cs:316:4:316:5 | access to field ch |
+| GuardsStressTest.cs:316:18:316:19 | access to field ch |
+| GuardsStressTest.cs:317:4:317:5 | access to field ch |
+| GuardsStressTest.cs:318:4:318:5 | access to field ch |
+| GuardsStressTest.cs:319:4:319:5 | access to field ch |
+| GuardsStressTest.cs:319:18:319:19 | access to field ch |
+| GuardsStressTest.cs:320:4:320:5 | access to field ch |
+| GuardsStressTest.cs:321:4:321:5 | access to field ch |
+| GuardsStressTest.cs:321:18:321:19 | access to field ch |
+| GuardsStressTest.cs:322:4:322:5 | access to field ch |
+| GuardsStressTest.cs:323:4:323:5 | access to field ch |
+| GuardsStressTest.cs:324:4:324:5 | access to field ch |
+| GuardsStressTest.cs:325:4:325:5 | access to field ch |
+| GuardsStressTest.cs:325:18:325:19 | access to field ch |
+| GuardsStressTest.cs:326:4:326:5 | access to field ch |
+| GuardsStressTest.cs:326:18:326:19 | access to field ch |
+| GuardsStressTest.cs:327:4:327:5 | access to field ch |
+| GuardsStressTest.cs:327:18:327:19 | access to field ch |
+| GuardsStressTest.cs:328:4:328:5 | access to field ch |
+| GuardsStressTest.cs:328:18:328:19 | access to field ch |
+| GuardsStressTest.cs:329:4:329:5 | access to field ch |
+| GuardsStressTest.cs:330:4:330:5 | access to field ch |
+| GuardsStressTest.cs:330:18:330:19 | access to field ch |
+| GuardsStressTest.cs:331:4:331:5 | access to field ch |
+| GuardsStressTest.cs:331:19:331:20 | access to field ch |
+| GuardsStressTest.cs:332:4:332:5 | access to field ch |
+| GuardsStressTest.cs:332:19:332:20 | access to field ch |
+| GuardsStressTest.cs:333:4:333:5 | access to field ch |
+| GuardsStressTest.cs:333:19:333:20 | access to field ch |
+| GuardsStressTest.cs:334:4:334:5 | access to field ch |
+| GuardsStressTest.cs:334:19:334:20 | access to field ch |
+| GuardsStressTest.cs:335:4:335:5 | access to field ch |
+| GuardsStressTest.cs:335:19:335:20 | access to field ch |
+| GuardsStressTest.cs:336:4:336:5 | access to field ch |
+| GuardsStressTest.cs:337:4:337:5 | access to field ch |
+| GuardsStressTest.cs:338:4:338:5 | access to field ch |
+| GuardsStressTest.cs:338:19:338:20 | access to field ch |
+| GuardsStressTest.cs:339:4:339:5 | access to field ch |
+| GuardsStressTest.cs:340:4:340:5 | access to field ch |
+| GuardsStressTest.cs:340:19:340:20 | access to field ch |
+| GuardsStressTest.cs:341:4:341:5 | access to field ch |
+| GuardsStressTest.cs:341:19:341:20 | access to field ch |
+| GuardsStressTest.cs:342:4:342:5 | access to field ch |
+| GuardsStressTest.cs:342:19:342:20 | access to field ch |
+| GuardsStressTest.cs:343:4:343:5 | access to field ch |
+| GuardsStressTest.cs:343:19:343:20 | access to field ch |
+| GuardsStressTest.cs:344:4:344:5 | access to field ch |
+| GuardsStressTest.cs:344:19:344:20 | access to field ch |
+| GuardsStressTest.cs:345:4:345:5 | access to field ch |
+| GuardsStressTest.cs:345:19:345:20 | access to field ch |
+| GuardsStressTest.cs:346:4:346:5 | access to field ch |
+| GuardsStressTest.cs:346:19:346:20 | access to field ch |
+| GuardsStressTest.cs:347:4:347:5 | access to field ch |
+| GuardsStressTest.cs:347:19:347:20 | access to field ch |
+| GuardsStressTest.cs:348:4:348:5 | access to field ch |
+| GuardsStressTest.cs:348:19:348:20 | access to field ch |
+| GuardsStressTest.cs:349:4:349:5 | access to field ch |
+| GuardsStressTest.cs:349:19:349:20 | access to field ch |
+| GuardsStressTest.cs:350:4:350:5 | access to field ch |
+| GuardsStressTest.cs:351:4:351:5 | access to field ch |
+| GuardsStressTest.cs:351:19:351:20 | access to field ch |
+| GuardsStressTest.cs:352:4:352:5 | access to field ch |
+| GuardsStressTest.cs:352:19:352:20 | access to field ch |
+| GuardsStressTest.cs:353:4:353:5 | access to field ch |
+| GuardsStressTest.cs:353:19:353:20 | access to field ch |
+| GuardsStressTest.cs:354:4:354:5 | access to field ch |
+| GuardsStressTest.cs:354:19:354:20 | access to field ch |
+| GuardsStressTest.cs:355:4:355:5 | access to field ch |
+| GuardsStressTest.cs:355:19:355:20 | access to field ch |
+| GuardsStressTest.cs:356:4:356:5 | access to field ch |
+| GuardsStressTest.cs:356:19:356:20 | access to field ch |
+| GuardsStressTest.cs:357:4:357:5 | access to field ch |
+| GuardsStressTest.cs:357:19:357:20 | access to field ch |
+| GuardsStressTest.cs:358:4:358:5 | access to field ch |
+| GuardsStressTest.cs:358:19:358:20 | access to field ch |
+| GuardsStressTest.cs:359:4:359:5 | access to field ch |
+| GuardsStressTest.cs:359:19:359:20 | access to field ch |
+| GuardsStressTest.cs:360:4:360:5 | access to field ch |
+| GuardsStressTest.cs:360:19:360:20 | access to field ch |
+| GuardsStressTest.cs:361:4:361:5 | access to field ch |
+| GuardsStressTest.cs:361:19:361:20 | access to field ch |
+| GuardsStressTest.cs:362:4:362:5 | access to field ch |
+| GuardsStressTest.cs:362:19:362:20 | access to field ch |
+| GuardsStressTest.cs:363:4:363:5 | access to field ch |
+| GuardsStressTest.cs:363:19:363:20 | access to field ch |
+| GuardsStressTest.cs:364:4:364:5 | access to field ch |
+| GuardsStressTest.cs:364:19:364:20 | access to field ch |
+| GuardsStressTest.cs:365:4:365:5 | access to field ch |
+| GuardsStressTest.cs:365:19:365:20 | access to field ch |
+| GuardsStressTest.cs:366:4:366:5 | access to field ch |
+| GuardsStressTest.cs:366:19:366:20 | access to field ch |
+| GuardsStressTest.cs:367:4:367:5 | access to field ch |
+| GuardsStressTest.cs:367:19:367:20 | access to field ch |
+| GuardsStressTest.cs:368:4:368:5 | access to field ch |
+| GuardsStressTest.cs:368:19:368:20 | access to field ch |
+| GuardsStressTest.cs:369:4:369:5 | access to field ch |
+| GuardsStressTest.cs:369:19:369:20 | access to field ch |
+| GuardsStressTest.cs:370:4:370:5 | access to field ch |
+| GuardsStressTest.cs:370:19:370:20 | access to field ch |
+| GuardsStressTest.cs:371:4:371:5 | access to field ch |
+| GuardsStressTest.cs:371:19:371:20 | access to field ch |
+| GuardsStressTest.cs:372:4:372:5 | access to field ch |
+| GuardsStressTest.cs:372:19:372:20 | access to field ch |
+| GuardsStressTest.cs:373:4:373:5 | access to field ch |
+| GuardsStressTest.cs:373:19:373:20 | access to field ch |
+| GuardsStressTest.cs:374:4:374:5 | access to field ch |
+| GuardsStressTest.cs:374:19:374:20 | access to field ch |
+| GuardsStressTest.cs:375:4:375:5 | access to field ch |
+| GuardsStressTest.cs:375:19:375:20 | access to field ch |
+| GuardsStressTest.cs:376:4:376:5 | access to field ch |
+| GuardsStressTest.cs:376:19:376:20 | access to field ch |
+| GuardsStressTest.cs:377:4:377:5 | access to field ch |
+| GuardsStressTest.cs:377:19:377:20 | access to field ch |
+| GuardsStressTest.cs:378:4:378:5 | access to field ch |
+| GuardsStressTest.cs:378:19:378:20 | access to field ch |
+| GuardsStressTest.cs:379:4:379:5 | access to field ch |
+| GuardsStressTest.cs:379:19:379:20 | access to field ch |
+| GuardsStressTest.cs:380:4:380:5 | access to field ch |
+| GuardsStressTest.cs:380:19:380:20 | access to field ch |
+| GuardsStressTest.cs:381:4:381:5 | access to field ch |
+| GuardsStressTest.cs:381:19:381:20 | access to field ch |
+| GuardsStressTest.cs:382:4:382:5 | access to field ch |
+| GuardsStressTest.cs:382:19:382:20 | access to field ch |
+| GuardsStressTest.cs:383:4:383:5 | access to field ch |
+| GuardsStressTest.cs:383:19:383:20 | access to field ch |
+| GuardsStressTest.cs:384:4:384:5 | access to field ch |
+| GuardsStressTest.cs:385:4:385:5 | access to field ch |
+| GuardsStressTest.cs:385:19:385:20 | access to field ch |
+| GuardsStressTest.cs:386:4:386:5 | access to field ch |
+| GuardsStressTest.cs:386:19:386:20 | access to field ch |
+| GuardsStressTest.cs:387:4:387:5 | access to field ch |
+| GuardsStressTest.cs:387:19:387:20 | access to field ch |
+| GuardsStressTest.cs:388:4:388:5 | access to field ch |
+| GuardsStressTest.cs:388:19:388:20 | access to field ch |
+| GuardsStressTest.cs:389:4:389:5 | access to field ch |
+| GuardsStressTest.cs:389:19:389:20 | access to field ch |
+| GuardsStressTest.cs:390:4:390:5 | access to field ch |
+| GuardsStressTest.cs:390:19:390:20 | access to field ch |
+| GuardsStressTest.cs:391:4:391:5 | access to field ch |
+| GuardsStressTest.cs:391:19:391:20 | access to field ch |
+| GuardsStressTest.cs:392:4:392:5 | access to field ch |
+| GuardsStressTest.cs:392:19:392:20 | access to field ch |
+| GuardsStressTest.cs:393:4:393:5 | access to field ch |
+| GuardsStressTest.cs:393:19:393:20 | access to field ch |
+| GuardsStressTest.cs:394:4:394:5 | access to field ch |
+| GuardsStressTest.cs:394:19:394:20 | access to field ch |
+| GuardsStressTest.cs:395:4:395:5 | access to field ch |
+| GuardsStressTest.cs:395:19:395:20 | access to field ch |
+| GuardsStressTest.cs:396:4:396:5 | access to field ch |
+| GuardsStressTest.cs:396:19:396:20 | access to field ch |
+| GuardsStressTest.cs:397:4:397:5 | access to field ch |
+| GuardsStressTest.cs:397:19:397:20 | access to field ch |
+| GuardsStressTest.cs:398:4:398:5 | access to field ch |
+| GuardsStressTest.cs:398:19:398:20 | access to field ch |
+| GuardsStressTest.cs:399:4:399:5 | access to field ch |
+| GuardsStressTest.cs:399:19:399:20 | access to field ch |
+| GuardsStressTest.cs:400:4:400:5 | access to field ch |
+| GuardsStressTest.cs:400:19:400:20 | access to field ch |
+| GuardsStressTest.cs:401:4:401:5 | access to field ch |
+| GuardsStressTest.cs:401:19:401:20 | access to field ch |
+| GuardsStressTest.cs:402:4:402:5 | access to field ch |
+| GuardsStressTest.cs:402:19:402:20 | access to field ch |
+| GuardsStressTest.cs:403:4:403:5 | access to field ch |
+| GuardsStressTest.cs:403:19:403:20 | access to field ch |
+| GuardsStressTest.cs:404:4:404:5 | access to field ch |
+| GuardsStressTest.cs:404:19:404:20 | access to field ch |
+| GuardsStressTest.cs:405:4:405:5 | access to field ch |
+| GuardsStressTest.cs:405:19:405:20 | access to field ch |
+| GuardsStressTest.cs:406:4:406:5 | access to field ch |
+| GuardsStressTest.cs:406:19:406:20 | access to field ch |
+| GuardsStressTest.cs:407:4:407:5 | access to field ch |
+| GuardsStressTest.cs:407:19:407:20 | access to field ch |
+| GuardsStressTest.cs:408:4:408:5 | access to field ch |
+| GuardsStressTest.cs:408:19:408:20 | access to field ch |
+| GuardsStressTest.cs:409:4:409:5 | access to field ch |
+| GuardsStressTest.cs:409:19:409:20 | access to field ch |
+| GuardsStressTest.cs:410:4:410:5 | access to field ch |
+| GuardsStressTest.cs:410:19:410:20 | access to field ch |
+| GuardsStressTest.cs:411:4:411:5 | access to field ch |
+| GuardsStressTest.cs:411:19:411:20 | access to field ch |
+| GuardsStressTest.cs:412:4:412:5 | access to field ch |
+| GuardsStressTest.cs:412:19:412:20 | access to field ch |
+| GuardsStressTest.cs:413:4:413:5 | access to field ch |
+| GuardsStressTest.cs:413:19:413:20 | access to field ch |
+| GuardsStressTest.cs:414:4:414:5 | access to field ch |
+| GuardsStressTest.cs:414:19:414:20 | access to field ch |
+| GuardsStressTest.cs:415:4:415:5 | access to field ch |
+| GuardsStressTest.cs:415:19:415:20 | access to field ch |
+| GuardsStressTest.cs:416:4:416:5 | access to field ch |
+| GuardsStressTest.cs:416:19:416:20 | access to field ch |
+| GuardsStressTest.cs:417:4:417:5 | access to field ch |
+| GuardsStressTest.cs:418:4:418:5 | access to field ch |
+| GuardsStressTest.cs:418:19:418:20 | access to field ch |
+| GuardsStressTest.cs:419:4:419:5 | access to field ch |
+| GuardsStressTest.cs:419:19:419:20 | access to field ch |
+| GuardsStressTest.cs:420:4:420:5 | access to field ch |
+| GuardsStressTest.cs:420:19:420:20 | access to field ch |
+| GuardsStressTest.cs:421:4:421:5 | access to field ch |
+| GuardsStressTest.cs:421:19:421:20 | access to field ch |
+| GuardsStressTest.cs:422:4:422:5 | access to field ch |
+| GuardsStressTest.cs:422:19:422:20 | access to field ch |
+| GuardsStressTest.cs:423:4:423:5 | access to field ch |
+| GuardsStressTest.cs:423:19:423:20 | access to field ch |
+| GuardsStressTest.cs:424:4:424:5 | access to field ch |
+| GuardsStressTest.cs:424:19:424:20 | access to field ch |
+| GuardsStressTest.cs:425:4:425:5 | access to field ch |
+| GuardsStressTest.cs:425:19:425:20 | access to field ch |
+| GuardsStressTest.cs:426:4:426:5 | access to field ch |
+| GuardsStressTest.cs:426:19:426:20 | access to field ch |
+| GuardsStressTest.cs:427:4:427:5 | access to field ch |
+| GuardsStressTest.cs:427:19:427:20 | access to field ch |
+| GuardsStressTest.cs:428:4:428:5 | access to field ch |
+| GuardsStressTest.cs:428:19:428:20 | access to field ch |
+| GuardsStressTest.cs:429:4:429:5 | access to field ch |
+| GuardsStressTest.cs:429:19:429:20 | access to field ch |
+| GuardsStressTest.cs:430:4:430:5 | access to field ch |
+| GuardsStressTest.cs:430:19:430:20 | access to field ch |
+| GuardsStressTest.cs:431:4:431:5 | access to field ch |
+| GuardsStressTest.cs:431:19:431:20 | access to field ch |
+| GuardsStressTest.cs:432:4:432:5 | access to field ch |
+| GuardsStressTest.cs:432:19:432:20 | access to field ch |
+| GuardsStressTest.cs:433:4:433:5 | access to field ch |
+| GuardsStressTest.cs:434:4:434:5 | access to field ch |
+| GuardsStressTest.cs:434:19:434:20 | access to field ch |
+| GuardsStressTest.cs:435:4:435:5 | access to field ch |
+| GuardsStressTest.cs:435:19:435:20 | access to field ch |
+| GuardsStressTest.cs:436:4:436:5 | access to field ch |
+| GuardsStressTest.cs:436:19:436:20 | access to field ch |
+| GuardsStressTest.cs:437:4:437:5 | access to field ch |
+| GuardsStressTest.cs:437:19:437:20 | access to field ch |
+| GuardsStressTest.cs:438:4:438:5 | access to field ch |
+| GuardsStressTest.cs:438:19:438:20 | access to field ch |
+| GuardsStressTest.cs:439:4:439:5 | access to field ch |
+| GuardsStressTest.cs:439:19:439:20 | access to field ch |
+| GuardsStressTest.cs:439:41:439:42 | access to field ch |
+| GuardsStressTest.cs:440:23:440:24 | access to field ch |
diff --git a/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.ql b/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.ql
new file mode 100644
index 000000000000..dbb472735b4d
--- /dev/null
+++ b/csharp/ql/test/library-tests/controlflow/guards-large/GuardedExpr.ql
@@ -0,0 +1,5 @@
+import csharp
+import semmle.code.csharp.controlflow.Guards
+
+from GuardedExpr ge
+select ge
diff --git a/csharp/ql/test/library-tests/controlflow/guards-large/GuardsStressTest.cs b/csharp/ql/test/library-tests/controlflow/guards-large/GuardsStressTest.cs
new file mode 100644
index 000000000000..200c51d89fd3
--- /dev/null
+++ b/csharp/ql/test/library-tests/controlflow/guards-large/GuardsStressTest.cs
@@ -0,0 +1,443 @@
+using System;
+#nullable enable
+public class StressTest
+{
+    int ch;
+    int Ors()
+    {
+        if (ch >= '0' && ch <= '9'
+|| ch >= 'A' && ch <= 'Z'
+|| ch == '_'
+|| ch >= 'a' && ch <= 'z'
+|| ch == 170
+|| ch == 181
+|| ch == 186
+|| ch >= 192 && ch <= 214
+|| ch >= 216 && ch <= 246
+|| ch >= 248 && ch <= 705
+|| ch >= 710 && ch <= 721
+|| ch >= 736 && ch <= 740
+|| ch == 748
+|| ch == 750
+|| ch >= 768 && ch <= 884
+|| ch >= 886 && ch <= 887
+|| ch >= 890 && ch <= 893
+|| ch == 902
+|| ch >= 904 && ch <= 906
+|| ch == 908
+|| ch >= 910 && ch <= 929
+|| ch >= 931 && ch <= 1013
+|| ch >= 1015 && ch <= 1153
+|| ch >= 1155 && ch <= 1159
+|| ch >= 1162 && ch <= 1319
+|| ch >= 1329 && ch <= 1366
+|| ch == 1369
+|| ch >= 1377 && ch <= 1415
+|| ch >= 1425 && ch <= 1469
+|| ch == 1471
+|| ch >= 1473 && ch <= 1474
+|| ch >= 1476 && ch <= 1477
+|| ch == 1479
+|| ch >= 1488 && ch <= 1514
+|| ch >= 1520 && ch <= 1522
+|| ch >= 1552 && ch <= 1562
+|| ch >= 1568 && ch <= 1641
+|| ch >= 1646 && ch <= 1747
+|| ch >= 1749 && ch <= 1756
+|| ch >= 1759 && ch <= 1768
+|| ch >= 1770 && ch <= 1788
+|| ch == 1791
+|| ch >= 1808 && ch <= 1866
+|| ch >= 1869 && ch <= 1969
+|| ch >= 1984 && ch <= 2037
+|| ch == 2042
+|| ch >= 2048 && ch <= 2093
+|| ch >= 2112 && ch <= 2139
+|| ch == 2208
+|| ch >= 2210 && ch <= 2220
+|| ch >= 2276 && ch <= 2302
+|| ch >= 2304 && ch <= 2403
+|| ch >= 2406 && ch <= 2415
+|| ch >= 2417 && ch <= 2423
+|| ch >= 2425 && ch <= 2431
+|| ch >= 2433 && ch <= 2435
+|| ch >= 2437 && ch <= 2444
+|| ch >= 2447 && ch <= 2448
+|| ch >= 2451 && ch <= 2472
+|| ch >= 2474 && ch <= 2480
+|| ch == 2482
+|| ch >= 2486 && ch <= 2489
+|| ch >= 2492 && ch <= 2500
+|| ch >= 2503 && ch <= 2504
+|| ch >= 2507 && ch <= 2510
+|| ch == 2519
+|| ch >= 2524 && ch <= 2525
+|| ch >= 2527 && ch <= 2531
+|| ch >= 2534 && ch <= 2545
+|| ch >= 2561 && ch <= 2563
+|| ch >= 2565 && ch <= 2570
+|| ch >= 2575 && ch <= 2576
+|| ch >= 2579 && ch <= 2600
+|| ch >= 2602 && ch <= 2608
+|| ch >= 2610 && ch <= 2611
+|| ch >= 2613 && ch <= 2614
+|| ch >= 2616 && ch <= 2617
+|| ch == 2620
+|| ch >= 2622 && ch <= 2626
+|| ch >= 2631 && ch <= 2632
+|| ch >= 2635 && ch <= 2637
+|| ch == 2641
+|| ch >= 2649 && ch <= 2652
+|| ch == 2654
+|| ch >= 2662 && ch <= 2677
+|| ch >= 2689 && ch <= 2691
+|| ch >= 2693 && ch <= 2701
+|| ch >= 2703 && ch <= 2705
+|| ch >= 2707 && ch <= 2728
+|| ch >= 2730 && ch <= 2736
+|| ch >= 2738 && ch <= 2739
+|| ch >= 2741 && ch <= 2745
+|| ch >= 2748 && ch <= 2757
+|| ch >= 2759 && ch <= 2761
+|| ch >= 2763 && ch <= 2765
+|| ch == 2768
+|| ch >= 2784 && ch <= 2787
+|| ch >= 2790 && ch <= 2799
+|| ch >= 2817 && ch <= 2819
+|| ch >= 2821 && ch <= 2828
+|| ch >= 2831 && ch <= 2832
+|| ch >= 2835 && ch <= 2856
+|| ch >= 2858 && ch <= 2864
+|| ch >= 2866 && ch <= 2867
+|| ch >= 2869 && ch <= 2873
+|| ch >= 2876 && ch <= 2884
+|| ch >= 2887 && ch <= 2888
+|| ch >= 2891 && ch <= 2893
+|| ch >= 2902 && ch <= 2903
+|| ch >= 2908 && ch <= 2909
+|| ch >= 2911 && ch <= 2915
+|| ch >= 2918 && ch <= 2927
+|| ch == 2929
+|| ch >= 2946 && ch <= 2947
+|| ch >= 2949 && ch <= 2954
+|| ch >= 2958 && ch <= 2960
+|| ch >= 2962 && ch <= 2965
+|| ch >= 2969 && ch <= 2970
+|| ch == 2972
+|| ch >= 2974 && ch <= 2975
+|| ch >= 2979 && ch <= 2980
+|| ch >= 2984 && ch <= 2986
+|| ch >= 2990 && ch <= 3001
+|| ch >= 3006 && ch <= 3010
+|| ch >= 3014 && ch <= 3016
+|| ch >= 3018 && ch <= 3021
+|| ch == 3024
+|| ch == 3031
+|| ch >= 3046 && ch <= 3055
+|| ch >= 3073 && ch <= 3075
+|| ch >= 3077 && ch <= 3084
+|| ch >= 3086 && ch <= 3088
+|| ch >= 3090 && ch <= 3112
+|| ch >= 3114 && ch <= 3123
+|| ch >= 3125 && ch <= 3129
+|| ch >= 3133 && ch <= 3140
+|| ch >= 3142 && ch <= 3144
+|| ch >= 3146 && ch <= 3149
+|| ch >= 3157 && ch <= 3158
+|| ch >= 3160 && ch <= 3161
+|| ch >= 3168 && ch <= 3171
+|| ch >= 3174 && ch <= 3183
+|| ch >= 3202 && ch <= 3203
+|| ch >= 3205 && ch <= 3212
+|| ch >= 3214 && ch <= 3216
+|| ch >= 3218 && ch <= 3240
+|| ch >= 3242 && ch <= 3251
+|| ch >= 3253 && ch <= 3257
+|| ch >= 3260 && ch <= 3268
+|| ch >= 3270 && ch <= 3272
+|| ch >= 3274 && ch <= 3277
+|| ch >= 3285 && ch <= 3286
+|| ch == 3294
+|| ch >= 3296 && ch <= 3299
+|| ch >= 3302 && ch <= 3311
+|| ch >= 3313 && ch <= 3314
+|| ch >= 3330 && ch <= 3331
+|| ch >= 3333 && ch <= 3340
+|| ch >= 3342 && ch <= 3344
+|| ch >= 3346 && ch <= 3386
+|| ch >= 3389 && ch <= 3396
+|| ch >= 3398 && ch <= 3400
+|| ch >= 3402 && ch <= 3406
+|| ch == 3415
+|| ch >= 3424 && ch <= 3427
+|| ch >= 3430 && ch <= 3439
+|| ch >= 3450 && ch <= 3455
+|| ch >= 3458 && ch <= 3459
+|| ch >= 3461 && ch <= 3478
+|| ch >= 3482 && ch <= 3505
+|| ch >= 3507 && ch <= 3515
+|| ch == 3517
+|| ch >= 3520 && ch <= 3526
+|| ch == 3530
+|| ch >= 3535 && ch <= 3540
+|| ch == 3542
+|| ch >= 3544 && ch <= 3551
+|| ch >= 3570 && ch <= 3571
+|| ch >= 3585 && ch <= 3642
+|| ch >= 3648 && ch <= 3662
+|| ch >= 3664 && ch <= 3673
+|| ch >= 3713 && ch <= 3714
+|| ch == 3716
+|| ch >= 3719 && ch <= 3720
+|| ch == 3722
+|| ch == 3725
+|| ch >= 3732 && ch <= 3735
+|| ch >= 3737 && ch <= 3743
+|| ch >= 3745 && ch <= 3747
+|| ch == 3749
+|| ch == 3751
+|| ch >= 3754 && ch <= 3755
+|| ch >= 3757 && ch <= 3769
+|| ch >= 3771 && ch <= 3773
+|| ch >= 3776 && ch <= 3780
+|| ch == 3782
+|| ch >= 3784 && ch <= 3789
+|| ch >= 3792 && ch <= 3801
+|| ch >= 3804 && ch <= 3807
+|| ch == 3840
+|| ch >= 3864 && ch <= 3865
+|| ch >= 3872 && ch <= 3881
+|| ch == 3893
+|| ch == 3895
+|| ch == 3897
+|| ch >= 3902 && ch <= 3911
+|| ch >= 3913 && ch <= 3948
+|| ch >= 3953 && ch <= 3972
+|| ch >= 3974 && ch <= 3991
+|| ch >= 3993 && ch <= 4028
+|| ch == 4038
+|| ch >= 4096 && ch <= 4169
+|| ch >= 4176 && ch <= 4253
+|| ch >= 4256 && ch <= 4293
+|| ch == 4295
+|| ch == 4301
+|| ch >= 4304 && ch <= 4346
+|| ch >= 4348 && ch <= 4680
+|| ch >= 4682 && ch <= 4685
+|| ch >= 4688 && ch <= 4694
+|| ch == 4696
+|| ch >= 4698 && ch <= 4701
+|| ch >= 4704 && ch <= 4744
+|| ch >= 4746 && ch <= 4749
+|| ch >= 4752 && ch <= 4784
+|| ch >= 4786 && ch <= 4789
+|| ch >= 4792 && ch <= 4798
+|| ch == 4800
+|| ch >= 4802 && ch <= 4805
+|| ch >= 4808 && ch <= 4822
+|| ch >= 4824 && ch <= 4880
+|| ch >= 4882 && ch <= 4885
+|| ch >= 4888 && ch <= 4954
+|| ch >= 4957 && ch <= 4959
+|| ch >= 4992 && ch <= 5007
+|| ch >= 5024 && ch <= 5108
+|| ch >= 5121 && ch <= 5740
+|| ch >= 5743 && ch <= 5759
+|| ch >= 5761 && ch <= 5786
+|| ch >= 5792 && ch <= 5866
+|| ch >= 5870 && ch <= 5872
+|| ch >= 5888 && ch <= 5900
+|| ch >= 5902 && ch <= 5908
+|| ch >= 5920 && ch <= 5940
+|| ch >= 5952 && ch <= 5971
+|| ch >= 5984 && ch <= 5996
+|| ch >= 5998 && ch <= 6000
+|| ch >= 6002 && ch <= 6003
+|| ch >= 6016 && ch <= 6099
+|| ch == 6103
+|| ch >= 6108 && ch <= 6109
+|| ch >= 6112 && ch <= 6121
+|| ch >= 6155 && ch <= 6157
+|| ch >= 6160 && ch <= 6169
+|| ch >= 6176 && ch <= 6263
+|| ch >= 6272 && ch <= 6314
+|| ch >= 6320 && ch <= 6389
+|| ch >= 6400 && ch <= 6428
+|| ch >= 6432 && ch <= 6443
+|| ch >= 6448 && ch <= 6459
+|| ch >= 6470 && ch <= 6509
+|| ch >= 6512 && ch <= 6516
+|| ch >= 6528 && ch <= 6571
+|| ch >= 6576 && ch <= 6601
+|| ch >= 6608 && ch <= 6617
+|| ch >= 6656 && ch <= 6683
+|| ch >= 6688 && ch <= 6750
+|| ch >= 6752 && ch <= 6780
+|| ch >= 6783 && ch <= 6793
+|| ch >= 6800 && ch <= 6809
+|| ch == 6823
+|| ch >= 6912 && ch <= 6987
+|| ch >= 6992 && ch <= 7001
+|| ch >= 7019 && ch <= 7027
+|| ch >= 7040 && ch <= 7155
+|| ch >= 7168 && ch <= 7223
+|| ch >= 7232 && ch <= 7241
+|| ch >= 7245 && ch <= 7293
+|| ch >= 7376 && ch <= 7378
+|| ch >= 7380 && ch <= 7414
+|| ch >= 7424 && ch <= 7654
+|| ch >= 7676 && ch <= 7957
+|| ch >= 7960 && ch <= 7965
+|| ch >= 7968 && ch <= 8005
+|| ch >= 8008 && ch <= 8013
+|| ch >= 8016 && ch <= 8023
+|| ch == 8025
+|| ch == 8027
+|| ch == 8029
+|| ch >= 8031 && ch <= 8061
+|| ch >= 8064 && ch <= 8116
+|| ch >= 8118 && ch <= 8124
+|| ch == 8126
+|| ch >= 8130 && ch <= 8132
+|| ch >= 8134 && ch <= 8140
+|| ch >= 8144 && ch <= 8147
+|| ch >= 8150 && ch <= 8155
+|| ch >= 8160 && ch <= 8172
+|| ch >= 8178 && ch <= 8180
+|| ch >= 8182 && ch <= 8188
+|| ch >= 8204 && ch <= 8205
+|| ch >= 8255 && ch <= 8256
+|| ch == 8276
+|| ch == 8305
+|| ch == 8319
+|| ch >= 8336 && ch <= 8348
+|| ch >= 8400 && ch <= 8412
+|| ch == 8417
+|| ch >= 8421 && ch <= 8432
+|| ch == 8450
+|| ch == 8455
+|| ch >= 8458 && ch <= 8467
+|| ch == 8469
+|| ch >= 8473 && ch <= 8477
+|| ch == 8484
+|| ch == 8486
+|| ch == 8488
+|| ch >= 8490 && ch <= 8493
+|| ch >= 8495 && ch <= 8505
+|| ch >= 8508 && ch <= 8511
+|| ch >= 8517 && ch <= 8521
+|| ch == 8526
+|| ch >= 8544 && ch <= 8584
+|| ch >= 11264 && ch <= 11310
+|| ch >= 11312 && ch <= 11358
+|| ch >= 11360 && ch <= 11492
+|| ch >= 11499 && ch <= 11507
+|| ch >= 11520 && ch <= 11557
+|| ch == 11559
+|| ch == 11565
+|| ch >= 11568 && ch <= 11623
+|| ch == 11631
+|| ch >= 11647 && ch <= 11670
+|| ch >= 11680 && ch <= 11686
+|| ch >= 11688 && ch <= 11694
+|| ch >= 11696 && ch <= 11702
+|| ch >= 11704 && ch <= 11710
+|| ch >= 11712 && ch <= 11718
+|| ch >= 11720 && ch <= 11726
+|| ch >= 11728 && ch <= 11734
+|| ch >= 11736 && ch <= 11742
+|| ch >= 11744 && ch <= 11775
+|| ch == 11823
+|| ch >= 12293 && ch <= 12295
+|| ch >= 12321 && ch <= 12335
+|| ch >= 12337 && ch <= 12341
+|| ch >= 12344 && ch <= 12348
+|| ch >= 12353 && ch <= 12438
+|| ch >= 12441 && ch <= 12442
+|| ch >= 12445 && ch <= 12447
+|| ch >= 12449 && ch <= 12538
+|| ch >= 12540 && ch <= 12543
+|| ch >= 12549 && ch <= 12589
+|| ch >= 12593 && ch <= 12686
+|| ch >= 12704 && ch <= 12730
+|| ch >= 12784 && ch <= 12799
+|| ch >= 13312 && ch <= 19893
+|| ch >= 19968 && ch <= 40908
+|| ch >= 40960 && ch <= 42124
+|| ch >= 42192 && ch <= 42237
+|| ch >= 42240 && ch <= 42508
+|| ch >= 42512 && ch <= 42539
+|| ch >= 42560 && ch <= 42607
+|| ch >= 42612 && ch <= 42621
+|| ch >= 42623 && ch <= 42647
+|| ch >= 42655 && ch <= 42737
+|| ch >= 42775 && ch <= 42783
+|| ch >= 42786 && ch <= 42888
+|| ch >= 42891 && ch <= 42894
+|| ch >= 42896 && ch <= 42899
+|| ch >= 42912 && ch <= 42922
+|| ch >= 43000 && ch <= 43047
+|| ch >= 43072 && ch <= 43123
+|| ch >= 43136 && ch <= 43204
+|| ch >= 43216 && ch <= 43225
+|| ch >= 43232 && ch <= 43255
+|| ch == 43259
+|| ch >= 43264 && ch <= 43309
+|| ch >= 43312 && ch <= 43347
+|| ch >= 43360 && ch <= 43388
+|| ch >= 43392 && ch <= 43456
+|| ch >= 43471 && ch <= 43481
+|| ch >= 43520 && ch <= 43574
+|| ch >= 43584 && ch <= 43597
+|| ch >= 43600 && ch <= 43609
+|| ch >= 43616 && ch <= 43638
+|| ch >= 43642 && ch <= 43643
+|| ch >= 43648 && ch <= 43714
+|| ch >= 43739 && ch <= 43741
+|| ch >= 43744 && ch <= 43759
+|| ch >= 43762 && ch <= 43766
+|| ch >= 43777 && ch <= 43782
+|| ch >= 43785 && ch <= 43790
+|| ch >= 43793 && ch <= 43798
+|| ch >= 43808 && ch <= 43814
+|| ch >= 43816 && ch <= 43822
+|| ch >= 43968 && ch <= 44010
+|| ch >= 44012 && ch <= 44013
+|| ch >= 44016 && ch <= 44025
+|| ch >= 44032 && ch <= 55203
+|| ch >= 55216 && ch <= 55238
+|| ch >= 55243 && ch <= 55291
+|| ch >= 63744 && ch <= 64109
+|| ch >= 64112 && ch <= 64217
+|| ch >= 64256 && ch <= 64262
+|| ch >= 64275 && ch <= 64279
+|| ch >= 64285 && ch <= 64296
+|| ch >= 64298 && ch <= 64310
+|| ch >= 64312 && ch <= 64316
+|| ch == 64318
+|| ch >= 64320 && ch <= 64321
+|| ch >= 64323 && ch <= 64324
+|| ch >= 64326 && ch <= 64433
+|| ch >= 64467 && ch <= 64829
+|| ch >= 64848 && ch <= 64911
+|| ch >= 64914 && ch <= 64967
+|| ch >= 65008 && ch <= 65019
+|| ch >= 65024 && ch <= 65039
+|| ch >= 65056 && ch <= 65062
+|| ch >= 65075 && ch <= 65076
+|| ch >= 65101 && ch <= 65103
+|| ch >= 65136 && ch <= 65140
+|| ch >= 65142 && ch <= 65276
+|| ch >= 65296 && ch <= 65305
+|| ch >= 65313 && ch <= 65338
+|| ch == 65343
+|| ch >= 65345 && ch <= 65370
+|| ch >= 65382 && ch <= 65470
+|| ch >= 65474 && ch <= 65479
+|| ch >= 65482 && ch <= 65487
+|| ch >= 65490 && ch <= 65495
+|| ch >= 65498 && ch <= 65500) { return ch; }
+        else { return ch + 1; }
+    }
+}
+

