From 1a811d5da04f5c6d75312899f69e1a59f1eb9be5 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 17 Aug 2026 11:22:50 +0100 Subject: [PATCH 1/7] C++: Cleanup in preparation for adding access paths at sources and sinks (no test changes). --- .../ir/dataflow/internal/DataFlowNodes.qll | 12 ++-- .../ir/dataflow/internal/DataFlowPrivate.qll | 71 ++++++++++++++++--- 2 files changed, 71 insertions(+), 12 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll index 27f7497422db..9e33969c85f8 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll @@ -1655,13 +1655,13 @@ abstract private class AbstractParameterNode extends Node { * Holds if this node represents an implicit `this` parameter, if it exists. */ predicate isThis() { none() } // overridden by subclasses -} -abstract private class AbstractIndirectParameterNode extends AbstractParameterNode { /** Gets the indirection index of this parameter node. */ - abstract int getIndirectionIndex(); + int getIndirectionIndex() { none() } } +abstract private class AbstractIndirectParameterNode extends AbstractParameterNode { } + pragma[noinline] private predicate indirectParameterNodeHasArgumentIndexAndIndex( IndirectInstructionParameterNode node, int argumentIndex, int indirectionIndex @@ -1725,7 +1725,9 @@ private class IndirectInstructionParameterNode extends AbstractIndirectParameter final override int getIndirectionIndex() { this.hasInstructionAndIndirectionIndex(init, result) } } -abstract private class AbstractDirectParameterNode extends AbstractParameterNode { } +abstract private class AbstractDirectParameterNode extends AbstractParameterNode { + override int getIndirectionIndex() { result = 0 } +} /** * A non-indirect parameter node that is represented as an `Instruction`. @@ -1796,6 +1798,8 @@ private class DirectBodyLessParameterNode extends AbstractExplicitParameterNode, } override Parameter getParameter() { result = p } + + final override int getIndirectionIndex() { result = 0 } } private class IndirectBodyLessParameterNode extends AbstractIndirectParameterNode, diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll index df4901b65fe8..0513c2ba92e9 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll @@ -508,11 +508,31 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos) * on parameters are also included. */ abstract class ArgumentNode extends Node { + /** + * Holds if this argument occurs at the given position in the given call, + * and this call is represented in the source code. + * The instance argument is considered to have index `-1`. + */ + predicate sourceArgumentOf(CallInstruction call, ArgumentPosition pos) { none() } + + /** + * Holds if this argument occurs at the given position in the given call, + * and this call part of a summary. + * The instance argument is considered to have index `-1`. + */ + predicate summaryArgumentOf(FlowSummaryImpl::Public::SummarizedCallable call, ArgumentPosition pos) { + none() + } + /** * Holds if this argument occurs at the given position in the given call. * The instance argument is considered to have index `-1`. */ - abstract predicate argumentOf(DataFlowCall call, ArgumentPosition pos); + final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { + this.sourceArgumentOf(call.asCallInstruction(), pos) + or + this.summaryArgumentOf(call.asSummaryCall(), pos) + } /** Gets the call in which this node is an argument. */ DataFlowCall getCall() { this.argumentOf(result, _) } @@ -527,16 +547,16 @@ private class PrimaryArgumentNode extends ArgumentNode, OperandNode { PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) } - override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { + override predicate sourceArgumentOf(CallInstruction call, ArgumentPosition pos) { op = call.getArgumentOperand(pos.(DirectPosition).getArgumentIndex()) } } private class SideEffectArgumentNode extends ArgumentNode, SideEffectOperandNode { - override predicate argumentOf(DataFlowCall dfCall, ArgumentPosition pos) { + override predicate sourceArgumentOf(CallInstruction c, ArgumentPosition pos) { exists(int indirectionIndex | pos = TIndirectionPosition(argumentIndex, pragma[only_bind_into](indirectionIndex)) and - this.getCallInstruction() = dfCall.asCallInstruction() and + this.getCallInstruction() = c and super.hasAddressOperandAndIndirectionIndex(arg, pragma[only_bind_into](indirectionIndex)) ) } @@ -554,8 +574,10 @@ class SummaryArgumentNode extends ArgumentNode, FlowSummaryNode { FlowSummaryImpl::Private::summaryArgumentNode(call_.getReceiver(), this.getSummaryNode(), pos_) } - override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { - call = call_ and + override predicate summaryArgumentOf( + FlowSummaryImpl::Public::SummarizedCallable call, ArgumentPosition pos + ) { + call = call_.asSummaryCall() and pos = pos_ } } @@ -569,8 +591,8 @@ private class FlowSummaryArgumentNode extends ArgumentNode, FlowSummaryNode { this.getSummaryNode() = FlowSummaryImpl::Private::summaryArgumentNode(callInstruction, rk) } - override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { - call.asCallInstruction() = callInstruction and + override predicate sourceArgumentOf(CallInstruction call, ArgumentPosition pos) { + call = callInstruction and pos = TFlowSummaryPosition(rk) } } @@ -593,6 +615,32 @@ abstract class Position extends TPosition { /** Gets the indirection index of this position. */ abstract int getIndirectionIndex(); + + /** + * Gets the parameter associated with this position, if any. + * + * Since a `Position` is defined by both an argument index and an + * indirection multiple `Position`s can be associated with the + * same `Parameter`. + */ + Parameter getParameter(Function f) { + result.getFunction() = f and + this.getArgumentIndex() = result.getIndex() + } + + /** + * Gets the argument (or qualifier) associated with this position, if any. + * + * Since a `Position` is defined by both an argument index and an + * indirection multiple `Position`s can be associated with the + * same argument/qualifier. + */ + Expr getArgument(Cpp::Call call) { + result = call.getArgument(this.getArgumentIndex()) + or + this.getArgumentIndex() = -1 and + result = call.getQualifier() + } } class DirectPosition extends Position, TDirectPosition { @@ -1189,6 +1237,11 @@ class DataFlowCall extends TDataFlowCall { */ CallInstruction asCallInstruction() { none() } + /** + * Gets the underlying summarized call, if any. + */ + FlowSummaryImpl::Public::SummarizedCallable asSummaryCall() { none() } + /** * Gets the operand the specifies the target function of the call. */ @@ -1306,6 +1359,8 @@ class SummaryCall extends DataFlowCall, TSummaryCall { */ FlowSummaryImpl::Private::SummaryNode getReceiver() { result = receiver } + final override FlowSummaryImpl::Public::SummarizedCallable asSummaryCall() { result = c } + // no implementation for `getCallTargetOperand()`, `getStaticCallTarget()` // or `getArgumentOperand(int index)`. This is because the flow summary // library is responsible for finding the call target, and there are no From 2ea969ddbc50e27c939508a8d497434cf04ad200 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 17 Aug 2026 13:39:04 +0100 Subject: [PATCH 2/7] C++: Add tests with missing flow sources. --- .../dataflow/external-models/flow.ext.yml | 3 ++ .../dataflow/external-models/sinks.expected | 5 +++ .../dataflow/external-models/test.cpp | 42 +++++++++++++++++++ 3 files changed, 50 insertions(+) diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml b/cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml index 130e13a92571..87756c451f3a 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml +++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml @@ -4,6 +4,9 @@ extensions: extensible: sourceModel data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance - ["", "", False, "ymlSource", "", "", "ReturnValue", "local", "manual"] + - ["", "", False, "ymlFieldSource", "", "", "ReturnValue.Field[SourceWrapper::value]", "local", "manual"] + - ["", "", False, "source_from_callback_template", "", "", "Argument[0].Parameter[*0].Field[SourceWrapper::value]", "local", "manual"] + - ["", "", False, "source_from_callback_ptr", "", "", "Argument[0].Parameter[*0].Field[SourceWrapper::value]", "local", "manual"] - addsTo: pack: codeql/cpp-all extensible: sinkModel diff --git a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected index a1f44de81589..858f12bdd69e 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected @@ -23,3 +23,8 @@ | test.cpp:201:10:201:10 | x | test-sink | | test.cpp:218:11:218:11 | x | test-sink | | test.cpp:224:11:224:11 | c | test-sink | +| test.cpp:243:13:243:17 | value | test-sink | +| test.cpp:248:18:248:22 | value | test-sink | +| test.cpp:254:14:254:18 | value | test-sink | +| test.cpp:258:14:258:18 | value | test-sink | +| test.cpp:263:15:263:19 | value | test-sink | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/test.cpp b/cpp/ql/test/library-tests/dataflow/external-models/test.cpp index ebb20bab6497..44138fd16e79 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/test.cpp +++ b/cpp/ql/test/library-tests/dataflow/external-models/test.cpp @@ -223,4 +223,46 @@ void test_reverse_flow(unsigned i, unsigned j) { char c = s[j]; ymlSink(c); // $ ir } +} + + +struct SourceWrapper { + int value; +}; + +SourceWrapper ymlFieldSource(); + +template +void source_from_callback_template(F); + +using Callback = void(*)(const SourceWrapper*); + +void source_from_callback_ptr(Callback); + +void f(const SourceWrapper* s) { + ymlSink(s->value); // $ MISSING: ir=250:32 ir=251:27 +} + +void test_source_access_path() { + SourceWrapper wrapper = ymlFieldSource(); + ymlSink(wrapper.value); // $ MISSING: ir + + source_from_callback_template(f); + source_from_callback_ptr(f); + + source_from_callback_template([](const SourceWrapper* s) { + ymlSink(s->value); // $ MISSING: ir + }); + + source_from_callback_ptr([](const SourceWrapper* s) { + ymlSink(s->value); // $ MISSING: ir + }); + + struct S { + void operator()(const SourceWrapper* s) { + ymlSink(s->value); // $ MISSING: ir + } + }; + + source_from_callback_template(S()); } \ No newline at end of file From 79ac0090d24d49009260ffc80dec901bb70a3a2b Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 17 Aug 2026 13:44:04 +0100 Subject: [PATCH 3/7] C++: Support for access path at sources and sinks. --- .../semmle/code/cpp/dataflow/ExternalFlow.qll | 9 +- .../cpp/dataflow/internal/FlowSummaryImpl.qll | 157 +++++++++++++++++- .../ir/dataflow/internal/DataFlowNodes.qll | 36 ++++ 3 files changed, 188 insertions(+), 14 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll index 29da7f7204c0..4f84b30d557e 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll @@ -113,6 +113,7 @@ import cpp private import new.DataFlow private import semmle.code.cpp.controlflow.IRGuards +private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes as Nodes private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil private import internal.FlowSummaryImpl @@ -952,9 +953,7 @@ private module Cached { */ cached predicate sourceNode(DataFlow::Node node, string kind, string model) { - exists(SourceSinkInterpretationInput::InterpretNode n | - isSourceNode(n, kind, model) and n.asNode() = node - ) + node.(Nodes::FlowSummaryNode).isSource(kind, model) } /** @@ -963,9 +962,7 @@ private module Cached { */ cached predicate sinkNode(DataFlow::Node node, string kind, string model) { - exists(SourceSinkInterpretationInput::InterpretNode n | - isSinkNode(n, kind, model) and n.asNode() = node - ) + node.(Nodes::FlowSummaryNode).isSink(kind, model) } private newtype TKindModelPair = diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll index dda9218855f8..7a43fe19492e 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll @@ -17,11 +17,9 @@ module Input implements InputSig { class SummarizedCallableBase = Function; - class SourceBase extends Void { - Location getLocation() { none() } - } + class SourceBase = Function; - class SinkBase = SourceBase; + class SinkBase = Function; class FlowSummaryCallBase = CallInstruction; @@ -134,15 +132,120 @@ module Input implements InputSig { private import Make as Impl +private class ConversionCall extends Call { + ConversionCall() { this.getTarget() instanceof ConversionOperator } +} + private module Input2 implements Impl::Private::InputSig2 { private import codeql.util.Void - class SourceSinkReportingElement extends Void { - Location getLocation() { none() } + class SourceSinkReportingElement extends Element { + SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter } + + DataFlowCallable getEnclosingCallable() { + result.asSourceCallable() = + [this.(Expr).getEnclosingFunction(), this.(Parameter).getFunction()] + } + + /** + * Gets the member function corresponding to an overloaded `operator()` when this element is + * invoked. + */ + private MemberFunction getOperatorCallFunction() { + // An `operator()` on a struct + result.getClassAndName("operator()").getADerivedClass*() = this.(Expr).getUnspecifiedType() + or + // A lambda that has undergone "lambda to function-pointer conversion" + result = this.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction() + } + + SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { + exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) | + // Taking the address of a function + result = pos.getParameter(this.(FunctionAccess).getTarget()) + or + // Passing an object with an overloaded `operator()` + result = pos.getParameter(this.getOperatorCallFunction()) + ) + } + } + + bindingset[source, sc] + SourceSinkReportingElement getASourceReportingElement( + Input::SourceBase source, Impl::Private::SummaryComponent sc + ) { + exists(Call call | call.getTarget() = source | + sc = Impl::Private::SummaryComponent::return(_) and + result = call + or + exists(ArgumentPosition pos | + sc = Impl::Private::SummaryComponent::argument(pos) and + result = pos.getArgument(call) + ) + ) + or + exists(ParameterPosition pos | + sc = Impl::Private::SummaryComponent::parameter(pos) and + result = pos.getParameter(source) + ) + } + + pragma[nomagic] + private IndirectReturnOutNode getIndirectReturn(CallInstruction call, NormalReturnKind rk) { + result.getCallInstruction() = call and + pragma[only_bind_out](result.getIndirectionIndex()) = + pragma[only_bind_out](rk.getIndirectionIndex()) + } + + bindingset[e, sc] + Node getSourceDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) { + exists(DataFlowCall call | + exists(ArgumentPosition pos | + sc = Impl::Private::SummaryComponent::argument(pos) and + pos.getArgument(call.asCallInstruction().getUnconvertedResultExpression()) = e + | + pos.getIndirectionIndex() = 0 and + result.(PostUpdateNode).getPreUpdateNode().asExpr() = e + or + result.(PostUpdateNode).getPreUpdateNode().asIndirectExpr(pos.getIndirectionIndex()) = e + ) + or + exists(ReturnKind rk | + sc = Impl::Private::SummaryComponent::return(rk) and + e = call.asCallInstruction().getUnconvertedResultExpression() + | + rk.getIndirectionIndex() = 0 and + simpleOutNode(result, call.asCallInstruction()) + or + result = getIndirectReturn(call.asCallInstruction(), rk) + ) + ) + or + exists(ParameterPosition pos, ParameterNode p | + sc = Impl::Private::SummaryComponent::parameter(pos) and + p.isParameterOf(e.getEnclosingCallable(), pos) and + result = p + ) + } - DataFlowCallable getEnclosingCallable() { none() } + bindingset[sink, sc] + SourceSinkReportingElement getASinkReportingElement( + Input::SinkBase sink, Impl::Private::SummaryComponent sc + ) { + exists(Call call, ArgumentPosition pos | + call.getTarget() = sink and + sc = Impl::Private::SummaryComponent::argument(pos) and + result = pos.getArgument(call) + ) + } - SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() } + bindingset[e, sc] + Node getSinkDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) { + exists(ArgumentPosition pos, CallInstruction call | + sc = Impl::Private::SummaryComponent::argument(pos) and + pos.getArgument(call.getUnconvertedResultExpression()) = e and + result.(ArgumentNode).sourceArgumentOf(call, pos) + ) } } @@ -319,3 +422,41 @@ module Private { } module Public = Impl::Public; + +private class SourceModelFunction extends Public::SourceElement instanceof Function { + private string namespace; + private string type; + private boolean subtypes; + private string name; + private string signature; + private string ext; + + SourceModelFunction() { + sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and + this = interpretElement(namespace, type, subtypes, name, signature, ext) + } + + override predicate isSource( + string output, string kind, Public::Provenance provenance, string model + ) { + sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model) + } +} + +private class SinkModelFunction extends Public::SinkElement instanceof Function { + private string namespace; + private string type; + private boolean subtypes; + private string name; + private string signature; + private string ext; + + SinkModelFunction() { + sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and + this = interpretElement(namespace, type, subtypes, name, signature, ext) + } + + override predicate isSink(string input, string kind, Public::Provenance provenance, string model) { + sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, model) + } +} diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll index 9e33969c85f8..16e2130eb229 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll @@ -1541,6 +1541,42 @@ class FlowSummaryNode extends Node, TFlowSummaryNode { override Location getLocationImpl() { result = this.getSummaryNode().getLocation() } override string toStringImpl() { result = this.getSummaryNode().toString() } + + /** Gets the source element that this node belongs to, if any. */ + FlowSummaryImpl::Public::SourceElement getSourceElement() { + result = this.getSummaryNode().getSourceElement() + } + + /** Gets the sink element that this node belongs to, if any. */ + FlowSummaryImpl::Public::SinkElement getSinkElement() { + result = this.getSummaryNode().getSinkElement() + } + + /** Holds if this node is a source node of kind `kind`. */ + predicate isSource(string kind, string model) { + this.getSummaryNode().