From e6077127bec3ac49144fe78a4d5eef384b14b254 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 23 Apr 2021 11:06:48 +0200
Subject: [PATCH 402/433] C++: Only unary and binary arithmetic operations and
 left shifts are now      reported as overflowing when we cannot analyze them.

---
 .../cpp/rangeanalysis/SimpleRangeAnalysis.qll | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
index d22a7f96a45f..2afe26bc3e0e 100644
--- a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -1617,6 +1617,18 @@ private module SimpleRangeAnalysisCached {
     defMightOverflowPositively(def, v)
   }
 
+  /**
+   * Holds if `e` is an expression where the concept of overflow makes sense.
+   * This predicate is used to filter out some of the unanalyzable expressions
+   * from `exprMightOverflowPositively` and `exprMightOverflowNegatively`.
+   */
+  pragma[inline]
+  private predicate exprThatCanOverflow(Expr e) {
+    e instanceof UnaryArithmeticOperation or
+    e instanceof BinaryArithmeticOperation or
+    e instanceof LShiftExpr
+  }
+
   /**
    * Holds if the expression might overflow negatively. This predicate
    * does not consider the possibility that the expression might overflow
@@ -1631,8 +1643,10 @@ private module SimpleRangeAnalysisCached {
     // detecting whether it might overflow.
     getLowerBoundsImpl(expr.(PostfixDecrExpr)) = exprMinVal(expr)
     or
-    // Expressions we cannot analyze could potentially overflow
-    not analyzableExpr(expr)
+    // We can't conclude that any unanalyzable expression might overflow. This
+    // is because there are many expressions that the range analysis doesn't
+    // handle, but where the concept of overflow doesn't make sense.
+    exprThatCanOverflow(expr) and not analyzableExpr(expr)
   }
 
   /**
@@ -1661,8 +1675,10 @@ private module SimpleRangeAnalysisCached {
     // detecting whether it might overflow.
     getUpperBoundsImpl(expr.(PostfixIncrExpr)) = exprMaxVal(expr)
     or
-    // Expressions we cannot analyze could potentially overflow
-    not analyzableExpr(expr)
+    // We can't conclude that any unanalyzable expression might overflow. This
+    // is because there are many expressions that the range analysis doesn't
+    // handle, but where the concept of overflow doesn't make sense.
+    exprThatCanOverflow(expr) and not analyzableExpr(expr)
   }
 
   /**

From e3f10c0e32f0d5659c594cf53fc19042d1fa58d4 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 23 Apr 2021 13:37:42 +0200
Subject: [PATCH 403/433] Cleanup DiagnosticError classes

---
 .../Diagnostics/DiagnosticExtractionErrors.ql | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
index f19fcc6416ac..91ed4a7b8838 100644
--- a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
+++ b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -14,12 +14,16 @@ private newtype TDiagnosticError =
   TExtractorError(ExtractorError e)
 
 abstract private class DiagnosticError extends TDiagnosticError {
-  string getMessage() { none() }
+  abstract string getMessage();
 
-  string toString() { none() }
+  abstract string toString();
 
-  string getLocation(Location l) {
-    if l.getFile().fromSource() then result = " in " + l.getFile() else result = ""
+  abstract Location getLocation();
+
+  string getLocationMessage() {
+    if getLocation().getFile().fromSource()
+    then result = " in " + getLocation().getFile()
+    else result = ""
   }
 }
 
@@ -29,10 +33,12 @@ private class DiagnosticCompilerError extends DiagnosticError {
   DiagnosticCompilerError() { this = TCompilerError(c) }
 
   override string getMessage() {
-    result = "Compiler error" + getLocation(c.getLocation()) + ": " + c.getMessage()
+    result = "Compiler error" + this.getLocationMessage() + ": " + c.getMessage()
   }
 
   override string toString() { result = c.toString() }
+
+  override Location getLocation() { result = c.getLocation() }
 }
 
 private class DiagnosticExtractorError extends DiagnosticError {
@@ -45,10 +51,12 @@ private class DiagnosticExtractorError extends DiagnosticError {
 
   override string getMessage() {
     result =
-      "Unexpected " + e.getOrigin() + " error" + getLocation(e.getLocation()) + ": " + e.getText()
+      "Unexpected " + e.getOrigin() + " error" + this.getLocationMessage() + ": " + e.getText()
   }
 
   override string toString() { result = e.toString() }
+
+  override Location getLocation() { result = e.getLocation() }
 }
 
 from DiagnosticError error

From b4bd7af9c86a5f89095ee033574753bf46b8dae2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 23 Apr 2021 13:40:12 +0200
Subject: [PATCH 404/433] Add change note

---
 csharp/change-notes/2021-04-23-model-error-extraction.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 csharp/change-notes/2021-04-23-model-error-extraction.md

diff --git a/csharp/change-notes/2021-04-23-model-error-extraction.md b/csharp/change-notes/2021-04-23-model-error-extraction.md
new file mode 100644
index 000000000000..7ac878442984
--- /dev/null
+++ b/csharp/change-notes/2021-04-23-model-error-extraction.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Program model errors are now extracted in standalone extraction.
\ No newline at end of file

From 819be43ce719f2aaa109d8bb3c23c25b44a92fc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tam=C3=A1s=20Vajk?= <tamasvajk@github.com>
Date: Fri, 23 Apr 2021 13:41:59 +0200
Subject: [PATCH 405/433] Fix alphabetical order of supported frameworks

---
 docs/codeql/support/reusables/frameworks.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/codeql/support/reusables/frameworks.rst b/docs/codeql/support/reusables/frameworks.rst
index 2dfebad49194..7266aa4b0284 100644
--- a/docs/codeql/support/reusables/frameworks.rst
+++ b/docs/codeql/support/reusables/frameworks.rst
@@ -23,12 +23,12 @@ C# built-in support
    ASP.NET, Web application framework
    ASP.NET Core, Web application framework
    ASP.NET Razor templates, Web application framework
+   Dapper, Database ORM
    EntityFramework, Database ORM
    EntityFramework Core, Database ORM
    Json.NET, Serialization
    NHibernate, Database ORM
    WinForms, User interface
-   Dapper, Database ORM
 
 Go built-in support
 ================================

From 1b4c3c7415598a422e1d9093461529149bcb33a6 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 23 Apr 2021 13:44:34 +0200
Subject: [PATCH 406/433] Fix code review findings

---
 .../code/csharp/security/dataflow/flowsources/Local.qll     | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
index b1b0bf8df850..4c7f70921d90 100644
--- a/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
+++ b/csharp/ql/src/semmle/code/csharp/security/dataflow/flowsources/Local.qll
@@ -26,11 +26,9 @@ class SystemConsoleReadSource extends LocalUserInputSource {
   SystemConsoleReadSource() {
     this.asExpr() =
       any(MethodCall call |
-        call.getTarget().hasQualifiedName("System.Console", "ReadLine") or
-        call.getTarget().hasQualifiedName("System.Console", "Read") or
-        call.getTarget().hasQualifiedName("System.Console", "ReadKey")
+        call.getTarget().hasQualifiedName("System.Console", ["ReadLine", "Read", "ReadKey"])
       )
   }
 
-  override string getSourceType() { result = "TextBox text" }
+  override string getSourceType() { result = "System.Console input" }
 }

From 3cf4f1f95634401c64dfcadafa9aa4dd1149799e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 23 Apr 2021 16:00:23 +0200
Subject: [PATCH 407/433] C++: Accept test changes.

---
 .../CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
index e71cacde76ce..e2b696ba0c05 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
@@ -12,5 +12,6 @@
 | test6.cpp:16:15:16:15 | s | $@ flows to here and is used in an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value |
 | test6.cpp:30:16:30:16 | s | $@ flows to here and is used in an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value |
 | test.c:14:15:14:35 | ... * ... | $@ flows to here and is used in an expression which might overflow. | test.c:11:29:11:32 | argv | User-provided value |
+| test.c:25:5:25:9 | ... ++ | $@ flows to here and is used in an expression which might overflow. | test.c:23:15:23:18 | argv | User-provided value |
 | test.c:44:7:44:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:41:17:41:20 | argv | User-provided value |
 | test.c:54:7:54:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:51:17:51:20 | argv | User-provided value |

From 86822f6c6161dc22f369a1de8caadb82d3530c38 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 23 Apr 2021 16:01:53 +0200
Subject: [PATCH 408/433] C++: Exclude pointer results from
 cpp/integer-overflow-tainted.

---
 cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql        | 1 +
 .../CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected   | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql
index 0adb600dbda6..7a7aa716e8a7 100644
--- a/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql
@@ -28,6 +28,7 @@ predicate outOfBoundsExpr(Expr expr, string kind) {
 
 from Expr use, Expr origin, string kind
 where
+  not use.getUnspecifiedType() instanceof PointerType and
   outOfBoundsExpr(use, kind) and
   tainted(origin, use) and
   origin != use and
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
index e2b696ba0c05..e71cacde76ce 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
@@ -12,6 +12,5 @@
 | test6.cpp:16:15:16:15 | s | $@ flows to here and is used in an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value |
 | test6.cpp:30:16:30:16 | s | $@ flows to here and is used in an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value |
 | test.c:14:15:14:35 | ... * ... | $@ flows to here and is used in an expression which might overflow. | test.c:11:29:11:32 | argv | User-provided value |
-| test.c:25:5:25:9 | ... ++ | $@ flows to here and is used in an expression which might overflow. | test.c:23:15:23:18 | argv | User-provided value |
 | test.c:44:7:44:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:41:17:41:20 | argv | User-provided value |
 | test.c:54:7:54:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:51:17:51:20 | argv | User-provided value |

From 004450b201d63afa55ad25aa4e4ebd9e9edfd731 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 23 Apr 2021 15:49:39 +0200
Subject: [PATCH 409/433] C#: Add missing `StringBuilder` flow summaries

---
 .../csharp/dataflow/LibraryTypeDataFlow.qll   | 32 +++++---
 .../dataflow/library/FlowSummaries.expected   | 77 +++++++++++++------
 .../dataflow/local/DataFlowStep.expected      |  2 +
 .../dataflow/local/TaintTrackingStep.expected |  4 +-
 4 files changed, 79 insertions(+), 36 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
index 5798080a98ab..32f22b979148 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
@@ -807,17 +807,29 @@ class SystemTextStringBuilderFlow extends LibraryTypeDataFlow, SystemTextStringB
       sinkAp = AccessPath::empty() and
       preservesValue = false
       or
-      exists(int i, Type t |
-        name.regexpMatch("Append(Format|Line)?") and
-        t = m.getParameter(i).getType() and
-        source = TCallableFlowSourceArg(i) and
+      name.regexpMatch("Append(Format|Line|Join)?") and
+      preservesValue = true and
+      (
+        exists(int i, Type t |
+          t = m.getParameter(i).getType() and
+          source = TCallableFlowSourceArg(i) and
+          sink = TCallableFlowSinkQualifier() and
+          sinkAp = AccessPath::element()
+        |
+          (
+            t instanceof StringType or
+            t instanceof ObjectType
+          ) and
+          sourceAp = AccessPath::empty()
+          or
+          isCollectionType(t) and
+          sourceAp = AccessPath::element()
+        )
+        or
+        source = TCallableFlowSourceQualifier() and
         sourceAp = AccessPath::empty() and
-        sink = [TCallableFlowSinkQualifier().(TCallableFlowSink), TCallableFlowSinkReturn()] and
-        sinkAp = AccessPath::element() and
-        preservesValue = true
-      |
-        t instanceof StringType or
-        t instanceof ObjectType
+        sink = TCallableFlowSinkReturn() and
+        sinkAp = AccessPath::empty()
       )
     )
   }
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
index 30b6ee553a16..faaef439eb55 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -2211,54 +2211,83 @@
 | System.Text.RegularExpressions.MatchCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
 | System.Text.RegularExpressions.MatchCollection.set_Item(int, Match) | argument 1 -> element of argument -1 | true |
 | System.Text.RegularExpressions.MatchCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(Char[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(Char[]) | element of argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(Char[], int, int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(Char[], int, int) | element of argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(ReadOnlyMemory<Char>) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(ReadOnlySpan<Char>) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(StringBuilder) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(StringBuilder, int, int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(bool) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(byte) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(char) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(char*, int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(char, int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(decimal) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(double) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(float) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(long) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.Append(object) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.Append(object) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.Append(object) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(sbyte) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(short) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.Append(string) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.Append(string) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.Append(string) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.Append(string, int, int) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(uint) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(ulong) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.Append(ushort) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | element of argument 2 -> element of argument -1 | true |
 | System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, params Object[]) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(char, params Object[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin(char, params Object[]) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(char, params String[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin(char, params String[]) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(string, params Object[]) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(string, params Object[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin(string, params Object[]) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(string, params String[]) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin(string, params String[]) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin(string, params String[]) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin<T>(char, IEnumerable<T>) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin<T>(char, IEnumerable<T>) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | argument -1 -> return (normal) | true |
+| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | element of argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendLine() | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of argument -1 | true |
-| System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendLine(string) | argument -1 -> return (normal) | true |
 | System.Text.StringBuilder.StringBuilder(string) | argument 0 -> element of return (normal) | true |
 | System.Text.StringBuilder.StringBuilder(string, int) | argument 0 -> element of return (normal) | true |
 | System.Text.StringBuilder.StringBuilder(string, int, int, int) | argument 0 -> element of return (normal) | true |
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
index e6c0dd9bedaa..f8d274d364d9 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
@@ -310,6 +310,7 @@
 | LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) | LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 |
 | LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder | LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) |
 | LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
+| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
 | LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
 | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) | LocalDataFlow.cs:240:15:240:23 | access to local variable nonSink10 |
 | LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) |
@@ -322,6 +323,7 @@
 | LocalDataFlow.cs:242:15:242:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
 | LocalDataFlow.cs:242:15:242:22 | access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
 | LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
+| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
 | LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
 | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
 | LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
index e20fecfbe556..b5a6e1ba9297 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
@@ -400,9 +400,9 @@
 | LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder | LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) |
 | LocalDataFlow.cs:234:40:234:41 | "" | LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder |
 | LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
+| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
 | LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
 | LocalDataFlow.cs:235:27:235:32 | access to local variable sink35 | LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 |
-| LocalDataFlow.cs:235:27:235:32 | access to local variable sink35 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
 | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) | LocalDataFlow.cs:240:15:240:23 | access to local variable nonSink10 |
 | LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) |
 | LocalDataFlow.cs:239:43:239:50 | access to local variable nonSink0 | LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder |
@@ -416,9 +416,9 @@
 | LocalDataFlow.cs:242:15:242:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
 | LocalDataFlow.cs:242:15:242:22 | access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
 | LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
+| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
 | LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 | LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 |
-| LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
 | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
 | LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |
 | LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AString) | LocalDataFlow.cs:248:22:248:48 | access to property AString |

From 455b8407128d9467fb4272b0019c26bc34a03060 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Fri, 23 Apr 2021 15:20:21 +0100
Subject: [PATCH 410/433] Fix all dead qhelp links

For those documents with no obvious new home I've pointed the links to the Internet Archive.
---
 .../Magic Constants/MagicConstantsNumbers.qhelp             | 2 +-
 .../Magic Constants/MagicConstantsString.qhelp              | 2 +-
 cpp/ql/src/Best Practices/SloppyGlobal.qhelp                | 2 +-
 cpp/ql/src/Best Practices/UseOfGoto.qhelp                   | 2 +-
 cpp/ql/src/Critical/ReturnValueIgnored.qhelp                | 2 +-
 .../Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.qhelp  | 2 +-
 cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp          | 2 +-
 cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp    | 2 +-
 .../src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp  | 2 +-
 .../src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp  | 2 +-
 csharp/ql/src/Language Abuse/ForeachCapture.qhelp           | 2 +-
 csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.qhelp      | 2 +-
 csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp | 2 +-
 csharp/ql/src/Metrics/Files/FNumberOfTests.qhelp            | 2 +-
 csharp/ql/src/Security Features/CWE-011/ASPNetDebug.qhelp   | 2 +-
 .../CWE-209/ExceptionInformationExposure.qhelp              | 3 ---
 .../ql/src/Likely Bugs/Concurrency/StartInConstructor.qhelp | 2 +-
 java/ql/src/Likely Bugs/Frameworks/Swing/ThreadSafety.qhelp | 2 +-
 .../src/Likely Bugs/Likely Typos/StringBufferCharInit.qhelp | 2 +-
 java/ql/src/Likely Bugs/Resource Leaks/CloseReader.qhelp    | 2 +-
 java/ql/src/Likely Bugs/Resource Leaks/CloseSql.qhelp       | 2 +-
 java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.qhelp    | 2 +-
 java/ql/src/Metrics/RefTypes/TEfferentCoupling.qhelp        | 2 +-
 java/ql/src/Metrics/RefTypes/TEfferentSourceCoupling.qhelp  | 2 +-
 .../ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp | 2 +-
 java/ql/src/Security/CWE/CWE-611/XXE.qhelp                  | 4 ++--
 .../Dead Code/FinalizerNullsFields.qhelp                    | 2 +-
 .../legacy/ParameterAssignment.qhelp                        | 2 +-
 .../src/Declarations/SuspiciousMethodNameDeclaration.qhelp  | 4 ++--
 .../ql/src/Declarations/UnreachableMethodOverloads.qhelp    | 2 +-
 .../ql/src/LanguageFeatures/PropertyWriteOnPrimitive.qhelp  | 4 ++--
 javascript/ql/src/NodeJS/CyclicImport.qhelp                 | 2 +-
 javascript/ql/src/NodeJS/UnusedDependency.qhelp             | 2 +-
 javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.qhelp | 2 +-
 .../ql/src/Security/CWE-400/RemotePropertyInjection.qhelp   | 4 ++--
 javascript/ql/src/Security/CWE-611/Xxe.qhelp                | 6 +++---
 javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp   | 2 +-
 python/ql/src/Classes/ShouldBeContextManager.qhelp          | 2 +-
 .../src/Functions/ModificationOfParameterWithDefault.qhelp  | 2 +-
 python/ql/src/Imports/CyclicImport.qhelp                    | 2 +-
 python/ql/src/Imports/ModuleLevelCyclicImport.qhelp         | 2 +-
 python/ql/src/Metrics/ClassEfferentCoupling.qhelp           | 2 +-
 python/ql/src/Metrics/ModuleEfferentCoupling.qhelp          | 2 +-
 python/ql/src/Variables/ShadowGlobal.qhelp                  | 5 ++---
 python/ql/src/external/MostlyDuplicateClass.qhelp           | 2 +-
 python/ql/src/external/MostlyDuplicateFile.qhelp            | 2 +-
 python/ql/src/external/MostlySimilarFile.qhelp              | 2 +-
 python/ql/src/external/SimilarFunction.qhelp                | 2 +-
 48 files changed, 54 insertions(+), 58 deletions(-)

diff --git a/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsNumbers.qhelp b/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsNumbers.qhelp
index 16fc75fc7ad8..aa97965996f2 100644
--- a/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsNumbers.qhelp	
+++ b/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsNumbers.qhelp	
@@ -39,7 +39,7 @@ then replace all the relevant occurrences in the code.</p>
 </li>
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, published by Prentice Hall PTR (1997). 
-  Chapter 5: Object Life Cycle, Rec 5.4 (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  Chapter 5: Object Life Cycle, Rec 5.4 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 <li>
   <a href="https://www.securecoding.cert.org/confluence/display/c/DCL06-C.+Use+meaningful+symbolic+constants+to+represent+literal+values">DCL06-C. Use meaningful symbolic constants to represent literal values</a>
diff --git a/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsString.qhelp b/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsString.qhelp
index ca01aac69f02..19182fe5b19d 100644
--- a/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsString.qhelp	
+++ b/cpp/ql/src/Best Practices/Magic Constants/MagicConstantsString.qhelp	
@@ -38,7 +38,7 @@ constant.</p>
 </li>
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, published by Prentice Hall PTR (1997). 
-  Chapter 5: Object Life Cycle, Rec 5.4 (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  Chapter 5: Object Life Cycle, Rec 5.4 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 <li>
   <a href="https://www.securecoding.cert.org/confluence/display/c/DCL06-C.+Use+meaningful+symbolic+constants+to+represent+literal+values">DCL06-C. Use meaningful symbolic constants to represent literal values</a>
diff --git a/cpp/ql/src/Best Practices/SloppyGlobal.qhelp b/cpp/ql/src/Best Practices/SloppyGlobal.qhelp
index a6255cc6a9e2..48b36e6d4767 100644
--- a/cpp/ql/src/Best Practices/SloppyGlobal.qhelp	
+++ b/cpp/ql/src/Best Practices/SloppyGlobal.qhelp	
@@ -21,7 +21,7 @@ Review the purpose of the each global variable flagged by this rule and update e
 
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, published by Prentice Hall PTR (1997). 
-  Chapter 1: Naming, Rec 1.1 (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  Chapter 1: Naming, Rec 1.1 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 <li>
   <a href="http://www.learncpp.com/cpp-tutorial/42-global-variables/">Global variables</a>.
diff --git a/cpp/ql/src/Best Practices/UseOfGoto.qhelp b/cpp/ql/src/Best Practices/UseOfGoto.qhelp
index dd5702aabe4f..cfceb144605b 100644
--- a/cpp/ql/src/Best Practices/UseOfGoto.qhelp	
+++ b/cpp/ql/src/Best Practices/UseOfGoto.qhelp	
@@ -45,7 +45,7 @@ this rule.
 </li>
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, Rule 4.6. Prentice Hall PTR, 1997.
-  (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 <li>
   cplusplus.com: <a href="http://www.cplusplus.com/doc/tutorial/control/">Control Structures</a>.
diff --git a/cpp/ql/src/Critical/ReturnValueIgnored.qhelp b/cpp/ql/src/Critical/ReturnValueIgnored.qhelp
index 26d0f5c6e848..de0636987a07 100644
--- a/cpp/ql/src/Critical/ReturnValueIgnored.qhelp
+++ b/cpp/ql/src/Critical/ReturnValueIgnored.qhelp
@@ -32,7 +32,7 @@ Check the return value of functions that return status information.
 <references>
 
 <li>
-  M. Henricson and E. Nyquist, <i>Industrial Strength C++</i>, Chapter 12: Error handling. Prentice Hall PTR, 1997 (<a href="http://mongers.org/industrial-c++/">available online</a>).
+  M. Henricson and E. Nyquist, <i>Industrial Strength C++</i>, Chapter 12: Error handling. Prentice Hall PTR, 1997 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">available online</a>).
 </li>
 <li>
   The CERT C Secure Coding Standard: <a href="https://www.securecoding.cert.org/confluence/display/perl/EXP32-PL.+Do+not+ignore+function+return+values">EXP32-PL. Do not ignore function return values</a>.
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.qhelp b/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.qhelp
index 88a150a0ba25..3c9a68b97e2d 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.qhelp	
@@ -26,7 +26,7 @@ indication that there may be cases unhandled by the <code>switch</code> statemen
   MSDN Library: <a href="https://docs.microsoft.com/en-us/cpp/cpp/switch-statement-cpp">switch statement (C++)</a>
 </li>
 <li>
-  M. Henricson and E. Nyquist, <i>Industrial Strength C++</i>, Chapter 4: Control Flow, Rec 4.5. Prentice Hall PTR, 1997 (<a href="http://mongers.org/industrial-c++/">available online</a>).
+  M. Henricson and E. Nyquist, <i>Industrial Strength C++</i>, Chapter 4: Control Flow, Rec 4.5. Prentice Hall PTR, 1997 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">available online</a>).
 </li>
 
 
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp
index 4e0b989b1213..846e54b33c9f 100644
--- a/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp
+++ b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp
@@ -29,7 +29,7 @@ build time: the more included files, the longer the compilation time.</p>
   <a href="http://www.drdobbs.com/cpp/decoupling-c-header-files/212701130">Decoupling C Header Files</a>
 </li>
 <li>
-  <a href="https://wiki.hsr.ch/Prog3/files/overload72-FINAL_DesigningHeaderFiles.pdf">C++ Best Practice -
+  <a href="https://accu.org/journals/overload/14/72/griffiths_1995/">C++ Best Practice -
 Designing Header Files</a>
 </li>
 
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp
index a3091c68285d..785ad68847da 100644
--- a/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp
+++ b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp
@@ -35,7 +35,7 @@ they are contributing to unnecessarily long build times and creating artificial
   <a href="http://www.drdobbs.com/cpp/decoupling-c-header-files/212701130">Decoupling C Header Files</a>
 </li>
 <li>
-  <a href="https://wiki.hsr.ch/Prog3/files/overload72-FINAL_DesigningHeaderFiles.pdf">C++ Best Practice -
+  <a href="https://accu.org/journals/overload/14/72/griffiths_1995/">C++ Best Practice -
 Designing Header Files</a>
 </li>
 </references>
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp
index d4edec95db93..fde62870954f 100644
--- a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp	
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp	
@@ -33,7 +33,7 @@ the break statement only exits from one level of the loop.</p>
 </li>
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, published by Prentice Hall PTR (1997). 
-  Chapter 4: Control Flow, Rule 4.6 (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  Chapter 4: Control Flow, Rule 4.6 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 <li>
   <a href="http://www.cplusplus.com/doc/tutorial/control/">www.cplusplus.com Control Structures</a>
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp
index c165fe59ba8c..19d01d570cd2 100644
--- a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp	
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp	
@@ -39,7 +39,7 @@ loop if the loop requires more complicated variable iteration.
 </li>
 <li>
   Mats Henricson and Erik Nyquist, <i>Industrial Strength C++</i>, published by Prentice Hall PTR (1997). 
-  Chapter 4: Control Flow, Rule 4.1 (<a href="http://mongers.org/industrial-c++/">PDF</a>).
+  Chapter 4: Control Flow, Rule 4.1 (<a href="https://web.archive.org/web/20190919025638/https://mongers.org/industrial-c++/">PDF</a>).
 </li>
 
 
diff --git a/csharp/ql/src/Language Abuse/ForeachCapture.qhelp b/csharp/ql/src/Language Abuse/ForeachCapture.qhelp
index da966c4d967e..516ed43cbf40 100644
--- a/csharp/ql/src/Language Abuse/ForeachCapture.qhelp	
+++ b/csharp/ql/src/Language Abuse/ForeachCapture.qhelp	
@@ -29,7 +29,7 @@ However on older compilers, the actual output is <code>10 10 10 10 10 10 10 10 1
 
 <references>
 
-  <li>Eric Lippert's Blog: <a href="http://blogs.msdn.com/b/ericlippert/archive/2009/11/12/closing-over-the-loop-variable-considered-harmful.aspx">Closing over the loop variable considered harmful</a>.</li>
+  <li>Eric Lippert's Blog: <a href="https://docs.microsoft.com/en-gb/archive/blogs/ericlippert/closing-over-the-loop-variable-considered-harmful">Closing over the loop variable considered harmful</a>.</li>
 
 </references>
 
diff --git a/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.qhelp b/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.qhelp
index ee484d49d46c..a2000deb2d59 100644
--- a/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.qhelp	
+++ b/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.qhelp	
@@ -27,7 +27,7 @@
     <a href="https://blogs.msdn.microsoft.com/shawnste/2018/04/12/the-japanese-calendars-y2k-moment/">The Japanese Calendar's Y2K Moment</a>.
   </li>
   <li>
-    <a href="https://docs.microsoft.com/en-us/windows/desktop/Intl/era-handling-for-the-japanese-calendar/">Era Handling for the Japanese Calendar</a>.
+    <a href="https://docs.microsoft.com/en-us/windows/win32/intl/era-handling-for-the-japanese-calendar">Era Handling for the Japanese Calendar</a>.
   </li>
   <li>
    <a href="https://simple.wikipedia.org/wiki/List_of_Japanese_eras">List of Japanese Eras (Wikipedia)</a>
diff --git a/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp b/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp
index ede1d57f1cfe..945bcb15a28a 100644
--- a/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp	
+++ b/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp	
@@ -25,7 +25,7 @@ really be compared using <code>i == j</code>.</p>
 <references>
 
   <li>MSDN: <a href="http://msdn.microsoft.com/en-us/library/system.object.referenceequals.aspx">Object.ReferenceEquals Method</a>.</li>
-  <li>The Way I See It: <a href="http://blogs.msdn.com/b/vijaysk/archive/2008/03/19/object-referenceequals-valuevar-valuevar-will-always-return-false.aspx">Object.ReferenceEquals(ValueVar, ValueVar) will always return false.</a></li>
+  <li>The Way I See It: <a href="https://web.archive.org/web/20190919103548/https://blogs.msdn.microsoft.com/vijaysk/2008/03/18/object-referenceequalsvaluevar-valuevar-will-always-return-false/">Object.ReferenceEquals(ValueVar, ValueVar) will always return false.</a></li>
 
 
 </references>
diff --git a/csharp/ql/src/Metrics/Files/FNumberOfTests.qhelp b/csharp/ql/src/Metrics/Files/FNumberOfTests.qhelp
index 1ebd170eaad3..cddb5383bac9 100644
--- a/csharp/ql/src/Metrics/Files/FNumberOfTests.qhelp
+++ b/csharp/ql/src/Metrics/Files/FNumberOfTests.qhelp
@@ -53,7 +53,7 @@
   Microsoft Visual Studio Unit Testing Framework: documentation at <a href="https://msdn.microsoft.com/en-us/library/microsoft.visualstudio.testtools.unittesting.aspx">MSDN</a>.
 </li>
 <li>
-  xUnit.net: official website at <a href="https://xunit.github.io/">https://xunit.github.io/</a>.
+  xUnit.net: official website at <a href="https://xunit.net/">https://xunit.net/</a>.
 </li>
 
 </references>
diff --git a/csharp/ql/src/Security Features/CWE-011/ASPNetDebug.qhelp b/csharp/ql/src/Security Features/CWE-011/ASPNetDebug.qhelp
index 5a65094f39c1..5caf33d0cc90 100644
--- a/csharp/ql/src/Security Features/CWE-011/ASPNetDebug.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-011/ASPNetDebug.qhelp	
@@ -42,7 +42,7 @@ To fix this problem, the 'debug' flag should be set to <code>false</code>, or re
 
 <li>
 MSDN:
-<a href="https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/">Why debug=false in ASP.NET applications in production environment</a>.
+<a href="https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/">Why debug=false in ASP.NET applications in production environment</a>.
 </li>
 <li>
 MSDN:
diff --git a/csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.qhelp b/csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.qhelp
index fc508827c9f7..f36d8a3204e0 100644
--- a/csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.qhelp	
@@ -36,7 +36,4 @@ use the error log, but remote users will not see the information.</p>
 <sample src="ExceptionInformationExposure.cs" />
 </example>
 
-<references>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Information_Leak_(information_disclosure)">Information Leak</a>.</li>
-</references>
 </qhelp>
diff --git a/java/ql/src/Likely Bugs/Concurrency/StartInConstructor.qhelp b/java/ql/src/Likely Bugs/Concurrency/StartInConstructor.qhelp
index 1d0d5b0a1fbf..1401c92b0d66 100644
--- a/java/ql/src/Likely Bugs/Concurrency/StartInConstructor.qhelp	
+++ b/java/ql/src/Likely Bugs/Concurrency/StartInConstructor.qhelp	
@@ -41,7 +41,7 @@ initialized. This results in the program outputting "hello my friend".</p>
 
 <li>
   IBM developerWorks:
-  <a href="http://www.ibm.com/developerworks/java/library/j-jtp0618/index.html#4">Don't start threads from within constructors</a>.
+  <a href="https://web.archive.org/web/20200417101823/http://www.ibm.com/developerworks/java/library/j-jtp0618/index.html#4">Don't start threads from within constructors</a>.
 </li>
 
 
diff --git a/java/ql/src/Likely Bugs/Frameworks/Swing/ThreadSafety.qhelp b/java/ql/src/Likely Bugs/Frameworks/Swing/ThreadSafety.qhelp
index af79f45d59ca..060db52dd61b 100644
--- a/java/ql/src/Likely Bugs/Frameworks/Swing/ThreadSafety.qhelp	
+++ b/java/ql/src/Likely Bugs/Frameworks/Swing/ThreadSafety.qhelp	
@@ -94,7 +94,7 @@ D. Flanagan, <em>Java Foundation Classes in a Nutshell</em>, p.28. O'Reilly, 199
 </li>
 <li>
 Java Developer's Journal:
-<a href="http://www2.sys-con.com/itsg/virtualcd/java/archives/0605/ford/index.html">Building Thread-Safe GUIs with Swing</a>.
+<a href="http://www.comscigate.com/JDJ/archives/0605/ford/index.html">Building Thread-Safe GUIs with Swing</a>.
 </li>
 <li>
 The Java Tutorials:
diff --git a/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.qhelp b/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.qhelp
index 48004a1f1186..d76c09e872bc 100644
--- a/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.qhelp	
+++ b/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.qhelp	
@@ -41,7 +41,7 @@ J. Bloch and N. Gafter, <em>Java Puzzlers: Traps, Pitfalls, and Corner Cases</em
 Addison-Wesley, 2005.
 </li>
 <li>
-NetBeans IDE: <a href="http://wiki.netbeans.org/Java_Hints">Java Hints</a>
+NetBeans IDE: <a href="https://web.archive.org/web/20210117160808/http://wiki.netbeans.org/Java_Hints">Java Hints</a>
 </li>
 <li>
 PMD: <a href="https://pmd.github.io/latest/pmd_rules_java_errorprone.html#stringbufferinstantiationwithchar">Rule StringBufferInstantiationWithChar</a>
diff --git a/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.qhelp b/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.qhelp
index 4d06bef040e3..b0ded8e53a17 100644
--- a/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.qhelp	
+++ b/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.qhelp	
@@ -51,7 +51,7 @@ In this case, the inner expression needs to be assigned to a local variable and
 
 
 <li>
-  IBM developerWorks: <a href="https://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>. 
+  IBM developerWorks: <a href="https://web.archive.org/web/20201109041839/http://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>.
 </li>
 <li>
   The Java Tutorials: <a href="https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html">The try-with-resources Statement</a>.
diff --git a/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.qhelp b/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.qhelp
index 8f89d16ef1d2..eea0513dc8ea 100644
--- a/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.qhelp	
+++ b/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.qhelp	
@@ -40,7 +40,7 @@ by the code that created it or by a server shutdown procedure, as appropriate.</
 
 
 <li>
-  IBM developerWorks: <a href="https://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>.
+  IBM developerWorks: <a href="https://web.archive.org/web/20201109041839/http://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>.
 </li>
 <li>
   The Java Tutorials: <a href="https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html">The try-with-resources Statement</a>.
diff --git a/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.qhelp b/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.qhelp
index 36e834ecefda..0b348a3f9b81 100644
--- a/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.qhelp	
+++ b/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.qhelp	
@@ -50,7 +50,7 @@ In this case, the inner expression needs to be assigned to a local variable and
 
 
 <li>
-  IBM developerWorks: <a href="https://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>. 
+  IBM developerWorks: <a href="https://web.archive.org/web/20201109041839/http://www.ibm.com/developerworks/java/library/j-jtp03216/index.html">Java theory and practice: Good housekeeping practices</a>.
 </li>
 <li>
   The Java Tutorials: <a href="https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html">The try-with-resources Statement</a>.
diff --git a/java/ql/src/Metrics/RefTypes/TEfferentCoupling.qhelp b/java/ql/src/Metrics/RefTypes/TEfferentCoupling.qhelp
index 40e9e0ef5de1..535faedf81e3 100644
--- a/java/ql/src/Metrics/RefTypes/TEfferentCoupling.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TEfferentCoupling.qhelp
@@ -51,7 +51,7 @@ so the general technique is quite widely applicable.
 
 
 <li>
-IBM developerWorks: <a href="http://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
+IBM developerWorks: <a href="https://web.archive.org/web/20190919085934/https://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
 </li>
 <li>
 R. Martin, <em>Agile Software Development: Principles, Patterns and Practices</em>. Pearson, 2011.
diff --git a/java/ql/src/Metrics/RefTypes/TEfferentSourceCoupling.qhelp b/java/ql/src/Metrics/RefTypes/TEfferentSourceCoupling.qhelp
index ceb74639c1e7..965fb2795fbf 100644
--- a/java/ql/src/Metrics/RefTypes/TEfferentSourceCoupling.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TEfferentSourceCoupling.qhelp
@@ -81,7 +81,7 @@ so the general technique is quite widely applicable.
 
 
 <li>
-A. Glover. <a href="http://7thgen.info/wiki/Code_Quality_For_Software_Architects">Code quality for software architects</a>. Published online, 2006.
+A. Glover. <a href="https://web.archive.org/web/20190919093358/http://7thgen.info/wiki/Code_Quality_For_Software_Architects">Code quality for software architects</a>. Published online, 2006.
 </li>
 <li>
 R. Martin. <em>Agile Software Development: Principles, Patterns and Practices</em>. Pearson, 2011.
diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
index 61b50a986e34..0d1f21ca87fc 100644
--- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
+++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
@@ -69,7 +69,7 @@ Or How I Learned to Start Worrying and Hate Java Object Deserialization</a>.
 </li>
 <li>
 Alvaro Muñoz &amp; Christian Schneider, RSAConference 2016:
-<a href="https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf">Serial Killer: Silently Pwning Your Java Endpoints</a>.
+<a href="https://speakerdeck.com/pwntester/serial-killer-silently-pwning-your-java-endpoints">Serial Killer: Silently Pwning Your Java Endpoints</a>.
 </li>
 <li>
 SnakeYaml documentation on deserialization:
diff --git a/java/ql/src/Security/CWE/CWE-611/XXE.qhelp b/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
index 93d420f7495c..c2557883080b 100644
--- a/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
+++ b/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
@@ -56,11 +56,11 @@ OWASP guidance on parsing xml files:
 </li>
 <li>
 Paper by Timothy Morgen:
-<a href="https://www.vsecurity.com//download/publications/XMLDTDEntityAttacks.pdf">XML Schema, DTD, and Entity Attacks</a>
+<a href="https://research.nccgroup.com/2014/05/19/xml-schema-dtd-and-entity-attacks-a-compendium-of-known-techniques/">XML Schema, DTD, and Entity Attacks</a>
 </li>
 <li>
 Out-of-band data retrieval: Timur Yunusov &amp; Alexey Osipov, Black hat EU 2013:
-<a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf">XML Out-Of-Band Data Retrieval</a>.
+<a href="https://www.slideshare.net/qqlan/bh-ready-v4">XML Out-Of-Band Data Retrieval</a>.
 </li>
 <li>
 Denial of service attack (Billion laughs):
diff --git a/java/ql/src/Violations of Best Practice/Dead Code/FinalizerNullsFields.qhelp b/java/ql/src/Violations of Best Practice/Dead Code/FinalizerNullsFields.qhelp
index f85888f651c6..5be6edda989e 100644
--- a/java/ql/src/Violations of Best Practice/Dead Code/FinalizerNullsFields.qhelp	
+++ b/java/ql/src/Violations of Best Practice/Dead Code/FinalizerNullsFields.qhelp	
@@ -77,7 +77,7 @@ severely affect performance, and you should avoid defining <code>finalize</code>
 </li>
 <li>
   IBM developerWorks:
-  <a href="https://www.ibm.com/developerworks/java/library/j-jtp01274/index.html#3.2">Java theory and practice: Explicit nulling</a>.
+  <a href="https://web.archive.org/web/20201111184342/https://www.ibm.com/developerworks/java/library/j-jtp01274/index.html#3.2">Java theory and practice: Explicit nulling</a>.
 </li>
 <li>
   Oracle Technology Network:
diff --git a/java/ql/src/Violations of Best Practice/legacy/ParameterAssignment.qhelp b/java/ql/src/Violations of Best Practice/legacy/ParameterAssignment.qhelp
index a4a39d81bc61..260f8f7c9c91 100644
--- a/java/ql/src/Violations of Best Practice/legacy/ParameterAssignment.qhelp	
+++ b/java/ql/src/Violations of Best Practice/legacy/ParameterAssignment.qhelp	
@@ -41,7 +41,7 @@ Help - Eclipse Platform:
 </li>
 <li>
 Java Basics:
-<a href="http://www.leepoint.net/JavaBasics/methods/methods-22-local-variables.html">Methods 4 - Local variables</a>.
+<a href="https://web.archive.org/web/20200223080939/http://leepoint.net/JavaBasics/methods/methods-22-local-variables.html">Methods 4 - Local variables</a>.
 </li>
 
 
diff --git a/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.qhelp b/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.qhelp
index d47f11d95f0a..e59f290ae6df 100644
--- a/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.qhelp
+++ b/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.qhelp
@@ -48,8 +48,8 @@ in the first place.
 </example>
 <references>
 
-<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/master/doc/spec.md#3.8.9">Constructor Type Literals</a>.</li>
-<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/master/doc/spec.md#8.3.1">Constructor Parameters</a>.</li>
+<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/30cb20434a6b117e007a4959b2a7c16489f86069/doc/spec-ARCHIVED.md#3.8.9">Constructor Type Literals</a>.</li>
+<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/30cb20434a6b117e007a4959b2a7c16489f86069/doc/spec-ARCHIVED.md#8.3.1">Constructor Parameters</a>.</li>
 
 </references>
 </qhelp>
diff --git a/javascript/ql/src/Declarations/UnreachableMethodOverloads.qhelp b/javascript/ql/src/Declarations/UnreachableMethodOverloads.qhelp
index a01de30057c0..f5f760f9cff2 100644
--- a/javascript/ql/src/Declarations/UnreachableMethodOverloads.qhelp
+++ b/javascript/ql/src/Declarations/UnreachableMethodOverloads.qhelp
@@ -61,7 +61,7 @@
 </example>
 <references>
 
-<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/7be7cba050799bc11c9411babd31f44c9ec087f0/doc/spec.md#4.15.1">Overload Resolution</a></li>
+<li>TypeScript specification: <a href="https://github.com/microsoft/TypeScript/blob/30cb20434a6b117e007a4959b2a7c16489f86069/doc/spec-ARCHIVED.md#4.15.1">Overload Resolution</a></li>
 
 </references>
 </qhelp>
diff --git a/javascript/ql/src/LanguageFeatures/PropertyWriteOnPrimitive.qhelp b/javascript/ql/src/LanguageFeatures/PropertyWriteOnPrimitive.qhelp
index 91bb87f44b96..05e9da7d1981 100644
--- a/javascript/ql/src/LanguageFeatures/PropertyWriteOnPrimitive.qhelp
+++ b/javascript/ql/src/LanguageFeatures/PropertyWriteOnPrimitive.qhelp
@@ -58,7 +58,7 @@ for (var i=s.length; i%8; ++i)
 </example>
 
 <references>
-<li>Ecma International, <a href="http://www.ecma-international.org/ecma-262/7.0/#prod-AssignmentExpression">ECMAScript 2016 Language Specification, Section 12.15: Assignment Operators</a>.</li>
-<li>Ecma International, <a href="http://www.ecma-international.org/ecma-262/7.0/#sec-object.defineproperty">ECMAScript 2016 Language Specification, Section 19.1.2.4: Object.defineProperty</a>.</li>
+<li>Ecma International, <a href="https://262.ecma-international.org/7.0/#prod-AssignmentExpression">ECMAScript 2016 Language Specification, Section 12.15: Assignment Operators</a>.</li>
+<li>Ecma International, <a href="https://262.ecma-international.org/7.0/#sec-object.defineproperty">ECMAScript 2016 Language Specification, Section 19.1.2.4: Object.defineProperty</a>.</li>
 </references>
 </qhelp>
diff --git a/javascript/ql/src/NodeJS/CyclicImport.qhelp b/javascript/ql/src/NodeJS/CyclicImport.qhelp
index f52d129fe4ec..b512c17db769 100644
--- a/javascript/ql/src/NodeJS/CyclicImport.qhelp
+++ b/javascript/ql/src/NodeJS/CyclicImport.qhelp
@@ -39,7 +39,7 @@ so that it no longer depends on <code>a.js</code>:
 <references>
 
 
-<li>Brad Harris: <a href="http://selfcontained.us/2012/05/08/node-js-circular-dependencies/">node.js and circular dependencies</a>.</li>
+<li>Brad Harris: <a href="https://web.archive.org/web/20200203213815/http://selfcontained.us/2012/05/08/node-js-circular-dependencies/">node.js and circular dependencies</a>.</li>
 <li>Node.js Manual: <a href="http://nodejs.org/api/modules.html#modules_cycles">Modules</a>.</li>
 
 
diff --git a/javascript/ql/src/NodeJS/UnusedDependency.qhelp b/javascript/ql/src/NodeJS/UnusedDependency.qhelp
index 530e9417062f..d35ae5fd3098 100644
--- a/javascript/ql/src/NodeJS/UnusedDependency.qhelp
+++ b/javascript/ql/src/NodeJS/UnusedDependency.qhelp
@@ -66,7 +66,7 @@ Since this dependency is only used during development, it should instead be list
 <references>
 
 
-<li>NPM Manual: <a href="https://www.npmjs.org/doc/files/package.json.html">package.json</a>.</li>
+<li>NPM Manual: <a href="https://docs.npmjs.com/cli/v7/configuring-npm/package-json">package.json</a>.</li>
 
 
 </references>
diff --git a/javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.qhelp b/javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.qhelp
index 7920c7ee8912..ea3fa3be486f 100644
--- a/javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.qhelp
+++ b/javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.qhelp
@@ -76,7 +76,7 @@
 		</li>
 		<li>
 			OWASP:
-			<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+			<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 			(Cross Site Scripting) Prevention Cheat Sheet</a>.
 		</li>
 		<li>
diff --git a/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.qhelp b/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.qhelp
index c93ab4d09f6c..f1c1f194e863 100644
--- a/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.qhelp
+++ b/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.qhelp
@@ -73,14 +73,14 @@
 	<li>Prototype pollution attacks:
 		<a href="https://github.com/electron/electron/pull/9287">electron</a>,
 		<a href="https://hackerone.com/reports/310443">lodash</a>,
-		<a href="https://nodesecurity.io/advisories/566">hoek</a>.
+		<a href="https://npmjs.com/advisories/566">hoek</a>.
 	</li>
 	<li> Penetration testing report:
 		<a href="http://seclists.org/pen-test/2009/Mar/67">
 			header name injection attack</a>
 	</li>
 	<li> npm blog post:
-		<a href="https://blog.liftsecurity.io/2015/01/14/the-dangers-of-square-bracket-notation#lift-security">
+		<a href="https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md">
 			dangers of square bracket notation</a>
 	</li>
 </references>
diff --git a/javascript/ql/src/Security/CWE-611/Xxe.qhelp b/javascript/ql/src/Security/CWE-611/Xxe.qhelp
index 94388f945306..1e859eb121fa 100644
--- a/javascript/ql/src/Security/CWE-611/Xxe.qhelp
+++ b/javascript/ql/src/Security/CWE-611/Xxe.qhelp
@@ -34,7 +34,7 @@ To guard against XXE attacks, the <code>noent</code> option should be omitted or
 internal entities such as <code>&amp;amp;</code> or <code>&amp;gt;</code>. If desired, these
 entities can be expanded in a separate step using utility functions provided by libraries such
 as <a href="http://underscorejs.org/#unescape">underscore</a>,
-<a href="https://lodash.com/docs/latest#unescape">lodash</a> or
+<a href="https://lodash.com/docs/4.17.15#unescape">lodash</a> or
 <a href="https://github.com/mathiasbynens/he">he</a>.
 </p>
 <sample src="examples/XxeGood.js"/>
@@ -47,11 +47,11 @@ OWASP:
 </li>
 <li>
 Timothy Morgen:
-<a href="https://www.vsecurity.com//download/publications/XMLDTDEntityAttacks.pdf">XML Schema, DTD, and Entity Attacks</a>.
+<a href="https://research.nccgroup.com/2014/05/19/xml-schema-dtd-and-entity-attacks-a-compendium-of-known-techniques/">XML Schema, DTD, and Entity Attacks</a>.
 </li>
 <li>
 Timur Yunusov, Alexey Osipov:
-<a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf">XML Out-Of-Band Data Retrieval</a>.
+<a href="https://www.slideshare.net/qqlan/bh-ready-v4">XML Out-Of-Band Data Retrieval</a>.
 </li>
 </references>
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp b/javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp
index 3db0aee40a23..2f79bde1a37e 100644
--- a/javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp
+++ b/javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp
@@ -33,6 +33,6 @@
 	</example>
 
 	<references>
-		<li>OWASP: <a href="https://owasp.org/www-community/attacks/Man-in-the-middle_attack">Man-in-the-middle attack</a>.</li>
+		<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">Man-in-the-middle attack</a></li>
 	</references>
 </qhelp>
diff --git a/python/ql/src/Classes/ShouldBeContextManager.qhelp b/python/ql/src/Classes/ShouldBeContextManager.qhelp
index 7c497688499c..2af029677a7c 100644
--- a/python/ql/src/Classes/ShouldBeContextManager.qhelp
+++ b/python/ql/src/Classes/ShouldBeContextManager.qhelp
@@ -31,7 +31,7 @@ updated to use a context manager.</p>
 </example>
 <references>
 
-<li>Effbot: <a href="http://effbot.org/zone/python-with-statement.htm">Python with statement</a>.</li>
+<li>Effbot: <a href="https://web.archive.org/web/20201012110738/http://effbot.org/zone/python-with-statement.htm">Python with statement</a>.</li>
 <li>Python Standard Library: <a href="http://docs.python.org/library/stdtypes.html#context-manager-types">Context manager
 </a>.</li>
 <li>Python Language Reference: <a href="http://docs.python.org/2.7/reference/datamodel.html#with-statement-context-managers">
diff --git a/python/ql/src/Functions/ModificationOfParameterWithDefault.qhelp b/python/ql/src/Functions/ModificationOfParameterWithDefault.qhelp
index ff225c689928..39bb484f8917 100644
--- a/python/ql/src/Functions/ModificationOfParameterWithDefault.qhelp
+++ b/python/ql/src/Functions/ModificationOfParameterWithDefault.qhelp
@@ -36,7 +36,7 @@ function with a default of <code>default=None</code>, check if the parameter is
 </example>
 <references>
 
-  <li>Effbot: <a href="http://effbot.org/zone/default-values.htm">Default Parameter Values in Python</a>.</li>
+  <li>Effbot: <a href="https://web.archive.org/web/20201112004749/http://effbot.org/zone/default-values.htm">Default Parameter Values in Python</a>.</li>
   <li>Python Language Reference: <a href="http://docs.python.org/2/reference/compound_stmts.html#function-definitions">Function definitions</a>.</li>
 
 
diff --git a/python/ql/src/Imports/CyclicImport.qhelp b/python/ql/src/Imports/CyclicImport.qhelp
index 0d84c64418a5..038f26c97aac 100644
--- a/python/ql/src/Imports/CyclicImport.qhelp
+++ b/python/ql/src/Imports/CyclicImport.qhelp
@@ -29,7 +29,7 @@ import that.
 
 <li>Python Language  Reference: <a href="http://docs.python.org/2/reference/simple_stmts.html#import">The import statement</a>.</li>
 <li>Python: <a href="http://docs.python.org/2/tutorial/modules.html">Modules</a>.</li>
-<li> Effbot: <a href="http://effbot.org/zone/import-confusion.htm">Import Confusion</a>.</li>
+<li> Effbot: <a href="https://web.archive.org/web/20200917011425/https://effbot.org/zone/import-confusion.htm">Import Confusion</a>.</li>
 
 
 </references>
diff --git a/python/ql/src/Imports/ModuleLevelCyclicImport.qhelp b/python/ql/src/Imports/ModuleLevelCyclicImport.qhelp
index 30af68d364e1..45b6810cf23e 100644
--- a/python/ql/src/Imports/ModuleLevelCyclicImport.qhelp
+++ b/python/ql/src/Imports/ModuleLevelCyclicImport.qhelp
@@ -33,7 +33,7 @@ import that.
 
 <li>Python Language  Reference: <a href="http://docs.python.org/2/reference/simple_stmts.html#import">The import statement</a>.</li>
 <li>Python: <a href="http://docs.python.org/2/tutorial/modules.html">Modules</a>.</li>
-<li> Effbot: <a href="http://effbot.org/zone/import-confusion.htm">Import Confusion</a>.</li>
+<li> Effbot: <a href="https://web.archive.org/web/20200917011425/https://effbot.org/zone/import-confusion.htm">Import Confusion</a>.</li>
 
 
 </references>
diff --git a/python/ql/src/Metrics/ClassEfferentCoupling.qhelp b/python/ql/src/Metrics/ClassEfferentCoupling.qhelp
index b28d6e5fb2e9..04e7ce949e2a 100644
--- a/python/ql/src/Metrics/ClassEfferentCoupling.qhelp
+++ b/python/ql/src/Metrics/ClassEfferentCoupling.qhelp
@@ -49,7 +49,7 @@ so the general technique is quite widely applicable.
 
 
 <li>
-IBM developerWorks: <a href="http://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
+IBM developerWorks: <a href="https://web.archive.org/web/20190919085934/https://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
 </li>
 <li>
 R. Martin, <em>Agile Software Development: Principles, Patterns and Practices</em>. Pearson, 2011.
diff --git a/python/ql/src/Metrics/ModuleEfferentCoupling.qhelp b/python/ql/src/Metrics/ModuleEfferentCoupling.qhelp
index 15cf254efac0..aec3126aa57e 100644
--- a/python/ql/src/Metrics/ModuleEfferentCoupling.qhelp
+++ b/python/ql/src/Metrics/ModuleEfferentCoupling.qhelp
@@ -29,7 +29,7 @@ You can reduce efferent coupling by splitting up a module so that each part depe
 
 
 <li>
-IBM developerWorks: <a href="http://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
+IBM developerWorks: <a href="https://web.archive.org/web/20190919085934/https://www.ibm.com/developerworks/library/j-eaed6/">Evolutionary architecture and emergent design: Emergent design through metrics</a>.
 </li>
 <li>
 R. Martin, <em>Agile Software Development: Principles, Patterns and Practices</em>. Pearson, 2011.
diff --git a/python/ql/src/Variables/ShadowGlobal.qhelp b/python/ql/src/Variables/ShadowGlobal.qhelp
index 52c883375706..f66a992c4837 100644
--- a/python/ql/src/Variables/ShadowGlobal.qhelp
+++ b/python/ql/src/Variables/ShadowGlobal.qhelp
@@ -26,9 +26,8 @@ variable should be renamed to make the code easier to interpret.</p>
 </example>
 <references>
 
-<li>J. Lusth, <i>The Art and Craft of Programming - Python Edition</i>, Section: Scope. University of Alabama, 2012. (<a href="http://troll.cs.ua.edu/ACP-PY/index_13.html">Published online</a>).</li>
-<li>New Mexico Tech Computer Center: <a href="http://infohost.nmt.edu/tcc/help/pubs/python/web/global-statement.html">The global
-statement: Declare access to a global name</a>.</li>
+<li>J. Lusth, <i>The Art and Craft of Programming - Python Edition</i>, Section: Scope. University of Alabama, 2012. (<a href="https://web.archive.org/web/20190919091129/http://troll.cs.ua.edu/ACP-PY/index_13.html">Published online</a>).</li>
+<li>Python Language Reference: <a href="http://docs.python.org/reference/simple_stmts.html#the-global-statement">The global statement</a>.</li>
 
 
 
diff --git a/python/ql/src/external/MostlyDuplicateClass.qhelp b/python/ql/src/external/MostlyDuplicateClass.qhelp
index e7e5a0dc50fc..5ca2bb0b6bec 100644
--- a/python/ql/src/external/MostlyDuplicateClass.qhelp
+++ b/python/ql/src/external/MostlyDuplicateClass.qhelp
@@ -25,7 +25,7 @@ duplicate classes.</p>
 </recommendation>
 <references>
 
-  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="http://www4.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
+  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="https://wwwbroy.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
 
 </references>
 </qhelp>
diff --git a/python/ql/src/external/MostlyDuplicateFile.qhelp b/python/ql/src/external/MostlyDuplicateFile.qhelp
index 80035aef7f66..66594625a04e 100644
--- a/python/ql/src/external/MostlyDuplicateFile.qhelp
+++ b/python/ql/src/external/MostlyDuplicateFile.qhelp
@@ -25,7 +25,7 @@ importing that module into the original module.</p>
 </recommendation>
 <references>
 
-  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="http://www4.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
+  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="https://wwwbroy.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
 
 </references>
 </qhelp>
diff --git a/python/ql/src/external/MostlySimilarFile.qhelp b/python/ql/src/external/MostlySimilarFile.qhelp
index 978c8f4450e3..fc5bd5175200 100644
--- a/python/ql/src/external/MostlySimilarFile.qhelp
+++ b/python/ql/src/external/MostlySimilarFile.qhelp
@@ -19,7 +19,7 @@ of the shared code into its own module and import that module into the original.
 </recommendation>
 <references>
 
-  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="http://www4.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
+  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="https://wwwbroy.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
 
 </references>
 </qhelp>
diff --git a/python/ql/src/external/SimilarFunction.qhelp b/python/ql/src/external/SimilarFunction.qhelp
index 5f8d0bdb7e92..2b1424c23749 100644
--- a/python/ql/src/external/SimilarFunction.qhelp
+++ b/python/ql/src/external/SimilarFunction.qhelp
@@ -25,7 +25,7 @@ almost all of their lines are the same, then consider extracting the same lines
 </recommendation>
 <references>
 
-  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="http://www4.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
+  <li>E. Juergens, F. Deissenboeck, B. Hummel and S. Wagner, <em>Do Code Clones Matter?</em>, 2009. (<a href="https://wwwbroy.in.tum.de/~juergens/publications/ICSE2009_RP_0110_juergens.pdf">available online</a>).</li>
 
 </references>
 </qhelp>

From 78b9682a4e499ba0fb3a1f3ab12a785b92d2908d Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Fri, 23 Apr 2021 15:46:48 +0100
Subject: [PATCH 411/433] Fix dead links in JS externs too

---
 javascript/externs/es/es2016.js |  2 +-
 javascript/externs/es/es6.js    | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/javascript/externs/es/es2016.js b/javascript/externs/es/es2016.js
index a3ca37da3b15..3fe253b155e3 100644
--- a/javascript/externs/es/es2016.js
+++ b/javascript/externs/es/es2016.js
@@ -4,7 +4,7 @@
 
 /**
  * @fileoverview Definitions for ECMAScript 2016.
- * @see http://www.ecma-international.org/ecma-262/7.0/
+ * @see https://262.ecma-international.org/7.0/
  * @externs
  */
 
diff --git a/javascript/externs/es/es6.js b/javascript/externs/es/es6.js
index 08e2a47c2701..cab2c1a1135b 100644
--- a/javascript/externs/es/es6.js
+++ b/javascript/externs/es/es6.js
@@ -210,7 +210,7 @@ String.prototype.repeat = function(count) {};
 /**
  * @constructor
  * @extends {Array<string>}
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-gettemplateobject
+ * @see https://262.ecma-international.org/6.0/#sec-gettemplateobject
  */
 var ITemplateArray = function() {};
 
@@ -1228,7 +1228,7 @@ Array.prototype.entries;
  * @return {T|undefined}
  * @this {IArrayLike<T>|string}
  * @template T,S
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-array.prototype.find
+ * @see https://262.ecma-international.org/6.0/#sec-array.prototype.find
  */
 Array.prototype.find = function(predicate, opt_this) {};
 
@@ -1239,7 +1239,7 @@ Array.prototype.find = function(predicate, opt_this) {};
  * @return {number}
  * @this {IArrayLike<T>|string}
  * @template T,S
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-array.prototype.findindex
+ * @see https://262.ecma-international.org/6.0/#sec-array.prototype.findindex
  */
 Array.prototype.findIndex = function(predicate, opt_this) {};
 
@@ -1251,7 +1251,7 @@ Array.prototype.findIndex = function(predicate, opt_this) {};
  * @return {!IArrayLike<T>}
  * @this {!IArrayLike<T>|string}
  * @template T
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-array.prototype.fill
+ * @see https://262.ecma-international.org/6.0/#sec-array.prototype.fill
  */
 Array.prototype.fill = function(value, opt_begin, opt_end) {};
 
@@ -1260,7 +1260,7 @@ Array.prototype.fill = function(value, opt_begin, opt_end) {};
  * @param {number} target
  * @param {number} start
  * @param {number=} opt_end
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-array.prototype.copywithin
+ * @see https://262.ecma-international.org/6.0/#sec-array.prototype.copywithin
  * @template T
  * @return {!IArrayLike<T>}
  */
@@ -1281,7 +1281,7 @@ Array.prototype.includes = function(searchElement, opt_fromIndex) {};
 /**
  * @param {!Object} obj
  * @return {!Array<symbol>}
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-object.getownpropertysymbols
+ * @see https://262.ecma-international.org/6.0/#sec-object.getownpropertysymbols
  */
 Object.getOwnPropertySymbols = function(obj) {};
 
@@ -1290,7 +1290,7 @@ Object.getOwnPropertySymbols = function(obj) {};
  * @param {!Object} obj
  * @param {?} proto
  * @return {!Object}
- * @see http://www.ecma-international.org/ecma-262/6.0/#sec-object.setprototypeof
+ * @see https://262.ecma-international.org/6.0/#sec-object.setprototypeof
  */
 Object.setPrototypeOf = function(obj, proto) {};
 

From 772d5eaccafc82d25b4704b3a545083a8d55c7d5 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Mon, 26 Apr 2021 09:55:32 +0200
Subject: [PATCH 412/433] C++: Add change note.

---
 cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md

diff --git a/cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md b/cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md
new file mode 100644
index 000000000000..5a7b8414fade
--- /dev/null
+++ b/cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `exprMightOverflowPositively` and `exprMightOverflowNegatively` predicates from the `SimpleRangeAnalysis` library now recognize more expressions that might overflow.

From 824c243268931793e5b2d0cd019fb920ec449fc4 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 26 Apr 2021 10:50:17 +0200
Subject: [PATCH 413/433] C#: Add change note

---
 csharp/change-notes/2021-04-26-string-builder-summaries.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 csharp/change-notes/2021-04-26-string-builder-summaries.md

diff --git a/csharp/change-notes/2021-04-26-string-builder-summaries.md b/csharp/change-notes/2021-04-26-string-builder-summaries.md
new file mode 100644
index 000000000000..285f40faf398
--- /dev/null
+++ b/csharp/change-notes/2021-04-26-string-builder-summaries.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Data-flow modelling of `StringBuilder` objects has been improved.
\ No newline at end of file

From d717fc7b1f0e42dc2ff3e10e7ae9e5324a554147 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Mon, 26 Apr 2021 10:13:04 +0100
Subject: [PATCH 414/433] Use Microsoft archive of vijaysk's blog

---
 csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp b/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp
index 945bcb15a28a..96feb557d3b1 100644
--- a/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp	
+++ b/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.qhelp	
@@ -25,7 +25,7 @@ really be compared using <code>i == j</code>.</p>
 <references>
 
   <li>MSDN: <a href="http://msdn.microsoft.com/en-us/library/system.object.referenceequals.aspx">Object.ReferenceEquals Method</a>.</li>
-  <li>The Way I See It: <a href="https://web.archive.org/web/20190919103548/https://blogs.msdn.microsoft.com/vijaysk/2008/03/18/object-referenceequalsvaluevar-valuevar-will-always-return-false/">Object.ReferenceEquals(ValueVar, ValueVar) will always return false.</a></li>
+  <li>The Way I See It: <a href="https://docs.microsoft.com/en-us/archive/blogs/vijaysk/object-referenceequalsvaluevar-valuevar-will-always-return-false">Object.ReferenceEquals(ValueVar, ValueVar) will always return false.</a></li>
 
 
 </references>

From 3889c8afec3595b041de6f0e02efa6393bbd8107 Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Mon, 26 Apr 2021 13:10:15 +0000
Subject: [PATCH 415/433] Python: Use only `TApiNode` in `API::Impl`

This ensures that changes to `API::Node` does not invalidate the cached
`module Impl`. At present, I don't expect this to have any effect (as
the `Node` class is also fairly static, though not explicitly cached),
but I can imagine us making some of the `Node` methods have
user-extensible behaviour, in which case we definitely do not want this
to result in reevaluation of `API::Impl`.
---
 python/ql/src/semmle/python/ApiGraphs.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 5f71d9d1c408..a530e44e85da 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -452,7 +452,7 @@ module API {
      * Holds if there is an edge from `pred` to `succ` in the API graph that is labeled with `lbl`.
      */
     cached
-    predicate edge(Node pred, string lbl, Node succ) {
+    predicate edge(TApiNode pred, string lbl, TApiNode succ) {
       /* There's an edge from the root node for each imported module. */
       exists(string m |
         pred = MkRoot() and

From 3670c729c0b5a0a574b412df8512d5a867049f8b Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Mon, 26 Apr 2021 08:43:28 -0700
Subject: [PATCH 416/433] Actions: Use the main branch of the codeql action

This commit switches to the bleeding edge, main branch of the
codeql action. This helps us test the action before merging all
of the new changes into main, which occurs roughly once a week.

If there are commits that introduce bugs in codeql-action, then
we will be more likely to catch it before releasing to the world
if we are using it in this extension.
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b86009ef6da9..370d2f14881c 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,7 +25,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@main
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: csharp
@@ -34,7 +34,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@main
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -48,4 +48,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@main

From 0e53ad33f65b7e3b72d8ebd713bab3d8117f3963 Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Mon, 26 Apr 2021 10:53:29 -0700
Subject: [PATCH 417/433] Actions: Add permissions block to code scanning
 workflow

---
 .github/workflows/codeql-analysis.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 370d2f14881c..3cd94cb6215c 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -19,6 +19,11 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      security_events: write
+      pull_requests: read
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2

From 0b322a31438dc1c16d5048d59aa547a629272fc5 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 27 Apr 2021 08:53:15 +0200
Subject: [PATCH 418/433] update JS/TS versions to reflect supported versions

---
 docs/codeql/support/reusables/versions-compilers.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/codeql/support/reusables/versions-compilers.rst b/docs/codeql/support/reusables/versions-compilers.rst
index ff49b01a4412..9bc3c855e586 100644
--- a/docs/codeql/support/reusables/versions-compilers.rst
+++ b/docs/codeql/support/reusables/versions-compilers.rst
@@ -20,9 +20,9 @@
    Java,"Java 7 to 15 [3]_","javac (OpenJDK and Oracle JDK),
 
    Eclipse compiler for Java (ECJ) [4]_",``.java``
-   JavaScript,ECMAScript 2019 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhm``, ``.xhtml``, ``.vue``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [5]_"
+   JavaScript,ECMAScript 2021 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhm``, ``.xhtml``, ``.vue``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [5]_"
    Python,"2.7, 3.5, 3.6, 3.7, 3.8",Not applicable,``.py``
-   TypeScript [6]_,"2.6-3.7",Standard TypeScript compiler,"``.ts``, ``.tsx``"
+   TypeScript [6]_,"2.6-4.2",Standard TypeScript compiler,"``.ts``, ``.tsx``"
 
 .. container:: footnote-group
 

From 05d693e3bb68bbece3a966d5b6c3afce6ee5ead1 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 27 Apr 2021 09:41:13 +0200
Subject: [PATCH 419/433] C++: Also include the assignment versions in
 exprThatCanOverflow.

---
 .../src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
index 2afe26bc3e0e..79dbe49611e0 100644
--- a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -1626,7 +1626,9 @@ private module SimpleRangeAnalysisCached {
   private predicate exprThatCanOverflow(Expr e) {
     e instanceof UnaryArithmeticOperation or
     e instanceof BinaryArithmeticOperation or
-    e instanceof LShiftExpr
+    e instanceof AssignArithmeticOperation or
+    e instanceof LShiftExpr or
+    e instanceof AssignLShiftExpr
   }
 
   /**

From a41e9055c564088f7ba32357cc53e48beaf6d0a0 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 27 Apr 2021 09:43:02 +0200
Subject: [PATCH 420/433] C++: Delete the fix that was introduced in
 bb447d7174141dc518e6ce90367121280fec1d80. This is no longer needed after
 #5678.

---
 .../src/semmle/code/cpp/security/Overflow.qll | 22 +++++++++----------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
index 465e64b9b6ca..6cf82791d526 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -99,12 +99,11 @@ VariableAccess varUse(LocalScopeVariable v) { result = v.getAnAccess() }
  * Holds if `e` potentially overflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
-  (
-    convertedExprMightOverflowPositively(e)
-    or
-    // Ensure that the predicate holds when range analysis cannot determine an upper bound
-    upperBound(e.getFullyConverted()) = exprMaxVal(e.getFullyConverted())
-  ) and
+  // Since `e` is guarenteed to be a `BinaryArithmeticOperation`, a `UnaryArithmeticOperation` or
+  // an `AssignArithmeticOperation` by the other constraints in this predicate, we know that
+  // `convertedExprMightOverflowPositively` will have a result even when `e` is not analyzable
+  // by `SimpleRangeAnalysis`.
+  convertedExprMightOverflowPositively(e) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // overflow possible if large
@@ -126,12 +125,11 @@ predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
  * Holds if `e` potentially underflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstUnderflow(Operation e, VariableAccess use) {
-  (
-    convertedExprMightOverflowNegatively(e)
-    or
-    // Ensure that the predicate holds when range analysis cannot determine a lower bound
-    lowerBound(e.getFullyConverted()) = exprMinVal(e.getFullyConverted())
-  ) and
+  // Since `e` is guarenteed to be a `BinaryArithmeticOperation`, a `UnaryArithmeticOperation` or
+  // an `AssignArithmeticOperation` by the other constraints in this predicate, we know that
+  // `convertedExprMightOverflowNegatively` will have a result even when `e` is not analyzable
+  // by `SimpleRangeAnalysis`.
+  convertedExprMightOverflowNegatively(e) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // underflow possible if use is left operand and small

From 04a785b9fb438e61e2af3b4dc788930260b4f8df Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 27 Apr 2021 09:43:27 +0200
Subject: [PATCH 421/433] C++: Accept test changes.

---
 .../CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected | 1 -
 .../test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
index 77b08e62d838..cbaf5d630795 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
@@ -3,5 +3,4 @@
 | test.c:50:3:50:5 | sc3 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:49:9:49:16 | 127 | Extreme value |
 | test.c:59:3:59:5 | sc6 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value |
 | test.c:63:3:63:5 | sc8 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value |
-| test.c:75:3:75:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
 | test.c:124:9:124:9 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:118:17:118:23 | 2147483647 | Extreme value |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
index ee2e041db3c3..8760641c8e2d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
@@ -72,7 +72,7 @@ void test_negatives() {
   signed char sc1, sc2, sc3, sc4, sc5, sc6, sc7, sc8;
 
   sc1 = CHAR_MAX;
-  sc1 += 0; // GOOD [FALSE POSITIVE]
+  sc1 += 0; // GOOD
   sc1 += -1; // GOOD
   sc2 = CHAR_MIN;
   sc2 += -1; // BAD [NOT DETECTED]

From 017beb6786e275f39f11a73535ceb286118b08d5 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 27 Apr 2021 10:07:33 +0200
Subject: [PATCH 422/433] Java: Use separate data-flow copy for
 `PredictableSeedFlowConfiguration`

---
 config/identical-files.json                   |    1 +
 .../semmle/code/java/dataflow/DataFlow6.qll   |   10 +
 .../java/dataflow/internal/DataFlowImpl6.qll  | 4166 +++++++++++++++++
 .../src/semmle/code/java/security/Random.qll  |   12 +-
 4 files changed, 4183 insertions(+), 6 deletions(-)
 create mode 100644 java/ql/src/semmle/code/java/dataflow/DataFlow6.qll
 create mode 100644 java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll

diff --git a/config/identical-files.json b/config/identical-files.json
index 3916e95a0cf0..8cfca3596c5e 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -5,6 +5,7 @@
     "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
     "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
     "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
     "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
     "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
     "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
diff --git a/java/ql/src/semmle/code/java/dataflow/DataFlow6.qll b/java/ql/src/semmle/code/java/dataflow/DataFlow6.qll
new file mode 100644
index 000000000000..28fa11da475f
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/DataFlow6.qll
@@ -0,0 +1,10 @@
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) data flow analyses.
+ */
+
+import java
+
+module DataFlow6 {
+  import semmle.code.java.dataflow.internal.DataFlowImpl6
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
new file mode 100644
index 000000000000..9498e51e7e61
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
@@ -0,0 +1,4166 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  abstract predicate isSource(Node source);
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  abstract predicate isSink(Node sink);
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * Holds if the additional flow step from `node1` to `node2` must be taken
+   * into account in the analysis.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private predicate inBarrier(Node node, Configuration config) {
+  config.isBarrierIn(node) and
+  config.isSource(node)
+}
+
+private predicate outBarrier(Node node, Configuration config) {
+  config.isBarrierOut(node) and
+  config.isSink(node)
+}
+
+private predicate fullBarrier(Node node, Configuration config) {
+  config.isBarrier(node)
+  or
+  config.isBarrierIn(node) and
+  not config.isSource(node)
+  or
+  config.isBarrierOut(node) and
+  not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(Node node1, Node node2, Configuration config) {
+  (
+    simpleLocalFlowStep(node1, node2) or
+    reverseStepThroughInputOutputAlias(node1, node2)
+  ) and
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
+  config.isAdditionalFlowStep(node1, node2) and
+  getNodeEnclosingCallable(node1) = getNodeEnclosingCallable(node2) and
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(Node node1, Node node2, Configuration config) {
+  jumpStep(node1, node2) and
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(Node node1, Node node2, Configuration config) {
+  config.isAdditionalFlowStep(node1, node2) and
+  getNodeEnclosingCallable(node1) != getNodeEnclosingCallable(node2) and
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private module Stage1 {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(Node node, Cc cc, Configuration config) {
+    not fullBarrier(node, config) and
+    (
+      config.isSource(node) and
+      cc = false
+      or
+      exists(Node mid |
+        fwdFlow(mid, cc, config) and
+        localFlowStep(mid, node, config)
+      )
+      or
+      exists(Node mid |
+        fwdFlow(mid, cc, config) and
+        additionalLocalFlowStep(mid, node, config)
+      )
+      or
+      exists(Node mid |
+        fwdFlow(mid, _, config) and
+        jumpStep(mid, node, config) and
+        cc = false
+      )
+      or
+      exists(Node mid |
+        fwdFlow(mid, _, config) and
+        additionalJumpStep(mid, node, config) and
+        cc = false
+      )
+      or
+      // store
+      exists(Node mid |
+        useFieldFlow(config) and
+        fwdFlow(mid, cc, config) and
+        store(mid, _, node, _) and
+        not outBarrier(mid, config)
+      )
+      or
+      // read
+      exists(Content c |
+        fwdFlowRead(c, node, cc, config) and
+        fwdFlowConsCand(c, config) and
+        not inBarrier(node, config)
+      )
+      or
+      // flow into a callable
+      exists(Node arg |
+        fwdFlow(arg, _, config) and
+        viableParamArg(_, node, arg) and
+        cc = true
+      )
+      or
+      // flow out of a callable
+      exists(DataFlowCall call |
+        fwdFlowOut(call, node, false, config) and
+        cc = false
+        or
+        fwdFlowOutFromArg(call, node, config) and
+        fwdFlowIsEntered(call, cc, config)
+      )
+    )
+  }
+
+  private predicate fwdFlow(Node node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowRead(Content c, Node node, Cc cc, Configuration config) {
+    exists(Node mid |
+      fwdFlow(mid, cc, config) and
+      read(mid, c, node)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(Node mid, Node node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _) and
+      c = tc.getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(ReturnNodeExt ret |
+      fwdFlow(ret, cc, config) and
+      getReturnPosition(ret) = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, Node out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOut(call, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, Node out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgumentNode arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArg(call, _, arg)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(Node node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(Node node, boolean toReturn, Configuration config) {
+    fwdFlow(node, config) and
+    config.isSink(node) and
+    toReturn = false
+    or
+    exists(Node mid |
+      localFlowStep(node, mid, config) and
+      revFlow(mid, toReturn, config)
+    )
+    or
+    exists(Node mid |
+      additionalLocalFlowStep(node, mid, config) and
+      revFlow(mid, toReturn, config)
+    )
+    or
+    exists(Node mid |
+      jumpStep(node, mid, config) and
+      revFlow(mid, _, config) and
+      toReturn = false
+    )
+    or
+    exists(Node mid |
+      additionalJumpStep(node, mid, config) and
+      revFlow(mid, _, config) and
+      toReturn = false
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(Node mid, Content c |
+      read(node, c, mid) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      getReturnPosition(node) = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(Node mid, Node node |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      read(node, c, mid) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, Node node, boolean toReturn, Configuration config) {
+    exists(Node mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  private predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, Node out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOut(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, Node out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParameterNode p, ArgumentNode arg, Configuration config
+  ) {
+    viableParamArg(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgumentNode arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParameterNode p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgumentNode arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(Node out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    Node node1, Ap ap1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(Node n1, Content c, Node n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config)) and
+    read(n1, c, n2)
+  }
+
+  pragma[nomagic]
+  predicate revFlow(Node node, Configuration config) { revFlow(node, _, config) }
+
+  predicate revFlow(Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config) {
+    revFlow(node, toReturn, config) and exists(returnAp) and exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(Node node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(ReturnNodeExt ret |
+      throughFlowNodeCand(ret, config) and
+      callable = getNodeEnclosingCallable(ret) and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  predicate parameterMayFlowThrough(ParameterNode p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      getNodeEnclosingCallable(p) = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself
+      not exists(int pos |
+        kind.(ParamUpdateReturnKind).getPosition() = pos and p.isParameterOf(_, pos)
+      )
+    )
+  }
+
+  predicate stats(boolean fwd, int nodes, int fields, int conscand, int tuples, Configuration config) {
+    fwd = true and
+    nodes = count(Node node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    tuples = count(Node n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(Node node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    tuples = count(Node n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(Node node1, Node node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(Node node1, Node node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, Node out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, ReturnNodeExt ret, Node out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, getReturnPosition(ret), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParameterNode p, ArgumentNode arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgumentNode arg, ParameterNode p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(Node n1, Configuration conf) {
+  result =
+    strictcount(Node n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(Node n2, Configuration conf) {
+  result =
+    strictcount(Node n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, ReturnNodeExt ret, Node out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgumentNode arg, ParameterNode p, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private module Stage2 {
+  module PrevStage = Stage1;
+
+  class ApApprox = PrevStage::Ap;
+
+  class Ap = boolean;
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  private ApApprox getApprox(Ap ap) { any() }
+
+  private ApNil getApNil(Node node) { PrevStage::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  private Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  private Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  class Cc = boolean;
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+
+    /** Holds if this call context may be `call`. */
+    predicate matchesCall(DataFlowCall call) { any() }
+  }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  private class LocalCc = Unit;
+
+  bindingset[call, c, outercc]
+  private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c]
+  private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) { any() }
+
+  bindingset[innercc, inner, call]
+  private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) {
+    any()
+  }
+
+  bindingset[node, cc, config]
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) { any() }
+
+  private predicate localStep(
+    Node node1, Node node2, boolean preservesValue, ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config)
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  private predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  private predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  bindingset[ap, contentType]
+  private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+
+  /* Begin: Stage 2 logic. */
+  private predicate flowCand(Node node, ApApprox apa, Configuration config) {
+    PrevStage::revFlow(node, _, _, apa, config)
+  }
+
+  /**
+   * Holds if `node` is reachable with access path `ap` from a source in the
+   * configuration `config`.
+   *
+   * The call context `cc` records whether the node is reached through an
+   * argument in a call, and if so, `argAp` records the access path of that
+   * argument.
+   */
+  pragma[nomagic]
+  predicate fwdFlow(Node node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
+    flowCand(node, _, config) and
+    config.isSource(node) and
+    cc = ccNone() and
+    argAp = apNone() and
+    ap = getApNil(node)
+    or
+    exists(Node mid, Ap ap0, LocalCc localCc |
+      fwdFlow(mid, cc, argAp, ap0, config) and
+      localCc = getLocalCc(mid, cc, config)
+    |
+      localStep(mid, node, true, _, config, localCc) and
+      ap = ap0
+      or
+      localStep(mid, node, false, ap, config, localCc) and
+      ap0 instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      fwdFlow(mid, _, _, ap, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      jumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(mid, _, _, nil, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      additionalJumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone() and
+      ap = getApNil(node)
+    )
+    or
+    // store
+    exists(TypedContent tc, Ap ap0 |
+      fwdFlowStore(_, ap0, tc, node, cc, argAp, config) and
+      ap = apCons(tc, ap0)
+    )
+    or
+    // read
+    exists(Ap ap0, Content c |
+      fwdFlowRead(ap0, c, _, node, cc, argAp, config) and
+      fwdFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // flow into a callable
+    exists(ApApprox apa |
+      fwdFlowIn(_, node, _, cc, _, ap, config) and
+      apa = getApprox(ap) and
+      if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+      then argAp = apSome(ap)
+      else argAp = apNone()
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, any(CcNoCall innercc), cc, argAp, ap, config)
+      or
+      exists(Ap argAp0 |
+        fwdFlowOutFromArg(call, node, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowStore(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    exists(DataFlowType contentType |
+      fwdFlow(node1, cc, argAp, ap1, config) and
+      PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
+      typecheckStore(ap1, contentType)
+    )
+  }
+
+  /**
+   * Holds if forward flow with access path `tail` reaches a store of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(TypedContent tc |
+      fwdFlowStore(_, tail, tc, _, _, _, config) and
+      tc.getContent() = c and
+      cons = apCons(tc, tail)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowRead(
+    Ap ap, Content c, Node node1, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    fwdFlow(node1, cc, argAp, ap, config) and
+    PrevStage::readStepCand(node1, c, node2, config) and
+    getHeadContent(ap) = c
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowIn(
+    DataFlowCall call, ParameterNode p, Cc outercc, Cc innercc, ApOption argAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ArgumentNode arg, boolean allowsFieldFlow |
+      fwdFlow(arg, outercc, argAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      innercc = getCallContextCall(call, getNodeEnclosingCallable(p), outercc)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  /**
+   * Holds if flow may exit from `call` at `out` with access path `ap`. The
+   * inner call context is `innercc`, but `ccOut` is just the call context
+   * based on the return step. In the case of through-flow `ccOut` is discarded
+   * and replaced by the outer call context as tracked by `fwdFlowIsEntered`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowOut(
+    DataFlowCall call, Node out, Cc innercc, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, boolean allowsFieldFlow, DataFlowCallable inner |
+      fwdFlow(ret, innercc, argAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+      inner = getNodeEnclosingCallable(ret) and
+      checkCallContextReturn(innercc, inner, call) and
+      ccOut = getCallContextReturn(inner, call)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(
+    DataFlowCall call, Node out, Ap argAp, Ap ap, Configuration config
+  ) {
+    fwdFlowOut(call, out, any(CcCall ccc), _, apSome(argAp), ap, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+   * and data might flow through the target callable and back out at `call`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(
+    DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ParameterNode p |
+      fwdFlowIn(call, p, cc, _, argAp, ap, config) and
+      PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate storeStepFwd(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Ap ap2, Configuration config
+  ) {
+    fwdFlowStore(node1, ap1, tc, node2, _, _, config) and
+    ap2 = apCons(tc, ap1) and
+    fwdFlowRead(ap2, tc.getContent(), _, _, _, _, config)
+  }
+
+  private predicate readStepFwd(Node n1, Ap ap1, Content c, Node n2, Ap ap2, Configuration config) {
+    fwdFlowRead(ap1, c, n1, n2, _, _, config) and
+    fwdFlowConsCand(ap1, c, ap2, config)
+  }
+
+  /**
+   * Holds if `node` with access path `ap` is part of a path from a source to a
+   * sink in the configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from the
+   * enclosing callable in order to reach a sink, and if so, `returnAp` records
+   * the access path of the returned value.
+   */
+  pragma[nomagic]
+  predicate revFlow(Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config) {
+    revFlow0(node, toReturn, returnAp, ap, config) and
+    fwdFlow(node, _, _, ap, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(
+    Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    fwdFlow(node, _, _, ap, config) and
+    config.isSink(node) and
+    toReturn = false and
+    returnAp = apNone() and
+    ap instanceof ApNil
+    or
+    exists(Node mid |
+      localStep(node, mid, true, _, config, _) and
+      revFlow(mid, toReturn, returnAp, ap, config)
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      localStep(node, mid, false, _, config, _) and
+      revFlow(mid, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+      ap instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      jumpStep(node, mid, config) and
+      revFlow(mid, _, _, ap, config) and
+      toReturn = false and
+      returnAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      additionalJumpStep(node, mid, config) and
+      revFlow(pragma[only_bind_into](mid), _, _, nil, pragma[only_bind_into](config)) and
+      toReturn = false and
+      returnAp = apNone() and
+      ap instanceof ApNil
+    )
+    or
+    // store
+    exists(Ap ap0, Content c |
+      revFlowStore(ap0, c, ap, node, _, _, toReturn, returnAp, config) and
+      revFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // read
+    exists(Node mid, Ap ap0 |
+      revFlow(mid, toReturn, returnAp, ap0, config) and
+      readStepFwd(node, ap, _, mid, ap0, config)
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, toReturn, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(Ap returnAp0 |
+        revFlowInToReturn(call, node, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    )
+    or
+    // flow out of a callable
+    revFlowOut(_, node, _, _, ap, config) and
+    toReturn = true and
+    if fwdFlow(node, any(CcCall ccc), apSome(_), ap, config)
+    then returnAp = apSome(ap)
+    else returnAp = apNone()
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(
+    Ap ap0, Content c, Ap ap, Node node, TypedContent tc, Node mid, boolean toReturn,
+    ApOption returnAp, Configuration config
+  ) {
+    revFlow(mid, toReturn, returnAp, ap0, config) and
+    storeStepFwd(node, ap, tc, mid, ap0, config) and
+    tc.getContent() = c
+  }
+
+  /**
+   * Holds if reverse flow with access path `tail` reaches a read of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(Node mid, Ap tail0 |
+      revFlow(mid, _, _, tail, config) and
+      tail = pragma[only_bind_into](tail0) and
+      readStepFwd(_, cons, c, mid, tail0, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(
+    DataFlowCall call, ReturnNodeExt ret, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(Node out, boolean allowsFieldFlow |
+      revFlow(out, toReturn, returnAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgumentNode arg, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ParameterNode p, boolean allowsFieldFlow |
+      revFlow(p, toReturn, returnAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(
+    DataFlowCall call, ArgumentNode arg, Ap returnAp, Ap ap, Configuration config
+  ) {
+    revFlowIn(call, arg, true, apSome(returnAp), ap, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(
+    DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, CcCall ccc |
+      revFlowOut(call, ret, toReturn, returnAp, ap, config) and
+      fwdFlow(ret, ccc, apSome(_), ap, config) and
+      ccc.matchesCall(call)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    Node node1, Ap ap1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
+  ) {
+    exists(Ap ap2, Content c |
+      store(node1, tc, node2, contentType) and
+      revFlowStore(ap2, c, ap1, node1, tc, node2, _, _, config) and
+      revFlowConsCand(ap2, c, ap1, config)
+    )
+  }
+
+  predicate readStepCand(Node node1, Content c, Node node2, Configuration config) {
+    exists(Ap ap1, Ap ap2 |
+      revFlow(node2, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+      readStepFwd(node1, ap1, c, node2, ap2, config) and
+      revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlow(Node node, Configuration config) { revFlow(node, _, _, _, config) }
+
+  private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepFwd(_, ap, tc, _, _, config)
+  }
+
+  predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepCand(_, ap, tc, _, _, config)
+  }
+
+  pragma[noinline]
+  private predicate parameterFlow(
+    ParameterNode p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+  ) {
+    revFlow(p, true, apSome(ap0), ap, config) and
+    c = getNodeEnclosingCallable(p)
+  }
+
+  predicate parameterMayFlowThrough(ParameterNode p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnNodeExt ret, Ap ap0, ReturnKindExt kind, int pos |
+      parameterFlow(p, ap, ap0, c, config) and
+      c = getNodeEnclosingCallable(ret) and
+      revFlow(ret, true, apSome(_), ap0, config) and
+      fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
+      kind = ret.getKind() and
+      p.isParameterOf(_, pos) and
+      // we don't expect a parameter to return stored in itself
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+    )
+  }
+
+  predicate stats(boolean fwd, int nodes, int fields, int conscand, int tuples, Configuration config) {
+    fwd = true and
+    nodes = count(Node node | fwdFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+    tuples = count(Node n, Cc cc, ApOption argAp, Ap ap | fwdFlow(n, cc, argAp, ap, config))
+    or
+    fwd = false and
+    nodes = count(Node node | revFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | consCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+    tuples = count(Node n, boolean b, ApOption retAp, Ap ap | revFlow(n, b, retAp, ap, config))
+  }
+  /* End: Stage 2 logic. */
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, ReturnNodeExt node1, Node node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlow(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgumentNode node1, ParameterNode node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlow(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends Node {
+    FlowCheckNode() {
+      this instanceof CastNode or
+      clearsContent(this, _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  predicate localFlowEntry(Node node, Configuration config) {
+    Stage2::revFlow(node, config) and
+    (
+      config.isSource(node) or
+      jumpStep(_, node, config) or
+      additionalJumpStep(_, node, config) or
+      node instanceof ParameterNode or
+      node instanceof OutNodeExt or
+      store(_, _, node, _) or
+      read(_, _, node) or
+      node instanceof FlowCheckNode
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(Node node, Configuration config) {
+    exists(Node next | Stage2::revFlow(next, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      store(node, _, next, _) or
+      read(node, _, next)
+    )
+    or
+    node instanceof FlowCheckNode
+    or
+    config.isSink(node)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(Node node1, Node node2, Configuration config) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    Stage2::revFlow(node1, _, _, false, pragma[only_bind_into](config)) and
+    Stage2::revFlow(node2, _, _, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    Node node1, Node node2, boolean preservesValue, DataFlowType t, Configuration config,
+    LocalCallContext cc
+  ) {
+    not isUnreachableInCall(node2, cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = getNodeType(node1)
+        or
+        additionalLocalFlowStepNodeCand2(node1, node2, config) and
+        preservesValue = false and
+        t = getNodeType(node2)
+      ) and
+      node1 != node2 and
+      cc.relevantFor(getNodeEnclosingCallable(node1)) and
+      not isUnreachableInCall(node1, cc.(LocalCallContextSpecificCall).getCall()) and
+      Stage2::revFlow(node2, pragma[only_bind_into](config))
+      or
+      exists(Node mid |
+        localFlowStepPlus(node1, mid, preservesValue, t, pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](config))
+      )
+      or
+      exists(Node mid |
+        localFlowStepPlus(node1, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = getNodeType(node2) and
+        Stage2::revFlow(node2, pragma[only_bind_into](config))
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    Node node1, Node node2, boolean preservesValue, AccessPathFrontNil apf, Configuration config,
+    LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, config)
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3 {
+  module PrevStage = Stage2;
+
+  class ApApprox = PrevStage::Ap;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  private ApApprox getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  private ApNil getApNil(Node node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(getNodeType(node))
+  }
+
+  bindingset[tc, tail]
+  private Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  private Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  class Cc = boolean;
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+
+    /** Holds if this call context may be `call`. */
+    predicate matchesCall(DataFlowCall call) { any() }
+  }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  private class LocalCc = Unit;
+
+  bindingset[call, c, outercc]
+  private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c]
+  private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) { any() }
+
+  bindingset[innercc, inner, call]
+  private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) {
+    any()
+  }
+
+  bindingset[node, cc, config]
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) { any() }
+
+  private predicate localStep(
+    Node node1, Node node2, boolean preservesValue, ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, node2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  private predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  private predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  bindingset[node, ap]
+  private predicate filter(Node node, Ap ap) {
+    not ap.isClearedAt(node) and
+    if node instanceof CastingNode then compatibleTypes(getNodeType(node), ap.getType()) else any()
+  }
+
+  bindingset[ap, contentType]
+  private predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+
+  /* Begin: Stage 3 logic. */
+  private predicate flowCand(Node node, ApApprox apa, Configuration config) {
+    PrevStage::revFlow(node, _, _, apa, config)
+  }
+
+  bindingset[result, apa]
+  private ApApprox unbindApa(ApApprox apa) {
+    exists(ApApprox apa0 |
+      apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
+    )
+  }
+
+  /**
+   * Holds if `node` is reachable with access path `ap` from a source in the
+   * configuration `config`.
+   *
+   * The call context `cc` records whether the node is reached through an
+   * argument in a call, and if so, `argAp` records the access path of that
+   * argument.
+   */
+  pragma[nomagic]
+  predicate fwdFlow(Node node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
+    fwdFlow0(node, cc, argAp, ap, config) and
+    flowCand(node, unbindApa(getApprox(ap)), config) and
+    filter(node, ap)
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlow0(Node node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
+    flowCand(node, _, config) and
+    config.isSource(node) and
+    cc = ccNone() and
+    argAp = apNone() and
+    ap = getApNil(node)
+    or
+    exists(Node mid, Ap ap0, LocalCc localCc |
+      fwdFlow(mid, cc, argAp, ap0, config) and
+      localCc = getLocalCc(mid, cc, config)
+    |
+      localStep(mid, node, true, _, config, localCc) and
+      ap = ap0
+      or
+      localStep(mid, node, false, ap, config, localCc) and
+      ap0 instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      fwdFlow(mid, _, _, ap, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      jumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(mid, _, _, nil, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      additionalJumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone() and
+      ap = getApNil(node)
+    )
+    or
+    // store
+    exists(TypedContent tc, Ap ap0 |
+      fwdFlowStore(_, ap0, tc, node, cc, argAp, config) and
+      ap = apCons(tc, ap0)
+    )
+    or
+    // read
+    exists(Ap ap0, Content c |
+      fwdFlowRead(ap0, c, _, node, cc, argAp, config) and
+      fwdFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // flow into a callable
+    exists(ApApprox apa |
+      fwdFlowIn(_, node, _, cc, _, ap, config) and
+      apa = getApprox(ap) and
+      if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+      then argAp = apSome(ap)
+      else argAp = apNone()
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, any(CcNoCall innercc), cc, argAp, ap, config)
+      or
+      exists(Ap argAp0 |
+        fwdFlowOutFromArg(call, node, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowStore(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    exists(DataFlowType contentType |
+      fwdFlow(node1, cc, argAp, ap1, config) and
+      PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+      typecheckStore(ap1, contentType)
+    )
+  }
+
+  /**
+   * Holds if forward flow with access path `tail` reaches a store of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(TypedContent tc |
+      fwdFlowStore(_, tail, tc, _, _, _, config) and
+      tc.getContent() = c and
+      cons = apCons(tc, tail)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowRead(
+    Ap ap, Content c, Node node1, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    fwdFlow(node1, cc, argAp, ap, config) and
+    PrevStage::readStepCand(node1, c, node2, config) and
+    getHeadContent(ap) = c
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowIn(
+    DataFlowCall call, ParameterNode p, Cc outercc, Cc innercc, ApOption argAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ArgumentNode arg, boolean allowsFieldFlow |
+      fwdFlow(arg, outercc, argAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      innercc = getCallContextCall(call, getNodeEnclosingCallable(p), outercc)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  /**
+   * Holds if flow may exit from `call` at `out` with access path `ap`. The
+   * inner call context is `innercc`, but `ccOut` is just the call context
+   * based on the return step. In the case of through-flow `ccOut` is discarded
+   * and replaced by the outer call context as tracked by `fwdFlowIsEntered`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowOut(
+    DataFlowCall call, Node out, Cc innercc, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, boolean allowsFieldFlow, DataFlowCallable inner |
+      fwdFlow(ret, innercc, argAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+      inner = getNodeEnclosingCallable(ret) and
+      checkCallContextReturn(innercc, inner, call) and
+      ccOut = getCallContextReturn(inner, call)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(
+    DataFlowCall call, Node out, Ap argAp, Ap ap, Configuration config
+  ) {
+    fwdFlowOut(call, out, any(CcCall ccc), _, apSome(argAp), ap, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+   * and data might flow through the target callable and back out at `call`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(
+    DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ParameterNode p |
+      fwdFlowIn(call, p, cc, _, argAp, ap, config) and
+      PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate storeStepFwd(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Ap ap2, Configuration config
+  ) {
+    fwdFlowStore(node1, ap1, tc, node2, _, _, config) and
+    ap2 = apCons(tc, ap1) and
+    fwdFlowRead(ap2, tc.getContent(), _, _, _, _, config)
+  }
+
+  private predicate readStepFwd(Node n1, Ap ap1, Content c, Node n2, Ap ap2, Configuration config) {
+    fwdFlowRead(ap1, c, n1, n2, _, _, config) and
+    fwdFlowConsCand(ap1, c, ap2, config)
+  }
+
+  /**
+   * Holds if `node` with access path `ap` is part of a path from a source to a
+   * sink in the configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from the
+   * enclosing callable in order to reach a sink, and if so, `returnAp` records
+   * the access path of the returned value.
+   */
+  pragma[nomagic]
+  predicate revFlow(Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config) {
+    revFlow0(node, toReturn, returnAp, ap, config) and
+    fwdFlow(node, _, _, ap, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(
+    Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    fwdFlow(node, _, _, ap, config) and
+    config.isSink(node) and
+    toReturn = false and
+    returnAp = apNone() and
+    ap instanceof ApNil
+    or
+    exists(Node mid |
+      localStep(node, mid, true, _, config, _) and
+      revFlow(mid, toReturn, returnAp, ap, config)
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      localStep(node, mid, false, _, config, _) and
+      revFlow(mid, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+      ap instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      jumpStep(node, mid, config) and
+      revFlow(mid, _, _, ap, config) and
+      toReturn = false and
+      returnAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      additionalJumpStep(node, mid, config) and
+      revFlow(pragma[only_bind_into](mid), _, _, nil, pragma[only_bind_into](config)) and
+      toReturn = false and
+      returnAp = apNone() and
+      ap instanceof ApNil
+    )
+    or
+    // store
+    exists(Ap ap0, Content c |
+      revFlowStore(ap0, c, ap, node, _, _, toReturn, returnAp, config) and
+      revFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // read
+    exists(Node mid, Ap ap0 |
+      revFlow(mid, toReturn, returnAp, ap0, config) and
+      readStepFwd(node, ap, _, mid, ap0, config)
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, toReturn, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(Ap returnAp0 |
+        revFlowInToReturn(call, node, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    )
+    or
+    // flow out of a callable
+    revFlowOut(_, node, _, _, ap, config) and
+    toReturn = true and
+    if fwdFlow(node, any(CcCall ccc), apSome(_), ap, config)
+    then returnAp = apSome(ap)
+    else returnAp = apNone()
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(
+    Ap ap0, Content c, Ap ap, Node node, TypedContent tc, Node mid, boolean toReturn,
+    ApOption returnAp, Configuration config
+  ) {
+    revFlow(mid, toReturn, returnAp, ap0, config) and
+    storeStepFwd(node, ap, tc, mid, ap0, config) and
+    tc.getContent() = c
+  }
+
+  /**
+   * Holds if reverse flow with access path `tail` reaches a read of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(Node mid, Ap tail0 |
+      revFlow(mid, _, _, tail, config) and
+      tail = pragma[only_bind_into](tail0) and
+      readStepFwd(_, cons, c, mid, tail0, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(
+    DataFlowCall call, ReturnNodeExt ret, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(Node out, boolean allowsFieldFlow |
+      revFlow(out, toReturn, returnAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgumentNode arg, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ParameterNode p, boolean allowsFieldFlow |
+      revFlow(p, toReturn, returnAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(
+    DataFlowCall call, ArgumentNode arg, Ap returnAp, Ap ap, Configuration config
+  ) {
+    revFlowIn(call, arg, true, apSome(returnAp), ap, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(
+    DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, CcCall ccc |
+      revFlowOut(call, ret, toReturn, returnAp, ap, config) and
+      fwdFlow(ret, ccc, apSome(_), ap, config) and
+      ccc.matchesCall(call)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    Node node1, Ap ap1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
+  ) {
+    exists(Ap ap2, Content c |
+      store(node1, tc, node2, contentType) and
+      revFlowStore(ap2, c, ap1, node1, tc, node2, _, _, config) and
+      revFlowConsCand(ap2, c, ap1, config)
+    )
+  }
+
+  predicate readStepCand(Node node1, Content c, Node node2, Configuration config) {
+    exists(Ap ap1, Ap ap2 |
+      revFlow(node2, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+      readStepFwd(node1, ap1, c, node2, ap2, config) and
+      revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlow(Node node, Configuration config) { revFlow(node, _, _, _, config) }
+
+  private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepFwd(_, ap, tc, _, _, config)
+  }
+
+  predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepCand(_, ap, tc, _, _, config)
+  }
+
+  pragma[noinline]
+  private predicate parameterFlow(
+    ParameterNode p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+  ) {
+    revFlow(p, true, apSome(ap0), ap, config) and
+    c = getNodeEnclosingCallable(p)
+  }
+
+  predicate parameterMayFlowThrough(ParameterNode p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnNodeExt ret, Ap ap0, ReturnKindExt kind, int pos |
+      parameterFlow(p, ap, ap0, c, config) and
+      c = getNodeEnclosingCallable(ret) and
+      revFlow(ret, true, apSome(_), ap0, config) and
+      fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
+      kind = ret.getKind() and
+      p.isParameterOf(_, pos) and
+      // we don't expect a parameter to return stored in itself
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+    )
+  }
+
+  predicate stats(boolean fwd, int nodes, int fields, int conscand, int tuples, Configuration config) {
+    fwd = true and
+    nodes = count(Node node | fwdFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+    tuples = count(Node n, Cc cc, ApOption argAp, Ap ap | fwdFlow(n, cc, argAp, ap, config))
+    or
+    fwd = false and
+    nodes = count(Node node | revFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | consCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+    tuples = count(Node n, boolean b, ApOption retAp, Ap ap | revFlow(n, b, retAp, ap, config))
+  }
+  /* End: Stage 3 logic. */
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(Node node, AccessPathFront argApf, Configuration config) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, true, _, apf, config) and
+    Stage3::fwdFlow(node, true, TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(Node n |
+        Stage3::revFlow(n, _, _, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4 {
+  module PrevStage = Stage3;
+
+  class ApApprox = PrevStage::Ap;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  private ApApprox getApprox(Ap ap) { result = ap.getFront() }
+
+  private ApNil getApNil(Node node) {
+    PrevStage::revFlow(node, _) and result = TNil(getNodeType(node))
+  }
+
+  bindingset[tc, tail]
+  private Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  private Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  private class LocalCc = LocalCallContext;
+
+  bindingset[call, c, outercc]
+  private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+    c = resolveCall(call, outercc) and
+    if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+  }
+
+  bindingset[call, c]
+  private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) {
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+
+  bindingset[innercc, inner, call]
+  private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) {
+    resolveReturn(innercc, inner, call)
+    or
+    innercc.(CallContextCall).matchesCall(call)
+  }
+
+  bindingset[node, cc, config]
+  private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
+  }
+
+  private predicate localStep(
+    Node node1, Node node2, boolean preservesValue, ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, node2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  private predicate flowOutOfCall(
+    DataFlowCall call, ReturnNodeExt node1, Node node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+    PrevStage::revFlow(node2, _, _, _, pragma[only_bind_into](config)) and
+    PrevStage::revFlow(node1, _, _, _, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  private predicate flowIntoCall(
+    DataFlowCall call, ArgumentNode node1, ParameterNode node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+    PrevStage::revFlow(node2, _, _, _, pragma[only_bind_into](config)) and
+    PrevStage::revFlow(node1, _, _, _, pragma[only_bind_into](config))
+  }
+
+  bindingset[node, ap]
+  private predicate filter(Node node, Ap ap) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+
+  /* Begin: Stage 4 logic. */
+  private predicate flowCand(Node node, ApApprox apa, Configuration config) {
+    PrevStage::revFlow(node, _, _, apa, config)
+  }
+
+  bindingset[result, apa]
+  private ApApprox unbindApa(ApApprox apa) {
+    exists(ApApprox apa0 |
+      apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
+    )
+  }
+
+  /**
+   * Holds if `node` is reachable with access path `ap` from a source in the
+   * configuration `config`.
+   *
+   * The call context `cc` records whether the node is reached through an
+   * argument in a call, and if so, `argAp` records the access path of that
+   * argument.
+   */
+  pragma[nomagic]
+  predicate fwdFlow(Node node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
+    fwdFlow0(node, cc, argAp, ap, config) and
+    flowCand(node, unbindApa(getApprox(ap)), config) and
+    filter(node, ap)
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlow0(Node node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
+    flowCand(node, _, config) and
+    config.isSource(node) and
+    cc = ccNone() and
+    argAp = apNone() and
+    ap = getApNil(node)
+    or
+    exists(Node mid, Ap ap0, LocalCc localCc |
+      fwdFlow(mid, cc, argAp, ap0, config) and
+      localCc = getLocalCc(mid, cc, config)
+    |
+      localStep(mid, node, true, _, config, localCc) and
+      ap = ap0
+      or
+      localStep(mid, node, false, ap, config, localCc) and
+      ap0 instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      fwdFlow(mid, _, _, ap, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      jumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(mid, _, _, nil, pragma[only_bind_into](config)) and
+      flowCand(node, _, pragma[only_bind_into](config)) and
+      additionalJumpStep(mid, node, config) and
+      cc = ccNone() and
+      argAp = apNone() and
+      ap = getApNil(node)
+    )
+    or
+    // store
+    exists(TypedContent tc, Ap ap0 |
+      fwdFlowStore(_, ap0, tc, node, cc, argAp, config) and
+      ap = apCons(tc, ap0)
+    )
+    or
+    // read
+    exists(Ap ap0, Content c |
+      fwdFlowRead(ap0, c, _, node, cc, argAp, config) and
+      fwdFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // flow into a callable
+    exists(ApApprox apa |
+      fwdFlowIn(_, node, _, cc, _, ap, config) and
+      apa = getApprox(ap) and
+      if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+      then argAp = apSome(ap)
+      else argAp = apNone()
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, any(CcNoCall innercc), cc, argAp, ap, config)
+      or
+      exists(Ap argAp0 |
+        fwdFlowOutFromArg(call, node, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowStore(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    exists(DataFlowType contentType |
+      fwdFlow(node1, cc, argAp, ap1, config) and
+      PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+      typecheckStore(ap1, contentType)
+    )
+  }
+
+  /**
+   * Holds if forward flow with access path `tail` reaches a store of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(TypedContent tc |
+      fwdFlowStore(_, tail, tc, _, _, _, config) and
+      tc.getContent() = c and
+      cons = apCons(tc, tail)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowRead(
+    Ap ap, Content c, Node node1, Node node2, Cc cc, ApOption argAp, Configuration config
+  ) {
+    fwdFlow(node1, cc, argAp, ap, config) and
+    PrevStage::readStepCand(node1, c, node2, config) and
+    getHeadContent(ap) = c
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowIn(
+    DataFlowCall call, ParameterNode p, Cc outercc, Cc innercc, ApOption argAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ArgumentNode arg, boolean allowsFieldFlow |
+      fwdFlow(arg, outercc, argAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      innercc = getCallContextCall(call, getNodeEnclosingCallable(p), outercc)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  /**
+   * Holds if flow may exit from `call` at `out` with access path `ap`. The
+   * inner call context is `innercc`, but `ccOut` is just the call context
+   * based on the return step. In the case of through-flow `ccOut` is discarded
+   * and replaced by the outer call context as tracked by `fwdFlowIsEntered`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowOut(
+    DataFlowCall call, Node out, Cc innercc, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, boolean allowsFieldFlow, DataFlowCallable inner |
+      fwdFlow(ret, innercc, argAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+      inner = getNodeEnclosingCallable(ret) and
+      checkCallContextReturn(innercc, inner, call) and
+      ccOut = getCallContextReturn(inner, call)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(
+    DataFlowCall call, Node out, Ap argAp, Ap ap, Configuration config
+  ) {
+    fwdFlowOut(call, out, any(CcCall ccc), _, apSome(argAp), ap, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+   * and data might flow through the target callable and back out at `call`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(
+    DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+  ) {
+    exists(ParameterNode p |
+      fwdFlowIn(call, p, cc, _, argAp, ap, config) and
+      PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate storeStepFwd(
+    Node node1, Ap ap1, TypedContent tc, Node node2, Ap ap2, Configuration config
+  ) {
+    fwdFlowStore(node1, ap1, tc, node2, _, _, config) and
+    ap2 = apCons(tc, ap1) and
+    fwdFlowRead(ap2, tc.getContent(), _, _, _, _, config)
+  }
+
+  private predicate readStepFwd(Node n1, Ap ap1, Content c, Node n2, Ap ap2, Configuration config) {
+    fwdFlowRead(ap1, c, n1, n2, _, _, config) and
+    fwdFlowConsCand(ap1, c, ap2, config)
+  }
+
+  /**
+   * Holds if `node` with access path `ap` is part of a path from a source to a
+   * sink in the configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from the
+   * enclosing callable in order to reach a sink, and if so, `returnAp` records
+   * the access path of the returned value.
+   */
+  pragma[nomagic]
+  predicate revFlow(Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config) {
+    revFlow0(node, toReturn, returnAp, ap, config) and
+    fwdFlow(node, _, _, ap, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(
+    Node node, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    fwdFlow(node, _, _, ap, config) and
+    config.isSink(node) and
+    toReturn = false and
+    returnAp = apNone() and
+    ap instanceof ApNil
+    or
+    exists(Node mid |
+      localStep(node, mid, true, _, config, _) and
+      revFlow(mid, toReturn, returnAp, ap, config)
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      localStep(node, mid, false, _, config, _) and
+      revFlow(mid, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+      ap instanceof ApNil
+    )
+    or
+    exists(Node mid |
+      jumpStep(node, mid, config) and
+      revFlow(mid, _, _, ap, config) and
+      toReturn = false and
+      returnAp = apNone()
+    )
+    or
+    exists(Node mid, ApNil nil |
+      fwdFlow(node, _, _, ap, pragma[only_bind_into](config)) and
+      additionalJumpStep(node, mid, config) and
+      revFlow(pragma[only_bind_into](mid), _, _, nil, pragma[only_bind_into](config)) and
+      toReturn = false and
+      returnAp = apNone() and
+      ap instanceof ApNil
+    )
+    or
+    // store
+    exists(Ap ap0, Content c |
+      revFlowStore(ap0, c, ap, node, _, _, toReturn, returnAp, config) and
+      revFlowConsCand(ap0, c, ap, config)
+    )
+    or
+    // read
+    exists(Node mid, Ap ap0 |
+      revFlow(mid, toReturn, returnAp, ap0, config) and
+      readStepFwd(node, ap, _, mid, ap0, config)
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, toReturn, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(Ap returnAp0 |
+        revFlowInToReturn(call, node, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    )
+    or
+    // flow out of a callable
+    revFlowOut(_, node, _, _, ap, config) and
+    toReturn = true and
+    if fwdFlow(node, any(CcCall ccc), apSome(_), ap, config)
+    then returnAp = apSome(ap)
+    else returnAp = apNone()
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(
+    Ap ap0, Content c, Ap ap, Node node, TypedContent tc, Node mid, boolean toReturn,
+    ApOption returnAp, Configuration config
+  ) {
+    revFlow(mid, toReturn, returnAp, ap0, config) and
+    storeStepFwd(node, ap, tc, mid, ap0, config) and
+    tc.getContent() = c
+  }
+
+  /**
+   * Holds if reverse flow with access path `tail` reaches a read of `c`
+   * resulting in access path `cons`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+    exists(Node mid, Ap tail0 |
+      revFlow(mid, _, _, tail, config) and
+      tail = pragma[only_bind_into](tail0) and
+      readStepFwd(_, cons, c, mid, tail0, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(
+    DataFlowCall call, ReturnNodeExt ret, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(Node out, boolean allowsFieldFlow |
+      revFlow(out, toReturn, returnAp, ap, config) and
+      flowOutOfCall(call, ret, out, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgumentNode arg, boolean toReturn, ApOption returnAp, Ap ap,
+    Configuration config
+  ) {
+    exists(ParameterNode p, boolean allowsFieldFlow |
+      revFlow(p, toReturn, returnAp, ap, config) and
+      flowIntoCall(call, arg, p, allowsFieldFlow, config)
+    |
+      ap instanceof ApNil or allowsFieldFlow = true
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(
+    DataFlowCall call, ArgumentNode arg, Ap returnAp, Ap ap, Configuration config
+  ) {
+    revFlowIn(call, arg, true, apSome(returnAp), ap, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(
+    DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+  ) {
+    exists(ReturnNodeExt ret, CcCall ccc |
+      revFlowOut(call, ret, toReturn, returnAp, ap, config) and
+      fwdFlow(ret, ccc, apSome(_), ap, config) and
+      ccc.matchesCall(call)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    Node node1, Ap ap1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
+  ) {
+    exists(Ap ap2, Content c |
+      store(node1, tc, node2, contentType) and
+      revFlowStore(ap2, c, ap1, node1, tc, node2, _, _, config) and
+      revFlowConsCand(ap2, c, ap1, config)
+    )
+  }
+
+  predicate readStepCand(Node node1, Content c, Node node2, Configuration config) {
+    exists(Ap ap1, Ap ap2 |
+      revFlow(node2, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+      readStepFwd(node1, ap1, c, node2, ap2, config) and
+      revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlow(Node node, Configuration config) { revFlow(node, _, _, _, config) }
+
+  private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepFwd(_, ap, tc, _, _, config)
+  }
+
+  predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+    storeStepCand(_, ap, tc, _, _, config)
+  }
+
+  pragma[noinline]
+  private predicate parameterFlow(
+    ParameterNode p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+  ) {
+    revFlow(p, true, apSome(ap0), ap, config) and
+    c = getNodeEnclosingCallable(p)
+  }
+
+  predicate parameterMayFlowThrough(ParameterNode p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnNodeExt ret, Ap ap0, ReturnKindExt kind, int pos |
+      parameterFlow(p, ap, ap0, c, config) and
+      c = getNodeEnclosingCallable(ret) and
+      revFlow(ret, true, apSome(_), ap0, config) and
+      fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
+      kind = ret.getKind() and
+      p.isParameterOf(_, pos) and
+      // we don't expect a parameter to return stored in itself
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+    )
+  }
+
+  predicate stats(boolean fwd, int nodes, int fields, int conscand, int tuples, Configuration config) {
+    fwd = true and
+    nodes = count(Node node | fwdFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+    tuples = count(Node n, Cc cc, ApOption argAp, Ap ap | fwdFlow(n, cc, argAp, ap, config))
+    or
+    fwd = false and
+    nodes = count(Node node | revFlow(node, _, _, _, config)) and
+    fields = count(TypedContent f0 | consCand(f0, _, config)) and
+    conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+    tuples = count(Node n, boolean b, ApOption retAp, Ap ap | revFlow(n, b, retAp, ap, config))
+  }
+  /* End: Stage 4 logic. */
+}
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+private predicate nodeMayUseSummary(Node n, AccessPathApprox apa, Configuration config) {
+  exists(DataFlowCallable c, AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, apa, _) and
+    Stage4::revFlow(n, true, _, apa0, config) and
+    Stage4::fwdFlow(n, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    getNodeEnclosingCallable(n) = c
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParameterNode p, AccessPath ap) {
+    Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), _)
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParameterNode p;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, ap) }
+
+  int getParameterPos() { p.isParameterOf(_, result) }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(Node n | Stage4::revFlow(n, _, _, apa, config) or nodeMayUseSummary(n, apa, config))
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = countPotentialAps(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+  )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(Node node, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, config) and
+    config.isSource(node) and
+    cc instanceof CallContextAny and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(getNodeType(node))
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, _, _, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(Node node, Configuration config) {
+    pragma[only_bind_into](config).isSink(node) and
+    Stage4::revFlow(node, pragma[only_bind_into](config)) and
+    (
+      // A sink that is also a source ...
+      config.isSource(node)
+      or
+      // ... or a sink that can be reached from a source
+      exists(PathNodeMid mid |
+        pathStep(mid, node, _, _, TAccessPathNil(_)) and
+        pragma[only_bind_into](config) = mid.getConfiguration()
+      )
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  Node getNode() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  private predicate isHidden() {
+    nodeIsHidden(this.getNode()) and
+    not this.isSource() and
+    not this instanceof PathNodeSink
+  }
+
+  private PathNode getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.(PathNodeImpl).getASuccessorImpl()
+  }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNode getASuccessorImpl();
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNode().toString() + ppAp() }
+
+  override string toStringWithContext() { result = this.getNode().toString() + ppAp() + ppCtx() }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
+
+/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { pathSucc(a, b) }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  Node node;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, cc, sc, ap, config) }
+
+  override Node getNode() { result = node }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNode(), result.getCallContext(), result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = getSuccMid()
+    or
+    // a final step to a sink via zero steps means we merge the last two steps to prevent trivial-looking edges
+    exists(PathNodeMid mid, PathNodeSink sink |
+      mid = getSuccMid() and
+      mid.getNode() = sink.getNode() and
+      mid.getAp() instanceof AccessPathNil and
+      sink.getConfiguration() = unbindConf(mid.getConfiguration()) and
+      result = sink
+    )
+  }
+
+  override predicate isSource() {
+    config.isSource(node) and
+    cc instanceof CallContextAny and
+    sc instanceof SummaryCtxNone and
+    ap instanceof AccessPathNil
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  Node node;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, config) }
+
+  override Node getNode() { result = node }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNode getASuccessorImpl() { none() }
+
+  override predicate isSource() { config.isSource(node) }
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCtx sc, AccessPath ap) {
+  exists(AccessPath ap0, Node midnode, Configuration conf, LocalCallContext localCC |
+    midnode = mid.getNode() and
+    conf = mid.getConfiguration() and
+    cc = mid.getCallContext() and
+    sc = mid.getSummaryCtx() and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
+    ap0 = mid.getAp()
+  |
+    localFlowBigStep(midnode, node, true, _, conf, localCC) and
+    ap = ap0
+    or
+    localFlowBigStep(midnode, node, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNode(), node, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNode(), node, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(getNodeType(node))
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, _, cc, sc, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, Node node, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNode(), tc.getContent(), node, mid.getConfiguration()) and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, Node node, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNode(), _, tc, node, _, mid.getConfiguration()) and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = getReturnPosition(mid.getNode()) and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, CallContext cc, AccessPathApprox apa,
+  Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private Node getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa
+) {
+  exists(ArgumentNode arg |
+    arg = mid.getNode() and
+    cc = mid.getCallContext() and
+    arg.argumentOf(call, i) and
+    ap = mid.getAp() and
+    apa = ap.getApprox()
+  )
+}
+
+pragma[noinline]
+private predicate parameterCand(
+  DataFlowCallable callable, int i, AccessPathApprox apa, Configuration config
+) {
+  exists(ParameterNode p |
+    Stage4::revFlow(p, _, _, apa, config) and
+    p.isParameterOf(callable, i)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
+  AccessPath ap
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, i, outercc, call, ap, apa) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, any(int j | j <= i and j >= i), apa, mid.getConfiguration())
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, SummaryCtx sc,
+  DataFlowCall call
+) {
+  exists(int i, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, i, outercc, call, ap) and
+    p.isParameterOf(callable, i) and
+    (
+      sc = TSummaryCtxSome(p, ap)
+      or
+      not exists(TSummaryCtxSome(p, ap)) and
+      sc = TSummaryCtxNone()
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, CallContextCall cc, SummaryCtxSome sc, AccessPath ap, AccessPathApprox apa,
+  Configuration config
+) {
+  exists(PathNodeMid mid, ReturnNodeExt ret, int pos |
+    mid.getNode() = ret and
+    kind = ret.getKind() and
+    cc = mid.getCallContext() and
+    sc = mid.getSummaryCtx() and
+    config = mid.getConfiguration() and
+    ap = mid.getAp() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    not kind.(ParamUpdateReturnKind).getPosition() = pos
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, CallContext cc, AccessPath ap,
+  AccessPathApprox apa
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, cc, innercc, sc, call) and
+    paramFlowsThrough(kind, innercc, sc, ap, apa, unbindConf(mid.getConfiguration()))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPath ap) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa |
+    pathThroughCallable0(call, mid, kind, cc, ap, apa) and
+    out = getAnOutNodeFlow(kind, call, apa, unbindConf(mid.getConfiguration()))
+  )
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.getNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(boolean fwd, int nodes, int fields, int conscand, int tuples) {
+  fwd = true and
+  nodes = count(Node n0 | exists(PathNode pn | pn.getNode() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(Node n0 | exists(PathNode pn | pn.getNode() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int tuples, Configuration config
+) {
+  stage = "1 Fwd" and n = 10 and Stage1::stats(true, nodes, fields, conscand, tuples, config)
+  or
+  stage = "1 Rev" and n = 15 and Stage1::stats(false, nodes, fields, conscand, tuples, config)
+  or
+  stage = "2 Fwd" and n = 20 and Stage2::stats(true, nodes, fields, conscand, tuples, config)
+  or
+  stage = "2 Rev" and n = 25 and Stage2::stats(false, nodes, fields, conscand, tuples, config)
+  or
+  stage = "3 Fwd" and n = 30 and Stage3::stats(true, nodes, fields, conscand, tuples, config)
+  or
+  stage = "3 Rev" and n = 35 and Stage3::stats(false, nodes, fields, conscand, tuples, config)
+  or
+  stage = "4 Fwd" and n = 40 and Stage4::stats(true, nodes, fields, conscand, tuples, config)
+  or
+  stage = "4 Rev" and n = 45 and Stage4::stats(false, nodes, fields, conscand, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(Node node1, Node node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      // flow into callable
+      viableParamArg(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOut(_, getReturnPosition(node1), node2)
+    |
+      c1 = getNodeEnclosingCallable(node1) and
+      c2 = getNodeEnclosingCallable(node2) and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) and c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) and c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      config.isSource(n) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      config.isSink(n) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParameterNode p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      Node node, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, PartialAccessPath ap,
+      Configuration config
+    ) {
+      config.isSource(node) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      ap = TPartialNil(getNodeType(node)) and
+      not fullBarrier(node, config) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, cc, sc1, sc2, ap, config) and
+      distSrc(getNodeEnclosingCallable(node), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      Node node, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, RevPartialAccessPath ap,
+      Configuration config
+    ) {
+      config.isSink(node) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      ap = TRevPartialNil() and
+      not fullBarrier(node, config) and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
+        not fullBarrier(node, config) and
+        distSink(getNodeEnclosingCallable(node), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    Node node, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
+      not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
+      if node instanceof CastingNode
+      then compatibleTypes(getNodeType(node), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNode().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() { result = this.getNode().toString() + this.ppAp() + this.ppCtx() }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    Node getNode() { none() }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(getNodeEnclosingCallable(this.getNode()), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(getNodeEnclosingCallable(this.getNode()), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    Node node;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, cc, sc1, sc2, ap, config) }
+
+    override Node getNode() { result = node }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNode(), result.getCallContext(), result.getSummaryCtx1(),
+        result.getSummaryCtx2(), result.getAp(), result.getConfiguration())
+    }
+
+    predicate isSource() {
+      config.isSource(node) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    Node node;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, sc1, sc2, ap, config) }
+
+    override Node getNode() { result = node }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNode(), this.getSummaryCtx1(), this.getSummaryCtx2(),
+        this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      config.isSink(node) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, Node node, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCall(node, cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNode(), node, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNode(), node, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(getNodeType(node)) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNode(), node, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNode(), node, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(getNodeType(node)) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      apConsFwd(ap, tc, ap0, config) and
+      compatibleTypes(ap.getType(), getNodeType(node))
+    )
+    or
+    partialPathIntoCallable(mid, node, _, cc, sc1, sc2, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None()
+    or
+    partialPathThroughCallable(mid, node, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { i <= result and i >= result }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, Node node, PartialAccessPath ap2
+  ) {
+    exists(Node midNode, DataFlowType contentType |
+      midNode = mid.getNode() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, Node node, CallContext cc,
+    Configuration config
+  ) {
+    exists(Node midNode |
+      midNode = mid.getNode() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node) and
+      ap.getHead() = tc and
+      config = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, CallContext innercc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    pos = getReturnPosition(mid.getNode()) and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, Node out, CallContext cc, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
+    |
+      out = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, int i, CallContext cc, DataFlowCall call, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ArgumentNode arg |
+      arg = mid.getNode() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, i) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, int i, CallContext outercc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, i, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParameterNode p, CallContext outercc, CallContextCall innercc,
+    TSummaryCtx1 sc1, TSummaryCtx2 sc2, DataFlowCall call, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(int i, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, i, outercc, call, ap, config) and
+      p.isParameterOf(callable, i) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, ReturnNodeExt ret |
+      mid.getNode() = ret and
+      kind = ret.getKind() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterNode p, CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2 |
+      partialPathIntoCallable(mid, p, cc, innercc, sc1, sc2, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, innercc, sc1, sc2, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, Node out, CallContext cc, PartialAccessPath ap, Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, cc, ap, config) and
+      out = kind.getAnOutNode(call)
+    )
+  }
+
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, Node node, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNode(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNode(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNode(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNode(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParameterNode p |
+      mid.getNode() = p and
+      viableParamArg(_, p, node) and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, sc1, sc2, _, ap, config) and
+      pos = getReturnPosition(node)
+    )
+    or
+    revPartialPathThroughCallable(mid, node, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, Node node, RevPartialAccessPath ap2
+  ) {
+    exists(Node midNode |
+      midNode = mid.getNode() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, Node node, Configuration config
+  ) {
+    exists(Node midNode, TypedContent tc |
+      midNode = mid.getNode() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    DataFlowCall call, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(Node out |
+      mid.getNode() = out and
+      viableReturnPosOut(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    int pos, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParameterNode p |
+      mid.getNode() = p and
+      p.isParameterOf(_, pos) and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, int pos, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2 |
+      revPartialPathIntoReturn(mid, _, sc1, sc2, call, _, config) and
+      revPartialPathFlowsThrough(pos, sc1, sc2, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgumentNode node, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(DataFlowCall call, int pos |
+      revPartialPathThroughCallable0(call, mid, pos, ap, config) and
+      node.argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/java/ql/src/semmle/code/java/security/Random.qll b/java/ql/src/semmle/code/java/security/Random.qll
index f589cfac9cad..75ee912a8957 100644
--- a/java/ql/src/semmle/code/java/security/Random.qll
+++ b/java/ql/src/semmle/code/java/security/Random.qll
@@ -1,6 +1,6 @@
 import java
 import semmle.code.java.dataflow.DefUse
-import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.DataFlow6
 
 /**
  * The `java.security.SecureRandom` class.
@@ -166,16 +166,16 @@ private predicate isSeeded(RValue use) {
   )
 }
 
-private class PredictableSeedFlowConfiguration extends DataFlow::Configuration {
+private class PredictableSeedFlowConfiguration extends DataFlow6::Configuration {
   PredictableSeedFlowConfiguration() { this = "Random::PredictableSeedFlowConfiguration" }
 
-  override predicate isSource(DataFlow::Node source) {
+  override predicate isSource(DataFlow6::Node source) {
     source.asExpr() instanceof PredictableSeedExpr
   }
 
-  override predicate isSink(DataFlow::Node sink) { isSeeding(sink.asExpr(), _) }
+  override predicate isSink(DataFlow6::Node sink) { isSeeding(sink.asExpr(), _) }
 
-  override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+  override predicate isAdditionalFlowStep(DataFlow6::Node node1, DataFlow6::Node node2) {
     predictableCalcStep(node1.asExpr(), node2.asExpr())
   }
 }
@@ -252,7 +252,7 @@ private predicate isSeeding(Expr arg, RValue use) {
 private predicate isSeedingSource(Expr arg, RValue use, Expr source) {
   isSeeding(arg, use) and
   exists(PredictableSeedFlowConfiguration conf |
-    conf.hasFlow(DataFlow::exprNode(source), DataFlow::exprNode(arg))
+    conf.hasFlow(DataFlow6::exprNode(source), DataFlow6::exprNode(arg))
   )
 }
 

From e08b629cb57ee7086e4df12b519a5ca2ff50a1b8 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 27 Apr 2021 10:32:41 +0200
Subject: [PATCH 423/433] Add documentation for URL opening sinks

---
 java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
index d1bce930054a..a68998b32118 100644
--- a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
+++ b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
@@ -36,7 +36,7 @@ class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HTTPString }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "open-url") }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof URLOpenSink }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(UrlConstructorCall u |
@@ -50,6 +50,13 @@ class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
   }
 }
 
+/**
+ * A sink that represents a URL opening method call, such as a call to `java.net.URL.openConnection()`.
+ */
+private class URLOpenSink extends DataFlow::Node {
+  URLOpenSink() { sinkNode(this, "open-url") }
+}
+
 from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess m, HTTPString s
 where
   source.getNode().asExpr() = s and

From 5b79094f34b9833e4706206bc8719c8459921558 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 27 Apr 2021 14:59:52 +0200
Subject: [PATCH 424/433] Fix naming in HTTPS URL check

---
 java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
index a68998b32118..77980f033f0b 100644
--- a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
+++ b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
@@ -15,8 +15,8 @@ import semmle.code.java.frameworks.Networking
 import DataFlow::PathGraph
 private import semmle.code.java.dataflow.ExternalFlow
 
-class HTTPString extends StringLiteral {
-  HTTPString() {
+class HttpString extends StringLiteral {
+  HttpString() {
     // Avoid matching "https" here.
     exists(string s | this.getRepresentedString() = s |
       (
@@ -31,12 +31,12 @@ class HTTPString extends StringLiteral {
   }
 }
 
-class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
-  HTTPStringToURLOpenMethodFlowConfig() { this = "HttpsUrls::HTTPStringToURLOpenMethodFlowConfig" }
+class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
+  HttpStringToUrlOpenMethodFlowConfig() { this = "HttpsUrls::HttpStringToUrlOpenMethodFlowConfig" }
 
-  override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HTTPString }
+  override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HttpString }
 
-  override predicate isSink(DataFlow::Node sink) { sink instanceof URLOpenSink }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof UrlOpenSink }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(UrlConstructorCall u |
@@ -53,14 +53,14 @@ class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
 /**
  * A sink that represents a URL opening method call, such as a call to `java.net.URL.openConnection()`.
  */
-private class URLOpenSink extends DataFlow::Node {
-  URLOpenSink() { sinkNode(this, "open-url") }
+private class UrlOpenSink extends DataFlow::Node {
+  UrlOpenSink() { sinkNode(this, "open-url") }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess m, HTTPString s
+from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess m, HttpString s
 where
   source.getNode().asExpr() = s and
   sink.getNode().asExpr() = m.getQualifier() and
-  any(HTTPStringToURLOpenMethodFlowConfig c).hasFlowPath(source, sink)
+  any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
 select m, source, sink, "URL may have been constructed with HTTP protocol, using $@.", s,
   "this source"

From 51e08d494093b230eafb479782a9a2d42fd19cd2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 27 Apr 2021 15:43:19 +0200
Subject: [PATCH 425/433] Fix error severity

---
 csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql         | 2 +-
 .../diagnostics/DiagnosticExtractorErrors.expected              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
index 91ed4a7b8838..23943d8491fb 100644
--- a/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
+++ b/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -60,4 +60,4 @@ private class DiagnosticExtractorError extends DiagnosticError {
 }
 
 from DiagnosticError error
-select error.getMessage(), 3
+select error.getMessage(), 2
diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
index e47e78cdce94..e4ae5ec1ef29 100644
--- a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
+++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.expected
@@ -1 +1 @@
-| Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 3 |
+| Unexpected C# extractor error in Program.cs: Unable to resolve target for call. (Compilation error?) | 2 |

From 9178f4b1c570a74dd9fada5a9bed202b8c855673 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 27 Apr 2021 15:57:17 +0200
Subject: [PATCH 426/433] add support for the anser library

---
 javascript/change-notes/2021-04-27-anser.md   |  4 +++
 javascript/ql/src/javascript.qll              |  1 +
 .../semmle/javascript/frameworks/Anser.qll    | 31 +++++++++++++++++++
 .../XssThroughDom/XssThroughDom.expected      | 19 ++++++++++++
 .../CWE-079/XssThroughDom/xss-through-dom.js  |  6 ++++
 5 files changed, 61 insertions(+)
 create mode 100644 javascript/change-notes/2021-04-27-anser.md
 create mode 100644 javascript/ql/src/semmle/javascript/frameworks/Anser.qll

diff --git a/javascript/change-notes/2021-04-27-anser.md b/javascript/change-notes/2021-04-27-anser.md
new file mode 100644
index 000000000000..f3808066f48f
--- /dev/null
+++ b/javascript/change-notes/2021-04-27-anser.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The security queries now track taint through the anser library. 
+  Affected packages are
+    [anser](https://www.npmjs.com/package/anser)
\ No newline at end of file
diff --git a/javascript/ql/src/javascript.qll b/javascript/ql/src/javascript.qll
index b565a7cd21f9..4660d7eaf93f 100644
--- a/javascript/ql/src/javascript.qll
+++ b/javascript/ql/src/javascript.qll
@@ -68,6 +68,7 @@ import semmle.javascript.dataflow.TaintTracking
 import semmle.javascript.dataflow.TypeInference
 import semmle.javascript.frameworks.Angular2
 import semmle.javascript.frameworks.AngularJS
+import semmle.javascript.frameworks.Anser
 import semmle.javascript.frameworks.AsyncPackage
 import semmle.javascript.frameworks.AWS
 import semmle.javascript.frameworks.Azure
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Anser.qll b/javascript/ql/src/semmle/javascript/frameworks/Anser.qll
new file mode 100644
index 000000000000..77525689fa44
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/Anser.qll
@@ -0,0 +1,31 @@
+/**
+ * Provides classes for working with applications using [anser](https://www.npmjs.com/package/anser).
+ */
+
+import javascript
+
+/**
+ * A taint step for the [anser](https://www.npmjs.com/package/anser) library.
+ */
+private class AnserTaintStep extends TaintTracking::SharedTaintStep {
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(API::CallNode call |
+      call =
+        API::moduleImport("anser")
+            .getMember(["linkify", "ansiToHtml", "ansiToText", "ansiToJson"])
+            .getACall()
+      or
+      call =
+        API::moduleImport("anser")
+            .getInstance()
+            .getMember([
+                "linkify", "ansiToHtml", "ansiToText", "ansiToJson", "process", "processChunkJson",
+                "processChunk"
+              ])
+            .getACall()
+    |
+      succ = call and
+      pred = call.getArgument(0)
+    )
+  }
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
index b88c3eae8ef3..b726a851f09e 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
@@ -103,6 +103,15 @@ nodes
 | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') |
 | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') |
 | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') |
+| xss-through-dom.js:84:8:84:30 | text |
+| xss-through-dom.js:84:15:84:30 | $("text").text() |
+| xss-through-dom.js:84:15:84:30 | $("text").text() |
+| xss-through-dom.js:86:16:86:37 | anser.a ... l(text) |
+| xss-through-dom.js:86:16:86:37 | anser.a ... l(text) |
+| xss-through-dom.js:86:33:86:36 | text |
+| xss-through-dom.js:87:16:87:40 | new ans ... s(text) |
+| xss-through-dom.js:87:16:87:40 | new ans ... s(text) |
+| xss-through-dom.js:87:36:87:39 | text |
 edges
 | forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
 | forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
@@ -161,6 +170,14 @@ edges
 | xss-through-dom.js:73:20:73:41 | $("inpu ... 0).name | xss-through-dom.js:73:9:73:41 | selector |
 | xss-through-dom.js:79:4:79:34 | documen ... t.value | xss-through-dom.js:79:4:79:34 | documen ... t.value |
 | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') |
+| xss-through-dom.js:84:8:84:30 | text | xss-through-dom.js:86:33:86:36 | text |
+| xss-through-dom.js:84:8:84:30 | text | xss-through-dom.js:87:36:87:39 | text |
+| xss-through-dom.js:84:15:84:30 | $("text").text() | xss-through-dom.js:84:8:84:30 | text |
+| xss-through-dom.js:84:15:84:30 | $("text").text() | xss-through-dom.js:84:8:84:30 | text |
+| xss-through-dom.js:86:33:86:36 | text | xss-through-dom.js:86:16:86:37 | anser.a ... l(text) |
+| xss-through-dom.js:86:33:86:36 | text | xss-through-dom.js:86:16:86:37 | anser.a ... l(text) |
+| xss-through-dom.js:87:36:87:39 | text | xss-through-dom.js:87:16:87:40 | new ans ... s(text) |
+| xss-through-dom.js:87:36:87:39 | text | xss-through-dom.js:87:16:87:40 | new ans ... s(text) |
 #select
 | forms.js:9:31:9:40 | values.foo | forms.js:8:23:8:28 | values | forms.js:9:31:9:40 | values.foo | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:8:23:8:28 | values | DOM text |
 | forms.js:12:31:12:40 | values.bar | forms.js:11:24:11:29 | values | forms.js:12:31:12:40 | values.bar | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:11:24:11:29 | values | DOM text |
@@ -190,3 +207,5 @@ edges
 | xss-through-dom.js:77:4:77:11 | selector | xss-through-dom.js:73:20:73:41 | $("inpu ... 0).name | xss-through-dom.js:77:4:77:11 | selector | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:73:20:73:41 | $("inpu ... 0).name | DOM text |
 | xss-through-dom.js:79:4:79:34 | documen ... t.value | xss-through-dom.js:79:4:79:34 | documen ... t.value | xss-through-dom.js:79:4:79:34 | documen ... t.value | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:79:4:79:34 | documen ... t.value | DOM text |
 | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:81:17:81:43 | $('#foo ... rText') | DOM text |
+| xss-through-dom.js:86:16:86:37 | anser.a ... l(text) | xss-through-dom.js:84:15:84:30 | $("text").text() | xss-through-dom.js:86:16:86:37 | anser.a ... l(text) | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:84:15:84:30 | $("text").text() | DOM text |
+| xss-through-dom.js:87:16:87:40 | new ans ... s(text) | xss-through-dom.js:84:15:84:30 | $("text").text() | xss-through-dom.js:87:16:87:40 | new ans ... s(text) | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:84:15:84:30 | $("text").text() | DOM text |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
index 9f85627ee7c7..0e6555fe5685 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
@@ -79,4 +79,10 @@
 	$(document.my_form.my_input.value); // NOT OK
 
 	$("#id").html( $('#foo').prop('innerText') ); // NOT OK
+
+	const anser = require("anser");
+	const text = $("text").text();
+
+	$("#id").html(anser.ansiToHtml(text)); // NOT OK
+	$("#id").html(new anser().process(text)); // NOT OK
 })();
\ No newline at end of file

From c27363cea53d82bed873d77217e7549dca602ae9 Mon Sep 17 00:00:00 2001
From: Chuan-kai Lin <cklin@github.com>
Date: Tue, 27 Apr 2021 13:57:16 -0700
Subject: [PATCH 427/433] Fix inconsistencies in information about the thief

The find-the-thief exercise is inconsistent.  The first part lists 10 answered questions about the thief, but later discussion silently adds a new question as question 8, so there are a total of 11 answered questions.

This commit updates the first list of answered questions so that it matches later discussions and the sample solution.
---
 docs/codeql/writing-codeql-queries/find-the-thief.rst | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/docs/codeql/writing-codeql-queries/find-the-thief.rst b/docs/codeql/writing-codeql-queries/find-the-thief.rst
index 131423b80585..ff9ee49f5dc4 100644
--- a/docs/codeql/writing-codeql-queries/find-the-thief.rst
+++ b/docs/codeql/writing-codeql-queries/find-the-thief.rst
@@ -39,11 +39,13 @@ You start asking some creative questions and making notes of the answers so you
 +------+--------------------------------------------------------------------+--------+
 | (7)  | Is the thief taller than 180cm and shorter than 190cm?             | no     |
 +------+--------------------------------------------------------------------+--------+
-| (8)  | Is the thief the tallest person in the village?                    | no     |
+| (8)  | Is the thief the oldest person in the village?                     | no     |
 +------+--------------------------------------------------------------------+--------+
-| (9)  | Is the thief shorter than the average villager?                    | yes    |
+| (9)  | Is the thief the tallest person in the village?                    | no     |
 +------+--------------------------------------------------------------------+--------+
-| (10) | Is the thief the oldest person in the eastern part of the village? | yes    |
+| (10) | Is the thief shorter than the average villager?                    | yes    |
++------+--------------------------------------------------------------------+--------+
+| (11) | Is the thief the oldest person in the eastern part of the village? | yes    |
 +------+--------------------------------------------------------------------+--------+
 
 There is too much information to search through by hand, so you decide to use your newly acquired QL skills to help you with your investigation...

From 4ae3a230899d41964029df57cbd49fdc2de0440b Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 27 Apr 2021 21:47:38 +0000
Subject: [PATCH 428/433] Python: Limit absolute imports

Limits the behaviour of github/codeql#5614 in two ways:

First, we only consider files that are contained in the source archive.
This prevents unnecessary computation involving files in e.g. the
standard library.

Secondly, we ignore any relative imports (e.g. `from .foo import ...`),
as these only work inside packages anyway.

This fixes an observed performance regression on projects that include
`google-cloud-sdk` as part of their source code.
---
 python/ql/src/semmle/python/Module.qll | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index 1e9d76bf1d86..8f9344f60c07 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -212,8 +212,15 @@ private string moduleNameFromBase(Container file) {
 private predicate transitively_imported_from_entry_point(File file) {
   file.getExtension().matches("%py%") and
   exists(File importer |
+    // Only consider files that are in the source archive
+    exists(importer.getRelativePath()) and
     importer.getParent() = file.getParent() and
-    exists(ImportExpr i | i.getLocation().getFile() = importer and i.getName() = file.getStem())
+    exists(ImportExpr i |
+      i.getLocation().getFile() = importer and
+      i.getName() = file.getStem() and
+      // Disregard relative imports
+      i.getLevel() = 0
+    )
   |
     importer.isPossibleEntryPoint() or transitively_imported_from_entry_point(importer)
   )

From e60628d4633511b2c65998b46bcd43b294481a6c Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 27 Apr 2021 10:33:19 +0200
Subject: [PATCH 429/433] add global replacements using inverted char classes
 as a sanitizer for DOM based XSS

---
 .../ql/src/semmle/javascript/security/dataflow/Xss.qll   | 9 ++++++++-
 .../Security/CWE-079/XssThroughDom/xss-through-dom.js    | 4 ++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
index 6a7bd111a9fe..899c1c17e879 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -34,7 +34,14 @@ module Shared {
   class MetacharEscapeSanitizer extends Sanitizer, StringReplaceCall {
     MetacharEscapeSanitizer() {
       isGlobal() and
-      RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
+      (
+        RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
+        or
+        // or it's a global inverted char class.
+        getRegExp().getRoot().(RegExpCharacterClass).isInverted()
+        or
+        getRegExp().getRoot().(RegExpQuantifier).getAChild().(RegExpCharacterClass).isInverted()
+      )
     }
   }
 
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
index 0e6555fe5685..656f233ca9e3 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js
@@ -85,4 +85,8 @@
 
 	$("#id").html(anser.ansiToHtml(text)); // NOT OK
 	$("#id").html(new anser().process(text)); // NOT OK
+	
+	$("section h1").each(function(){
+		$("nav ul").append("<a href='#" + $(this).text().toLowerCase().replace(/ /g, '-').replace(/[^\w-]+/g,'') + "'>Section</a>"); // OK
+	});
 })();
\ No newline at end of file

From 160fa148f11d0f43f4d9ee5a19e32e93597b2e88 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 28 Apr 2021 11:39:28 +0200
Subject: [PATCH 430/433] move `InfiniteRepetitionQuantifier` to Regexp.qll

---
 javascript/ql/src/semmle/javascript/Regexp.qll      | 13 +++++++++++++
 .../javascript/security/performance/ReDoSUtil.qll   | 13 -------------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Regexp.qll b/javascript/ql/src/semmle/javascript/Regexp.qll
index 842cf0705c72..0d600f8f8c46 100644
--- a/javascript/ql/src/semmle/javascript/Regexp.qll
+++ b/javascript/ql/src/semmle/javascript/Regexp.qll
@@ -191,6 +191,19 @@ class RegExpQuantifier extends RegExpTerm, @regexp_quantifier {
   predicate isGreedy() { is_greedy(this) }
 }
 
+/**
+ * A regular expression term that permits unlimited repetitions.
+ */
+class InfiniteRepetitionQuantifier extends RegExpQuantifier {
+  InfiniteRepetitionQuantifier() {
+    this instanceof RegExpPlus
+    or
+    this instanceof RegExpStar
+    or
+    this instanceof RegExpRange and not exists(this.(RegExpRange).getUpperBound())
+  }
+}
+
 /**
  * An escaped regular expression term, that is, a regular expression
  * term starting with a backslash.
diff --git a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
index ae2917920d7b..a6f91c595dd0 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
@@ -53,19 +53,6 @@ private predicate isReDoSCandidate(State state, string pump) {
   )
 }
 
-/**
- * A regular expression term that permits unlimited repetitions.
- */
-class InfiniteRepetitionQuantifier extends RegExpQuantifier {
-  InfiniteRepetitionQuantifier() {
-    this instanceof RegExpPlus
-    or
-    this instanceof RegExpStar
-    or
-    this instanceof RegExpRange and not exists(this.(RegExpRange).getUpperBound())
-  }
-}
-
 /**
  * Gets the char after `c` (from a simplified ASCII table).
  */

From d07c71c99de5f318230bedca605d43afd799e8a2 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 28 Apr 2021 11:46:35 +0200
Subject: [PATCH 431/433] unlimited repetition of a wildcard is also a wildcard

---
 javascript/ql/src/semmle/javascript/Regexp.qll | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/Regexp.qll b/javascript/ql/src/semmle/javascript/Regexp.qll
index 0d600f8f8c46..1a27f001d600 100644
--- a/javascript/ql/src/semmle/javascript/Regexp.qll
+++ b/javascript/ql/src/semmle/javascript/Regexp.qll
@@ -1078,6 +1078,12 @@ module RegExp {
       not cls.isInverted() and
       cls.getAChild().(RegExpCharacterClassEscape).getValue().isUppercase()
     )
+    or
+    // an unlimited number of wildcards, is also a wildcard.
+    exists(InfiniteRepetitionQuantifier q |
+      term = q and
+      isWildcardLike(q.getAChild())
+    )
   }
 
   /**

From d5450f1df6d82f7e3457e23fbc8c6b6da7467147 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 28 Apr 2021 11:46:50 +0200
Subject: [PATCH 432/433] use `isWildcardLike` in `MetacharEscapeSanitizer`

---
 .../ql/src/semmle/javascript/security/dataflow/Xss.qll      | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
index 899c1c17e879..81e69a5229b6 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -37,10 +37,8 @@ module Shared {
       (
         RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
         or
-        // or it's a global inverted char class.
-        getRegExp().getRoot().(RegExpCharacterClass).isInverted()
-        or
-        getRegExp().getRoot().(RegExpQuantifier).getAChild().(RegExpCharacterClass).isInverted()
+        // or it's like a wild-card.
+        RegExp::isWildcardLike(getRegExp().getRoot())
       )
     }
   }

From 0376a13dd82460ac82ed1ee0e17ec4056a3542a1 Mon Sep 17 00:00:00 2001
From: Andrew Eisenberg <aeisenberg@github.com>
Date: Wed, 28 Apr 2021 15:05:13 -0700
Subject: [PATCH 433/433] Actions: Fix code scanning workflow

---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 3cd94cb6215c..87d6632d03e7 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,8 +21,8 @@ jobs:
 
     permissions:
       contents: read
-      security_events: write
-      pull_requests: read
+      security-events: write
+      pull-requests: read
 
     steps:
     - name: Checkout repository