(FlowSummaryImpl::Private::SourceOutputNode).isEntry(kind, model) + } + + /** Holds if this node is a sink node of kind `kind`. */ + predicate isSink(string kind, string model) { + this.getSummaryNode().(FlowSummaryImpl::Private::SinkInputNode).isExit(kind, model) + } +} + +private class SourceOutputNode extends FlowSummaryImpl::Private::SourceOutputNode { + final override string toString() { + exists(Call call | + this.isOutArgument(call) and + result = call.getTarget() + " output argument" + ) + or + not this.isOutArgument(_) and + result = super.toString() + } + + private predicate isOutArgument(Call call) { + [call.getAnArgument(), call.getQualifier()] = this.getSourceSinkReportingElement() + } } /** From af7db963b711eab1294eab35f717ca8bf0196ca7 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 17 Aug 2026 14:39:14 +0100 Subject: [PATCH 4/7] C++: Accept test changes. --- .../dataflow/external-models/flow.expected | 344 ++++++++++-------- .../dataflow/external-models/sinks.expected | 4 +- .../dataflow/external-models/sources.expected | 30 +- .../dataflow/external-models/test.cpp | 10 +- .../models-as-data/testModels.expected | 67 ++++ 5 files changed, 288 insertions(+), 167 deletions(-) diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected index 24ba3b2aa686..99ce09880165 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected @@ -33,106 +33,109 @@ models | 32 | Source: ; ; false; WinHttpQueryHeadersEx; ; ; Argument[*6]; remote; manual | | 33 | Source: ; ; false; WinHttpReadData; ; ; Argument[*1]; remote; manual | | 34 | Source: ; ; false; WinHttpReadDataEx; ; ; Argument[*1]; remote; manual | -| 35 | Source: ; ; false; ymlSource; ; ; ReturnValue; local; manual | -| 36 | Source: Azure::Core::Http; RawResponse; true; ExtractBodyStream; ; ; ReturnValue[*]; remote; manual | -| 37 | Source: Azure::Core::Http; RawResponse; true; GetBody; ; ; ReturnValue[*]; remote; manual | -| 38 | Source: Azure::Core::Http; RawResponse; true; GetHeaders; ; ; ReturnValue[*]; remote; manual | -| 39 | Source: Azure::Core::Http; Request; true; GetBodyStream; ; ; ReturnValue[*]; remote; manual | -| 40 | Source: Azure::Core::Http; Request; true; GetHeader; ; ; ReturnValue; remote; manual | -| 41 | Source: Azure::Core::Http; Request; true; GetHeaders; ; ; ReturnValue; remote; manual | -| 42 | Source: boost::asio; ; false; read_until; ; ; Argument[*1]; remote; manual | -| 43 | Summary: ; ; false; CLSIDFromProgID; ; ; Argument[*0]; Argument[*1]; taint; manual | -| 44 | Summary: ; ; false; CLSIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | -| 45 | Summary: ; ; false; CommandLineToArgvA; ; ; Argument[*0]; ReturnValue[**]; taint; manual | -| 46 | Summary: ; ; false; CreateRemoteThread; ; ; Argument[@4]; Argument[3].Parameter[@0]; value; manual | -| 47 | Summary: ; ; false; CreateRemoteThreadEx; ; ; Argument[@4]; Argument[3].Parameter[@0]; value; manual | -| 48 | Summary: ; ; false; CreateThread; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual | -| 49 | Summary: ; ; false; GUIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | -| 50 | Summary: ; ; false; IIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | -| 51 | Summary: ; ; false; ProgIDFromCLSID; ; ; Argument[*0]; Argument[**1]; taint; manual | -| 52 | Summary: ; ; false; ReadFileEx; ; ; Argument[*3].Field[@hEvent]; Argument[4].Parameter[*2].Field[@hEvent]; value; manual | -| 53 | Summary: ; ; false; RtlCopyDeviceMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 54 | Summary: ; ; false; RtlCopyMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 55 | Summary: ; ; false; RtlCopyMemoryNonTemporal; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 56 | Summary: ; ; false; RtlCopyUnicodeString; ; ; Argument[*1].Field[*Buffer]; Argument[*0].Field[*Buffer]; value; manual | -| 57 | Summary: ; ; false; RtlCopyVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 58 | Summary: ; ; false; RtlInitUnicodeString; ; ; Argument[*1]; Argument[*0].Field[*Buffer]; value; manual | -| 59 | Summary: ; ; false; RtlMoveMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 60 | Summary: ; ; false; RtlMoveVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | -| 61 | Summary: ; ; false; StringFromCLSID; ; ; Argument[*0]; Argument[**1]; taint; manual | -| 62 | Summary: ; ; false; StringFromGUID2; ; ; Argument[*0]; Argument[*1]; taint; manual | -| 63 | Summary: ; ; false; StringFromIID; ; ; Argument[*0]; Argument[**1]; taint; manual | -| 64 | Summary: ; ; false; WinHttpCrackUrl; ; ; Argument[*0]; Argument[*3]; taint; manual | -| 65 | Summary: ; ; false; callWithArgument; ; ; Argument[1]; Argument[0].Parameter[0]; value; manual | -| 66 | Summary: ; ; false; callWithNonTypeTemplate; (const T &); ; Argument[*0]; ReturnValue; value; manual | -| 67 | Summary: ; ; false; pthread_create; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual | -| 68 | Summary: ; ; false; read_field_from_struct; ; ; Argument[*0].Field[MyNamespace::MyStructInNamespace::myField]; ReturnValue; value; manual | -| 69 | Summary: ; ; false; read_field_from_struct_2; ; ; Argument[*0].Field[MyGlobalStruct::myField]; ReturnValue; value; manual | -| 70 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated | -| 71 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual | -| 72 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual | -| 73 | Summary: ; MyString; true; operator[]; ; ; Argument[-1]; ReturnValue[*]; taint; manual | -| 74 | Summary: ; MyString; true; operator[]; ; ; ReturnValue[*]; Argument[-1]; taint; manual | -| 75 | Summary: ; ReverseFlow; true; get_ptr; ; ; ReturnValue[*]; Argument[-1].Field[ReverseFlow::value]; value; manual | -| 76 | Summary: ; TemplateClass1; true; templateFunction2; (U,V); ; Argument[1]; ReturnValue; value; manual | -| 77 | Summary: ; TemplateClass1; false; templateFunction; (T,U); ; Argument[0]; ReturnValue; value; manual | -| 78 | Summary: ; TemplateClass2; true; function; (U,T); ; Argument[1]; ReturnValue; value; manual | -| 79 | Summary: Azure::Core::IO; BodyStream; true; Read; ; ; Argument[-1]; Argument[*0]; taint; manual | -| 80 | Summary: Azure::Core::IO; BodyStream; true; ReadToCount; ; ; Argument[-1]; Argument[*0]; taint; manual | -| 81 | Summary: Azure::Core::IO; BodyStream; true; ReadToEnd; ; ; Argument[-1]; ReturnValue.Element; taint; manual | -| 82 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual | -| 83 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | +| 35 | Source: ; ; false; source_from_callback_ptr; ; ; Argument[0].Parameter[*0].Field[SourceWrapper::value]; local; manual | +| 36 | Source: ; ; false; source_from_callback_template; ; ; Argument[0].Parameter[*0].Field[SourceWrapper::value]; local; manual | +| 37 | Source: ; ; false; ymlFieldSource; ; ; ReturnValue.Field[SourceWrapper::value]; local; manual | +| 38 | Source: ; ; false; ymlSource; ; ; ReturnValue; local; manual | +| 39 | Source: Azure::Core::Http; RawResponse; true; ExtractBodyStream; ; ; ReturnValue[*]; remote; manual | +| 40 | Source: Azure::Core::Http; RawResponse; true; GetBody; ; ; ReturnValue[*]; remote; manual | +| 41 | Source: Azure::Core::Http; RawResponse; true; GetHeaders; ; ; ReturnValue[*]; remote; manual | +| 42 | Source: Azure::Core::Http; Request; true; GetBodyStream; ; ; ReturnValue[*]; remote; manual | +| 43 | Source: Azure::Core::Http; Request; true; GetHeader; ; ; ReturnValue; remote; manual | +| 44 | Source: Azure::Core::Http; Request; true; GetHeaders; ; ; ReturnValue; remote; manual | +| 45 | Source: boost::asio; ; false; read_until; ; ; Argument[*1]; remote; manual | +| 46 | Summary: ; ; false; CLSIDFromProgID; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 47 | Summary: ; ; false; CLSIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 48 | Summary: ; ; false; CommandLineToArgvA; ; ; Argument[*0]; ReturnValue[**]; taint; manual | +| 49 | Summary: ; ; false; CreateRemoteThread; ; ; Argument[@4]; Argument[3].Parameter[@0]; value; manual | +| 50 | Summary: ; ; false; CreateRemoteThreadEx; ; ; Argument[@4]; Argument[3].Parameter[@0]; value; manual | +| 51 | Summary: ; ; false; CreateThread; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual | +| 52 | Summary: ; ; false; GUIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 53 | Summary: ; ; false; IIDFromString; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 54 | Summary: ; ; false; ProgIDFromCLSID; ; ; Argument[*0]; Argument[**1]; taint; manual | +| 55 | Summary: ; ; false; ReadFileEx; ; ; Argument[*3].Field[@hEvent]; Argument[4].Parameter[*2].Field[@hEvent]; value; manual | +| 56 | Summary: ; ; false; RtlCopyDeviceMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 57 | Summary: ; ; false; RtlCopyMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 58 | Summary: ; ; false; RtlCopyMemoryNonTemporal; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 59 | Summary: ; ; false; RtlCopyUnicodeString; ; ; Argument[*1].Field[*Buffer]; Argument[*0].Field[*Buffer]; value; manual | +| 60 | Summary: ; ; false; RtlCopyVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 61 | Summary: ; ; false; RtlInitUnicodeString; ; ; Argument[*1]; Argument[*0].Field[*Buffer]; value; manual | +| 62 | Summary: ; ; false; RtlMoveMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 63 | Summary: ; ; false; RtlMoveVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual | +| 64 | Summary: ; ; false; StringFromCLSID; ; ; Argument[*0]; Argument[**1]; taint; manual | +| 65 | Summary: ; ; false; StringFromGUID2; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 66 | Summary: ; ; false; StringFromIID; ; ; Argument[*0]; Argument[**1]; taint; manual | +| 67 | Summary: ; ; false; WinHttpCrackUrl; ; ; Argument[*0]; Argument[*3]; taint; manual | +| 68 | Summary: ; ; false; callWithArgument; ; ; Argument[1]; Argument[0].Parameter[0]; value; manual | +| 69 | Summary: ; ; false; callWithNonTypeTemplate; (const T &); ; Argument[*0]; ReturnValue; value; manual | +| 70 | Summary: ; ; false; pthread_create; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual | +| 71 | Summary: ; ; false; read_field_from_struct; ; ; Argument[*0].Field[MyNamespace::MyStructInNamespace::myField]; ReturnValue; value; manual | +| 72 | Summary: ; ; false; read_field_from_struct_2; ; ; Argument[*0].Field[MyGlobalStruct::myField]; ReturnValue; value; manual | +| 73 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated | +| 74 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual | +| 75 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual | +| 76 | Summary: ; MyString; true; operator[]; ; ; Argument[-1]; ReturnValue[*]; taint; manual | +| 77 | Summary: ; MyString; true; operator[]; ; ; ReturnValue[*]; Argument[-1]; taint; manual | +| 78 | Summary: ; ReverseFlow; true; get_ptr; ; ; ReturnValue[*]; Argument[-1].Field[ReverseFlow::value]; value; manual | +| 79 | Summary: ; TemplateClass1; true; templateFunction2; (U,V); ; Argument[1]; ReturnValue; value; manual | +| 80 | Summary: ; TemplateClass1; false; templateFunction; (T,U); ; Argument[0]; ReturnValue; value; manual | +| 81 | Summary: ; TemplateClass2; true; function; (U,T); ; Argument[1]; ReturnValue; value; manual | +| 82 | Summary: Azure::Core::IO; BodyStream; true; Read; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 83 | Summary: Azure::Core::IO; BodyStream; true; ReadToCount; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 84 | Summary: Azure::Core::IO; BodyStream; true; ReadToEnd; ; ; Argument[-1]; ReturnValue.Element; taint; manual | +| 85 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual | +| 86 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | edges -| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:42 | -| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | *recv_buffer | provenance | Src:MaD:42 Sink:MaD:2 | +| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:45 | +| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | recv_buffer | provenance | Src:MaD:45 Sink:MaD:2 | | asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:98:7:98:14 | send_str | provenance | TaintFunction | | asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:100:64:100:71 | *send_str | provenance | TaintFunction | | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | | | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance | | -| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:2 | -| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:83 | -| azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:253:48:253:60 | *call to GetBodyStream | provenance | Src:MaD:39 | +| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | send_buffer | provenance | Sink:MaD:2 | +| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:86 | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:257:5:257:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:262:5:262:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:266:38:266:41 | *resp | provenance | | -| azure.cpp:257:5:257:8 | *resp | azure.cpp:257:16:257:21 | Read output argument | provenance | MaD:79 | +| azure.cpp:253:48:253:60 | call to GetBodyStream | azure.cpp:253:48:253:60 | *call to GetBodyStream | provenance | Src:MaD:42 | +| azure.cpp:257:5:257:8 | *resp | azure.cpp:257:16:257:21 | Read output argument | provenance | MaD:82 | | azure.cpp:257:16:257:21 | Read output argument | azure.cpp:258:10:258:16 | * ... | provenance | | -| azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | provenance | MaD:80 | +| azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | provenance | MaD:83 | | azure.cpp:262:23:262:28 | ReadToCount output argument | azure.cpp:263:10:263:16 | * ... | provenance | | -| azure.cpp:266:38:266:41 | *resp | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance | MaD:81 | +| azure.cpp:266:38:266:41 | *resp | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance | MaD:84 | | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance | | | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | azure.cpp:267:10:267:12 | vec [element] | provenance | | | azure.cpp:267:10:267:12 | vec [element] | azure.cpp:267:10:267:12 | vec | provenance | | -| azure.cpp:273:62:273:64 | call to GetHeaders | azure.cpp:273:62:273:64 | call to GetHeaders | provenance | Src:MaD:38 | +| azure.cpp:273:52:273:61 | call to GetHeaders | azure.cpp:273:62:273:64 | call to GetHeaders | provenance | Src:MaD:41 | | azure.cpp:273:62:273:64 | call to GetHeaders | azure.cpp:274:14:274:29 | call to operator[] | provenance | TaintFunction | | azure.cpp:273:62:273:64 | call to GetHeaders | azure.cpp:274:14:274:29 | call to operator[] | provenance | TaintFunction | | azure.cpp:273:62:273:64 | call to GetHeaders | azure.cpp:274:14:274:29 | call to operator[] | provenance | TaintFunction | | azure.cpp:274:14:274:29 | call to operator[] | azure.cpp:274:10:274:29 | call to operator[] | provenance | | | azure.cpp:274:14:274:29 | call to operator[] | azure.cpp:274:14:274:29 | call to operator[] | provenance | | -| azure.cpp:277:45:277:47 | call to GetBody | azure.cpp:277:45:277:47 | call to GetBody | provenance | Src:MaD:37 | +| azure.cpp:277:38:277:44 | call to GetBody | azure.cpp:277:45:277:47 | call to GetBody | provenance | Src:MaD:40 | | azure.cpp:277:45:277:47 | call to GetBody | azure.cpp:278:10:278:13 | body | provenance | | | azure.cpp:277:45:277:47 | call to GetBody | azure.cpp:278:10:278:13 | body | provenance | | | azure.cpp:278:10:278:13 | body | azure.cpp:278:10:278:13 | body | provenance | | -| azure.cpp:281:68:281:84 | *call to ExtractBodyStream | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | provenance | Src:MaD:36 | | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | azure.cpp:282:21:282:23 | *call to get | provenance | | -| azure.cpp:282:21:282:23 | *call to get | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance | MaD:81 | +| azure.cpp:281:68:281:84 | call to ExtractBodyStream | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | provenance | Src:MaD:39 | +| azure.cpp:282:21:282:23 | *call to get | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance | MaD:84 | | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | azure.cpp:282:10:282:38 | call to ReadToEnd | provenance | | | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance | | -| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:289:63:289:65 | call to Value | provenance | MaD:82 | +| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:289:63:289:65 | call to Value | provenance | MaD:85 | +| azure.cpp:289:32:289:40 | Value output argument | azure.cpp:289:32:289:40 | call to GetHeader | provenance | Src:MaD:43 | | azure.cpp:289:32:289:40 | call to GetHeader | azure.cpp:289:24:289:56 | call to GetHeader | provenance | | -| azure.cpp:289:32:289:40 | call to GetHeader | azure.cpp:289:32:289:40 | call to GetHeader | provenance | Src:MaD:40 | | azure.cpp:289:63:289:65 | call to Value | azure.cpp:289:63:289:65 | call to Value | provenance | | | azure.cpp:289:63:289:65 | call to Value | azure.cpp:290:10:290:20 | headerValue | provenance | | | azure.cpp:289:63:289:65 | call to Value | azure.cpp:290:10:290:20 | headerValue | provenance | | | azure.cpp:290:10:290:20 | headerValue | azure.cpp:290:10:290:20 | headerValue | provenance | | -| azure.cpp:293:58:293:67 | call to GetHeaders | azure.cpp:293:58:293:67 | call to GetHeaders | provenance | Src:MaD:41 | +| azure.cpp:293:58:293:67 | call to GetHeaders | azure.cpp:293:58:293:67 | call to GetHeaders | provenance | Src:MaD:44 | | azure.cpp:293:58:293:67 | call to GetHeaders | azure.cpp:294:38:294:53 | call to operator[] | provenance | TaintFunction | | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | | | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | | | azure.cpp:295:10:295:20 | contentType | azure.cpp:295:10:295:20 | contentType | provenance | | | test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance | | | test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance | | -| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:14:10:14:10 | x | provenance | Sink:MaD:1 | | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:17:24:17:24 | x | provenance | | | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:21:27:21:27 | x | provenance | | @@ -140,99 +143,122 @@ edges | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:32:41:32:41 | x | provenance | | | test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | | | test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:18:10:18:10 | y | provenance | Sink:MaD:1 | -| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:71 | +| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:74 | | test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | | | test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:22:10:22:10 | z | provenance | Sink:MaD:1 | -| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:70 | +| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:73 | | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | | | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:26:10:26:11 | y2 | provenance | Sink:MaD:1 | -| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:72 | +| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:75 | | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance | | | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:33:10:33:11 | z2 | provenance | Sink:MaD:1 | | test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | provenance | | | test.cpp:32:41:32:41 | x | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance | | | test.cpp:46:30:46:32 | *arg [x] | test.cpp:47:12:47:19 | *arg [x] | provenance | | | test.cpp:47:12:47:19 | *arg [x] | test.cpp:48:13:48:13 | *s [x] | provenance | | -| test.cpp:48:13:48:13 | *s [x] | test.cpp:48:16:48:16 | x | provenance | Sink:MaD:1 | +| test.cpp:48:13:48:13 | *s [x] | test.cpp:48:16:48:16 | x | provenance | | +| test.cpp:48:16:48:16 | x | test.cpp:48:16:48:16 | x | provenance | Sink:MaD:1 | | test.cpp:56:2:56:2 | *s [post update] [x] | test.cpp:59:55:59:64 | *& ... [x] | provenance | | | test.cpp:56:2:56:18 | ... = ... | test.cpp:56:2:56:2 | *s [post update] [x] | provenance | | -| test.cpp:56:8:56:16 | call to ymlSource | test.cpp:56:2:56:18 | ... = ... | provenance | Src:MaD:35 | -| test.cpp:59:55:59:64 | *& ... [x] | test.cpp:46:30:46:32 | *arg [x] | provenance | MaD:67 | +| test.cpp:56:8:56:16 | call to ymlSource | test.cpp:56:2:56:18 | ... = ... | provenance | Src:MaD:38 | +| test.cpp:59:55:59:64 | *& ... [x] | test.cpp:46:30:46:32 | *arg [x] | provenance | MaD:70 | | test.cpp:68:22:68:22 | y | test.cpp:69:11:69:11 | y | provenance | Sink:MaD:1 | | test.cpp:74:22:74:22 | y | test.cpp:75:11:75:11 | y | provenance | Sink:MaD:1 | | test.cpp:82:22:82:22 | y | test.cpp:83:11:83:11 | y | provenance | Sink:MaD:1 | | test.cpp:88:22:88:22 | y | test.cpp:89:11:89:11 | y | provenance | Sink:MaD:1 | -| test.cpp:94:10:94:18 | call to ymlSource | test.cpp:94:10:94:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:94:10:94:18 | call to ymlSource | test.cpp:94:10:94:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:97:26:97:26 | x | provenance | | | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:101:26:101:26 | x | provenance | | | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:103:63:103:63 | x | provenance | | | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:104:62:104:62 | x | provenance | | -| test.cpp:97:26:97:26 | x | test.cpp:68:22:68:22 | y | provenance | MaD:65 | -| test.cpp:101:26:101:26 | x | test.cpp:74:22:74:22 | y | provenance | MaD:65 | -| test.cpp:103:63:103:63 | x | test.cpp:82:22:82:22 | y | provenance | MaD:65 | -| test.cpp:104:62:104:62 | x | test.cpp:88:22:88:22 | y | provenance | MaD:65 | -| test.cpp:114:10:114:18 | call to ymlSource | test.cpp:114:10:114:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:97:26:97:26 | x | test.cpp:68:22:68:22 | y | provenance | MaD:68 | +| test.cpp:101:26:101:26 | x | test.cpp:74:22:74:22 | y | provenance | MaD:68 | +| test.cpp:103:63:103:63 | x | test.cpp:82:22:82:22 | y | provenance | MaD:68 | +| test.cpp:104:62:104:62 | x | test.cpp:88:22:88:22 | y | provenance | MaD:68 | +| test.cpp:114:10:114:18 | call to ymlSource | test.cpp:114:10:114:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:114:10:114:18 | call to ymlSource | test.cpp:118:44:118:44 | *x | provenance | | | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | provenance | | | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | test.cpp:119:10:119:11 | y2 | provenance | Sink:MaD:1 | -| test.cpp:118:44:118:44 | *x | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | provenance | MaD:66 | -| test.cpp:133:10:133:18 | call to ymlSource | test.cpp:133:10:133:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:118:44:118:44 | *x | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | provenance | MaD:69 | +| test.cpp:133:10:133:18 | call to ymlSource | test.cpp:133:10:133:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:133:10:133:18 | call to ymlSource | test.cpp:134:45:134:45 | x | provenance | | | test.cpp:134:13:134:43 | call to templateFunction | test.cpp:134:13:134:43 | call to templateFunction | provenance | | | test.cpp:134:13:134:43 | call to templateFunction | test.cpp:135:10:135:10 | y | provenance | Sink:MaD:1 | -| test.cpp:134:45:134:45 | x | test.cpp:134:13:134:43 | call to templateFunction | provenance | MaD:77 | -| test.cpp:146:10:146:18 | call to ymlSource | test.cpp:146:10:146:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:134:45:134:45 | x | test.cpp:134:13:134:43 | call to templateFunction | provenance | MaD:80 | +| test.cpp:146:10:146:18 | call to ymlSource | test.cpp:146:10:146:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:146:10:146:18 | call to ymlSource | test.cpp:148:26:148:26 | x | provenance | | | test.cpp:148:10:148:27 | call to function | test.cpp:148:10:148:27 | call to function | provenance | | | test.cpp:148:10:148:27 | call to function | test.cpp:149:10:149:10 | z | provenance | Sink:MaD:1 | -| test.cpp:148:26:148:26 | x | test.cpp:148:10:148:27 | call to function | provenance | MaD:78 | -| test.cpp:155:10:155:18 | call to ymlSource | test.cpp:155:10:155:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:148:26:148:26 | x | test.cpp:148:10:148:27 | call to function | provenance | MaD:81 | +| test.cpp:155:10:155:18 | call to ymlSource | test.cpp:155:10:155:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:155:10:155:18 | call to ymlSource | test.cpp:157:26:157:26 | x | provenance | | | test.cpp:157:13:157:20 | call to function | test.cpp:157:13:157:20 | call to function | provenance | | | test.cpp:157:13:157:20 | call to function | test.cpp:158:10:158:10 | z | provenance | Sink:MaD:1 | -| test.cpp:157:26:157:26 | x | test.cpp:157:13:157:20 | call to function | provenance | MaD:78 | +| test.cpp:157:26:157:26 | x | test.cpp:157:13:157:20 | call to function | provenance | MaD:81 | | test.cpp:164:34:164:34 | x | test.cpp:165:69:165:69 | x | provenance | | | test.cpp:165:12:165:64 | call to templateFunction2 | test.cpp:164:7:164:7 | *templateFunction3 | provenance | | | test.cpp:165:12:165:64 | call to templateFunction2 | test.cpp:165:12:165:64 | call to templateFunction2 | provenance | | -| test.cpp:165:69:165:69 | x | test.cpp:165:12:165:64 | call to templateFunction2 | provenance | MaD:76 | -| test.cpp:170:10:170:18 | call to ymlSource | test.cpp:170:10:170:18 | call to ymlSource | provenance | Src:MaD:35 | +| test.cpp:165:69:165:69 | x | test.cpp:165:12:165:64 | call to templateFunction2 | provenance | MaD:79 | +| test.cpp:170:10:170:18 | call to ymlSource | test.cpp:170:10:170:18 | call to ymlSource | provenance | Src:MaD:38 | | test.cpp:170:10:170:18 | call to ymlSource | test.cpp:172:51:172:51 | x | provenance | | | test.cpp:172:13:172:44 | call to templateFunction3 | test.cpp:172:13:172:44 | call to templateFunction3 | provenance | | | test.cpp:172:13:172:44 | call to templateFunction3 | test.cpp:173:10:173:10 | y | provenance | Sink:MaD:1 | | test.cpp:172:51:172:51 | x | test.cpp:164:34:164:34 | x | provenance | | -| test.cpp:172:51:172:51 | x | test.cpp:172:13:172:44 | call to templateFunction3 | provenance | MaD:76 | +| test.cpp:172:51:172:51 | x | test.cpp:172:13:172:44 | call to templateFunction3 | provenance | MaD:79 | | test.cpp:186:2:186:2 | *s [post update] [myField] | test.cpp:187:33:187:34 | *& ... [myField] | provenance | | | test.cpp:186:2:186:24 | ... = ... | test.cpp:186:2:186:2 | *s [post update] [myField] | provenance | | -| test.cpp:186:14:186:22 | call to ymlSource | test.cpp:186:2:186:24 | ... = ... | provenance | Src:MaD:35 | +| test.cpp:186:14:186:22 | call to ymlSource | test.cpp:186:2:186:24 | ... = ... | provenance | Src:MaD:38 | | test.cpp:187:10:187:31 | call to read_field_from_struct | test.cpp:187:10:187:31 | call to read_field_from_struct | provenance | | | test.cpp:187:10:187:31 | call to read_field_from_struct | test.cpp:188:10:188:10 | x | provenance | Sink:MaD:1 | -| test.cpp:187:33:187:34 | *& ... [myField] | test.cpp:187:10:187:31 | call to read_field_from_struct | provenance | MaD:68 | +| test.cpp:187:33:187:34 | *& ... [myField] | test.cpp:187:10:187:31 | call to read_field_from_struct | provenance | MaD:71 | | test.cpp:199:2:199:2 | *s [post update] [myField] | test.cpp:200:35:200:36 | *& ... [myField] | provenance | | | test.cpp:199:2:199:24 | ... = ... | test.cpp:199:2:199:2 | *s [post update] [myField] | provenance | | -| test.cpp:199:14:199:22 | call to ymlSource | test.cpp:199:2:199:24 | ... = ... | provenance | Src:MaD:35 | +| test.cpp:199:14:199:22 | call to ymlSource | test.cpp:199:2:199:24 | ... = ... | provenance | Src:MaD:38 | | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | provenance | | | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | test.cpp:201:10:201:10 | x | provenance | Sink:MaD:1 | -| test.cpp:200:35:200:36 | *& ... [myField] | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | provenance | MaD:69 | +| test.cpp:200:35:200:36 | *& ... [myField] | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | provenance | MaD:72 | | test.cpp:216:3:216:4 | get_ptr output argument [value] | test.cpp:217:11:217:12 | *rf [value] | provenance | | -| test.cpp:216:3:216:28 | ... = ... | test.cpp:216:3:216:4 | get_ptr output argument [value] | provenance | MaD:75 | -| test.cpp:216:18:216:26 | call to ymlSource | test.cpp:216:3:216:28 | ... = ... | provenance | Src:MaD:35 | +| test.cpp:216:3:216:28 | ... = ... | test.cpp:216:3:216:4 | get_ptr output argument [value] | provenance | MaD:78 | +| test.cpp:216:18:216:26 | call to ymlSource | test.cpp:216:3:216:28 | ... = ... | provenance | Src:MaD:38 | | test.cpp:217:11:217:12 | *rf [value] | test.cpp:217:14:217:18 | value | provenance | | | test.cpp:217:14:217:18 | value | test.cpp:217:14:217:18 | value | provenance | | | test.cpp:217:14:217:18 | value | test.cpp:218:11:218:11 | x | provenance | Sink:MaD:1 | | test.cpp:222:3:222:3 | operator[] output argument | test.cpp:223:12:223:12 | *s | provenance | | -| test.cpp:222:3:222:20 | ... = ... | test.cpp:222:3:222:3 | operator[] output argument | provenance | MaD:74 | -| test.cpp:222:10:222:20 | call to ymlSource | test.cpp:222:3:222:20 | ... = ... | provenance | Src:MaD:35 | -| test.cpp:223:12:223:12 | *s | test.cpp:223:13:223:15 | call to operator[] | provenance | MaD:73 | +| test.cpp:222:3:222:20 | ... = ... | test.cpp:222:3:222:3 | operator[] output argument | provenance | MaD:77 | +| test.cpp:222:10:222:18 | call to ymlSource | test.cpp:222:3:222:20 | ... = ... | provenance | Src:MaD:38 | +| test.cpp:223:12:223:12 | *s | test.cpp:223:13:223:15 | call to operator[] | provenance | MaD:76 | | test.cpp:223:13:223:15 | call to operator[] | test.cpp:223:13:223:15 | call to operator[] | provenance | | | test.cpp:223:13:223:15 | call to operator[] | test.cpp:224:11:224:11 | c | provenance | Sink:MaD:1 | -| windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:22:15:22:29 | *call to GetCommandLineA | provenance | Src:MaD:3 | +| test.cpp:243:10:243:10 | *s [value] | test.cpp:243:13:243:17 | value | provenance | | +| test.cpp:243:13:243:17 | value | test.cpp:243:13:243:17 | value | provenance | Sink:MaD:1 | +| test.cpp:247:26:247:39 | call to ymlFieldSource | test.cpp:247:26:247:39 | call to ymlFieldSource [value] | provenance | Src:MaD:37 | +| test.cpp:247:26:247:39 | call to ymlFieldSource [value] | test.cpp:248:10:248:16 | *wrapper [value] | provenance | | +| test.cpp:248:10:248:16 | *wrapper [value] | test.cpp:248:18:248:22 | value | provenance | | +| test.cpp:248:18:248:22 | value | test.cpp:248:18:248:22 | value | provenance | Sink:MaD:1 | +| test.cpp:250:32:250:32 | source_from_callback_template output argument | test.cpp:250:32:250:32 | source_from_callback_template output argument [value] | provenance | Src:MaD:36 | +| test.cpp:250:32:250:32 | source_from_callback_template output argument [value] | test.cpp:243:10:243:10 | *s [value] | provenance | | +| test.cpp:251:27:251:27 | source_from_callback_ptr output argument | test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | provenance | Src:MaD:35 | +| test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | test.cpp:243:10:243:10 | *s [value] | provenance | | +| test.cpp:253:32:255:2 | source_from_callback_template output argument | test.cpp:253:32:255:2 | source_from_callback_template output argument [value] | provenance | Src:MaD:36 | +| test.cpp:253:32:255:2 | source_from_callback_template output argument [value] | test.cpp:254:11:254:11 | *s [value] | provenance | | +| test.cpp:254:11:254:11 | *s [value] | test.cpp:254:14:254:18 | value | provenance | | +| test.cpp:254:14:254:18 | value | test.cpp:254:14:254:18 | value | provenance | Sink:MaD:1 | +| test.cpp:257:27:257:27 | source_from_callback_ptr output argument | test.cpp:257:27:257:27 | source_from_callback_ptr output argument [value] | provenance | Src:MaD:35 | +| test.cpp:257:27:257:27 | source_from_callback_ptr output argument [value] | test.cpp:258:11:258:11 | *s [value] | provenance | | +| test.cpp:258:11:258:11 | *s [value] | test.cpp:258:14:258:18 | value | provenance | | +| test.cpp:258:14:258:18 | value | test.cpp:258:14:258:18 | value | provenance | Sink:MaD:1 | +| test.cpp:263:12:263:12 | *s [value] | test.cpp:263:15:263:19 | value | provenance | | +| test.cpp:263:15:263:19 | value | test.cpp:263:15:263:19 | value | provenance | Sink:MaD:1 | +| test.cpp:267:32:267:34 | source_from_callback_template output argument | test.cpp:267:32:267:34 | source_from_callback_template output argument [value] | provenance | Src:MaD:36 | +| test.cpp:267:32:267:34 | source_from_callback_template output argument [value] | test.cpp:263:12:263:12 | *s [value] | provenance | | | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:24:8:24:11 | * ... | provenance | | | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:27:36:27:38 | *cmd | provenance | | +| windows.cpp:22:15:22:29 | call to GetCommandLineA | windows.cpp:22:15:22:29 | *call to GetCommandLineA | provenance | Src:MaD:3 | | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | | | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:30:8:30:15 | * ... | provenance | | -| windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | MaD:45 | -| windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | provenance | Src:MaD:4 | +| windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | MaD:48 | | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:36:10:36:13 | * ... | provenance | | +| windows.cpp:34:17:34:38 | call to GetEnvironmentStringsA | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | provenance | Src:MaD:4 | | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | windows.cpp:41:10:41:13 | * ... | provenance | Src:MaD:5 | | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | windows.cpp:149:42:149:53 | *lpOverlapped [*hEvent] | provenance | | | windows.cpp:149:18:149:62 | *hEvent | windows.cpp:149:18:149:62 | *hEvent | provenance | | @@ -250,32 +276,32 @@ edges | windows.cpp:189:21:189:26 | ReadFile output argument | windows.cpp:190:5:190:56 | *... = ... | provenance | Src:MaD:17 | | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | windows.cpp:192:53:192:63 | *& ... [*hEvent] | provenance | | | windows.cpp:190:5:190:56 | *... = ... | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | provenance | | -| windows.cpp:192:53:192:63 | *& ... [*hEvent] | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | provenance | MaD:52 | +| windows.cpp:192:53:192:63 | *& ... [*hEvent] | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | provenance | MaD:55 | | windows.cpp:198:21:198:26 | ReadFile output argument | windows.cpp:199:5:199:57 | ... = ... | provenance | Src:MaD:17 | | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | windows.cpp:201:53:201:63 | *& ... [hEvent] | provenance | | | windows.cpp:199:5:199:57 | ... = ... | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | provenance | | -| windows.cpp:201:53:201:63 | *& ... [hEvent] | windows.cpp:157:16:157:27 | *lpOverlapped [hEvent] | provenance | MaD:52 | +| windows.cpp:201:53:201:63 | *& ... [hEvent] | windows.cpp:157:16:157:27 | *lpOverlapped [hEvent] | provenance | MaD:55 | | windows.cpp:209:84:209:89 | NtReadFile output argument | windows.cpp:211:10:211:16 | * ... | provenance | Src:MaD:16 | -| windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:286:23:286:35 | *call to MapViewOfFile | provenance | Src:MaD:12 | | windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:287:20:287:52 | *pMapView | provenance | | +| windows.cpp:286:23:286:35 | call to MapViewOfFile | windows.cpp:286:23:286:35 | *call to MapViewOfFile | provenance | Src:MaD:12 | | windows.cpp:287:20:287:52 | *pMapView | windows.cpp:289:10:289:16 | * ... | provenance | | -| windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | provenance | Src:MaD:9 | | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | windows.cpp:294:20:294:52 | *pMapView | provenance | | +| windows.cpp:293:23:293:36 | call to MapViewOfFile2 | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | provenance | Src:MaD:9 | | windows.cpp:294:20:294:52 | *pMapView | windows.cpp:296:10:296:16 | * ... | provenance | | -| windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | provenance | Src:MaD:10 | | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | windows.cpp:303:20:303:52 | *pMapView | provenance | | +| windows.cpp:302:23:302:36 | call to MapViewOfFile3 | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | provenance | Src:MaD:10 | | windows.cpp:303:20:303:52 | *pMapView | windows.cpp:305:10:305:16 | * ... | provenance | | -| windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | provenance | Src:MaD:11 | | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | windows.cpp:312:20:312:52 | *pMapView | provenance | | +| windows.cpp:311:23:311:43 | call to MapViewOfFile3FromApp | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | provenance | Src:MaD:11 | | windows.cpp:312:20:312:52 | *pMapView | windows.cpp:314:10:314:16 | * ... | provenance | | -| windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | provenance | Src:MaD:13 | | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | windows.cpp:319:20:319:52 | *pMapView | provenance | | +| windows.cpp:318:23:318:37 | call to MapViewOfFileEx | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | provenance | Src:MaD:13 | | windows.cpp:319:20:319:52 | *pMapView | windows.cpp:321:10:321:16 | * ... | provenance | | -| windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | provenance | Src:MaD:14 | | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | windows.cpp:326:20:326:52 | *pMapView | provenance | | +| windows.cpp:325:23:325:42 | call to MapViewOfFileFromApp | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | provenance | Src:MaD:14 | | windows.cpp:326:20:326:52 | *pMapView | windows.cpp:328:10:328:16 | * ... | provenance | | -| windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | provenance | Src:MaD:15 | | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:333:20:333:52 | *pMapView | provenance | | +| windows.cpp:332:23:332:40 | call to MapViewOfFileNuma2 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | provenance | Src:MaD:15 | | windows.cpp:333:20:333:52 | *pMapView | windows.cpp:335:10:335:16 | * ... | provenance | | | windows.cpp:403:26:403:36 | *lpParameter [x] | windows.cpp:405:10:405:25 | *lpParameter [x] | provenance | | | windows.cpp:405:10:405:25 | *lpParameter [x] | windows.cpp:406:8:406:8 | *s [x] | provenance | | @@ -291,9 +317,9 @@ edges | windows.cpp:431:3:431:3 | *s [post update] [x] | windows.cpp:464:7:464:8 | *& ... [x] | provenance | | | windows.cpp:431:3:431:16 | ... = ... | windows.cpp:431:3:431:3 | *s [post update] [x] | provenance | | | windows.cpp:431:9:431:14 | call to source | windows.cpp:431:3:431:16 | ... = ... | provenance | | -| windows.cpp:439:7:439:8 | *& ... [x] | windows.cpp:403:26:403:36 | *lpParameter [x] | provenance | MaD:48 | -| windows.cpp:451:7:451:8 | *& ... [x] | windows.cpp:410:26:410:36 | *lpParameter [x] | provenance | MaD:46 | -| windows.cpp:464:7:464:8 | *& ... [x] | windows.cpp:417:26:417:36 | *lpParameter [x] | provenance | MaD:47 | +| windows.cpp:439:7:439:8 | *& ... [x] | windows.cpp:403:26:403:36 | *lpParameter [x] | provenance | MaD:51 | +| windows.cpp:451:7:451:8 | *& ... [x] | windows.cpp:410:26:410:36 | *lpParameter [x] | provenance | MaD:49 | +| windows.cpp:464:7:464:8 | *& ... [x] | windows.cpp:417:26:417:36 | *lpParameter [x] | provenance | MaD:50 | | windows.cpp:533:11:533:16 | call to source | windows.cpp:533:11:533:16 | call to source | provenance | | | windows.cpp:533:11:533:16 | call to source | windows.cpp:537:40:537:41 | *& ... | provenance | | | windows.cpp:533:11:533:16 | call to source | windows.cpp:542:38:542:39 | *& ... | provenance | | @@ -302,30 +328,30 @@ edges | windows.cpp:533:11:533:16 | call to source | windows.cpp:568:32:568:33 | *& ... | provenance | | | windows.cpp:533:11:533:16 | call to source | windows.cpp:573:40:573:41 | *& ... | provenance | | | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | windows.cpp:538:10:538:23 | access to array | provenance | | -| windows.cpp:537:40:537:41 | *& ... | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | provenance | MaD:57 | +| windows.cpp:537:40:537:41 | *& ... | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | provenance | MaD:60 | | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | windows.cpp:543:10:543:23 | access to array | provenance | | -| windows.cpp:542:38:542:39 | *& ... | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | provenance | MaD:53 | +| windows.cpp:542:38:542:39 | *& ... | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | provenance | MaD:56 | | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | windows.cpp:548:10:548:23 | access to array | provenance | | -| windows.cpp:547:32:547:33 | *& ... | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | provenance | MaD:54 | +| windows.cpp:547:32:547:33 | *& ... | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | provenance | MaD:57 | | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | windows.cpp:553:10:553:23 | access to array | provenance | | -| windows.cpp:552:43:552:44 | *& ... | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | provenance | MaD:55 | +| windows.cpp:552:43:552:44 | *& ... | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | provenance | MaD:58 | | windows.cpp:559:5:559:24 | ... = ... | windows.cpp:561:39:561:44 | *buffer | provenance | | | windows.cpp:559:17:559:24 | call to source | windows.cpp:559:5:559:24 | ... = ... | provenance | | | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:562:10:562:19 | *src_string [*Buffer] | provenance | | | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:563:40:563:50 | *& ... [*Buffer] | provenance | | -| windows.cpp:561:39:561:44 | *buffer | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | provenance | MaD:58 | +| windows.cpp:561:39:561:44 | *buffer | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | provenance | MaD:61 | | windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:10:562:29 | access to array | provenance | | | windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:21:562:26 | *Buffer | provenance | | | windows.cpp:562:21:562:26 | *Buffer | windows.cpp:562:10:562:29 | access to array | provenance | | | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | provenance | | -| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | provenance | MaD:56 | +| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | provenance | MaD:59 | | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:10:564:30 | access to array | provenance | | | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:22:564:27 | *Buffer | provenance | | | windows.cpp:564:22:564:27 | *Buffer | windows.cpp:564:10:564:30 | access to array | provenance | | | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | windows.cpp:569:10:569:23 | access to array | provenance | | -| windows.cpp:568:32:568:33 | *& ... | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | provenance | MaD:59 | +| windows.cpp:568:32:568:33 | *& ... | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | provenance | MaD:62 | | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | windows.cpp:574:10:574:23 | access to array | provenance | | -| windows.cpp:573:40:573:41 | *& ... | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | provenance | MaD:60 | +| windows.cpp:573:40:573:41 | *& ... | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | provenance | MaD:63 | | windows.cpp:645:45:645:50 | WinHttpReadData output argument | windows.cpp:647:10:647:16 | * ... | provenance | Src:MaD:33 | | windows.cpp:652:48:652:53 | WinHttpReadDataEx output argument | windows.cpp:654:10:654:16 | * ... | provenance | Src:MaD:34 | | windows.cpp:659:47:659:52 | WinHttpQueryHeaders output argument | windows.cpp:661:10:661:16 | * ... | provenance | Src:MaD:29 | @@ -334,7 +360,7 @@ edges | windows.cpp:669:105:669:112 | WinHttpQueryHeadersEx output argument | windows.cpp:675:10:675:27 | * ... | provenance | Src:MaD:30 | | windows.cpp:728:5:728:28 | ... = ... | windows.cpp:729:35:729:35 | *x | provenance | | | windows.cpp:728:12:728:28 | call to source | windows.cpp:728:5:728:28 | ... = ... | provenance | | -| windows.cpp:729:35:729:35 | *x | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | provenance | MaD:64 | +| windows.cpp:729:35:729:35 | *x | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | provenance | MaD:67 | | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | windows.cpp:731:10:731:36 | * ... | provenance | | | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | windows.cpp:733:10:733:35 | * ... | provenance | | | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | windows.cpp:735:10:735:37 | * ... | provenance | | @@ -369,49 +395,49 @@ edges | windows.cpp:1087:71:1087:74 | RegEnumValueW output argument | windows.cpp:1089:10:1089:14 | * ... | provenance | Src:MaD:20 | | windows.cpp:1122:5:1122:27 | ... = ... | windows.cpp:1124:19:1124:21 | *str | provenance | | | windows.cpp:1122:14:1122:27 | call to source | windows.cpp:1122:5:1122:27 | ... = ... | provenance | | -| windows.cpp:1124:19:1124:21 | *str | windows.cpp:1124:24:1124:27 | IIDFromString output argument | provenance | MaD:50 | +| windows.cpp:1124:19:1124:21 | *str | windows.cpp:1124:24:1124:27 | IIDFromString output argument | provenance | MaD:53 | | windows.cpp:1124:24:1124:27 | IIDFromString output argument | windows.cpp:1125:10:1125:12 | iid | provenance | | | windows.cpp:1128:15:1128:20 | call to source | windows.cpp:1128:15:1128:20 | call to source | provenance | | | windows.cpp:1128:15:1128:20 | call to source | windows.cpp:1130:19:1130:21 | *iid | provenance | | -| windows.cpp:1130:19:1130:21 | *iid | windows.cpp:1130:24:1130:27 | StringFromIID output argument | provenance | MaD:63 | +| windows.cpp:1130:19:1130:21 | *iid | windows.cpp:1130:24:1130:27 | StringFromIID output argument | provenance | MaD:66 | | windows.cpp:1130:24:1130:27 | StringFromIID output argument | windows.cpp:1132:10:1132:13 | * ... | provenance | | | windows.cpp:1135:19:1135:24 | call to source | windows.cpp:1135:19:1135:24 | call to source | provenance | | | windows.cpp:1135:19:1135:24 | call to source | windows.cpp:1137:21:1137:25 | *clsid | provenance | | -| windows.cpp:1137:21:1137:25 | *clsid | windows.cpp:1137:28:1137:31 | ProgIDFromCLSID output argument | provenance | MaD:51 | +| windows.cpp:1137:21:1137:25 | *clsid | windows.cpp:1137:28:1137:31 | ProgIDFromCLSID output argument | provenance | MaD:54 | | windows.cpp:1137:28:1137:31 | ProgIDFromCLSID output argument | windows.cpp:1139:10:1139:13 | * ... | provenance | | | windows.cpp:1143:5:1143:30 | ... = ... | windows.cpp:1145:21:1145:26 | *progID | provenance | | | windows.cpp:1143:17:1143:30 | call to source | windows.cpp:1143:5:1143:30 | ... = ... | provenance | | -| windows.cpp:1145:21:1145:26 | *progID | windows.cpp:1145:29:1145:34 | CLSIDFromProgID output argument | provenance | MaD:43 | +| windows.cpp:1145:21:1145:26 | *progID | windows.cpp:1145:29:1145:34 | CLSIDFromProgID output argument | provenance | MaD:46 | | windows.cpp:1145:29:1145:34 | CLSIDFromProgID output argument | windows.cpp:1146:10:1146:14 | clsid | provenance | | | windows.cpp:1150:5:1150:27 | ... = ... | windows.cpp:1152:21:1152:23 | *str | provenance | | | windows.cpp:1150:14:1150:27 | call to source | windows.cpp:1150:5:1150:27 | ... = ... | provenance | | -| windows.cpp:1152:21:1152:23 | *str | windows.cpp:1152:26:1152:31 | CLSIDFromString output argument | provenance | MaD:44 | +| windows.cpp:1152:21:1152:23 | *str | windows.cpp:1152:26:1152:31 | CLSIDFromString output argument | provenance | MaD:47 | | windows.cpp:1152:26:1152:31 | CLSIDFromString output argument | windows.cpp:1153:10:1153:14 | clsid | provenance | | | windows.cpp:1156:19:1156:24 | call to source | windows.cpp:1156:19:1156:24 | call to source | provenance | | | windows.cpp:1156:19:1156:24 | call to source | windows.cpp:1158:21:1158:25 | *clsid | provenance | | -| windows.cpp:1158:21:1158:25 | *clsid | windows.cpp:1158:28:1158:31 | StringFromCLSID output argument | provenance | MaD:61 | +| windows.cpp:1158:21:1158:25 | *clsid | windows.cpp:1158:28:1158:31 | StringFromCLSID output argument | provenance | MaD:64 | | windows.cpp:1158:28:1158:31 | StringFromCLSID output argument | windows.cpp:1160:10:1160:13 | * ... | provenance | | | windows.cpp:1164:5:1164:27 | ... = ... | windows.cpp:1166:20:1166:22 | *str | provenance | | | windows.cpp:1164:14:1164:27 | call to source | windows.cpp:1164:5:1164:27 | ... = ... | provenance | | -| windows.cpp:1166:20:1166:22 | *str | windows.cpp:1166:25:1166:29 | GUIDFromString output argument | provenance | MaD:49 | +| windows.cpp:1166:20:1166:22 | *str | windows.cpp:1166:25:1166:29 | GUIDFromString output argument | provenance | MaD:52 | | windows.cpp:1166:25:1166:29 | GUIDFromString output argument | windows.cpp:1167:10:1167:13 | guid | provenance | | | windows.cpp:1170:17:1170:22 | call to source | windows.cpp:1170:17:1170:22 | call to source | provenance | | | windows.cpp:1170:17:1170:22 | call to source | windows.cpp:1172:21:1172:24 | *guid | provenance | | -| windows.cpp:1172:21:1172:24 | *guid | windows.cpp:1172:27:1172:29 | StringFromGUID2 output argument | provenance | MaD:62 | +| windows.cpp:1172:21:1172:24 | *guid | windows.cpp:1172:27:1172:29 | StringFromGUID2 output argument | provenance | MaD:65 | | windows.cpp:1172:27:1172:29 | StringFromGUID2 output argument | windows.cpp:1174:10:1174:13 | * ... | provenance | | nodes | asio_streams.cpp:87:34:87:44 | read_until output argument | semmle.label | read_until output argument | | asio_streams.cpp:91:7:91:17 | recv_buffer | semmle.label | recv_buffer | -| asio_streams.cpp:93:29:93:39 | *recv_buffer | semmle.label | *recv_buffer | +| asio_streams.cpp:93:29:93:39 | recv_buffer | semmle.label | recv_buffer | | asio_streams.cpp:97:37:97:44 | call to source | semmle.label | call to source | | asio_streams.cpp:98:7:98:14 | send_str | semmle.label | send_str | | asio_streams.cpp:100:44:100:62 | call to buffer | semmle.label | call to buffer | | asio_streams.cpp:100:44:100:62 | call to buffer | semmle.label | call to buffer | | asio_streams.cpp:100:64:100:71 | *send_str | semmle.label | *send_str | | asio_streams.cpp:101:7:101:17 | send_buffer | semmle.label | send_buffer | -| asio_streams.cpp:103:29:103:39 | *send_buffer | semmle.label | *send_buffer | -| azure.cpp:253:48:253:60 | *call to GetBodyStream | semmle.label | *call to GetBodyStream | +| asio_streams.cpp:103:29:103:39 | send_buffer | semmle.label | send_buffer | | azure.cpp:253:48:253:60 | *call to GetBodyStream | semmle.label | *call to GetBodyStream | +| azure.cpp:253:48:253:60 | call to GetBodyStream | semmle.label | call to GetBodyStream | | azure.cpp:257:5:257:8 | *resp | semmle.label | *resp | | azure.cpp:257:16:257:21 | Read output argument | semmle.label | Read output argument | | azure.cpp:258:10:258:16 | * ... | semmle.label | * ... | @@ -423,25 +449,25 @@ nodes | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | semmle.label | call to ReadToEnd [element] | | azure.cpp:267:10:267:12 | vec | semmle.label | vec | | azure.cpp:267:10:267:12 | vec [element] | semmle.label | vec [element] | -| azure.cpp:273:62:273:64 | call to GetHeaders | semmle.label | call to GetHeaders | +| azure.cpp:273:52:273:61 | call to GetHeaders | semmle.label | call to GetHeaders | | azure.cpp:273:62:273:64 | call to GetHeaders | semmle.label | call to GetHeaders | | azure.cpp:274:10:274:29 | call to operator[] | semmle.label | call to operator[] | | azure.cpp:274:14:274:29 | call to operator[] | semmle.label | call to operator[] | | azure.cpp:274:14:274:29 | call to operator[] | semmle.label | call to operator[] | | azure.cpp:274:14:274:29 | call to operator[] | semmle.label | call to operator[] | -| azure.cpp:277:45:277:47 | call to GetBody | semmle.label | call to GetBody | +| azure.cpp:277:38:277:44 | call to GetBody | semmle.label | call to GetBody | | azure.cpp:277:45:277:47 | call to GetBody | semmle.label | call to GetBody | | azure.cpp:278:10:278:13 | body | semmle.label | body | | azure.cpp:278:10:278:13 | body | semmle.label | body | | azure.cpp:278:10:278:13 | body | semmle.label | body | | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | semmle.label | *call to ExtractBodyStream | -| azure.cpp:281:68:281:84 | *call to ExtractBodyStream | semmle.label | *call to ExtractBodyStream | +| azure.cpp:281:68:281:84 | call to ExtractBodyStream | semmle.label | call to ExtractBodyStream | | azure.cpp:282:10:282:38 | call to ReadToEnd | semmle.label | call to ReadToEnd | | azure.cpp:282:21:282:23 | *call to get | semmle.label | *call to get | | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | semmle.label | call to ReadToEnd [element] | | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | semmle.label | call to ReadToEnd [element] | | azure.cpp:289:24:289:56 | call to GetHeader | semmle.label | call to GetHeader | -| azure.cpp:289:32:289:40 | call to GetHeader | semmle.label | call to GetHeader | +| azure.cpp:289:32:289:40 | Value output argument | semmle.label | Value output argument | | azure.cpp:289:32:289:40 | call to GetHeader | semmle.label | call to GetHeader | | azure.cpp:289:63:289:65 | call to Value | semmle.label | call to Value | | azure.cpp:289:63:289:65 | call to Value | semmle.label | call to Value | @@ -480,6 +506,7 @@ nodes | test.cpp:47:12:47:19 | *arg [x] | semmle.label | *arg [x] | | test.cpp:48:13:48:13 | *s [x] | semmle.label | *s [x] | | test.cpp:48:16:48:16 | x | semmle.label | x | +| test.cpp:48:16:48:16 | x | semmle.label | x | | test.cpp:56:2:56:2 | *s [post update] [x] | semmle.label | *s [post update] [x] | | test.cpp:56:2:56:18 | ... = ... | semmle.label | ... = ... | | test.cpp:56:8:56:16 | call to ymlSource | semmle.label | call to ymlSource | @@ -556,20 +583,47 @@ nodes | test.cpp:218:11:218:11 | x | semmle.label | x | | test.cpp:222:3:222:3 | operator[] output argument | semmle.label | operator[] output argument | | test.cpp:222:3:222:20 | ... = ... | semmle.label | ... = ... | -| test.cpp:222:10:222:20 | call to ymlSource | semmle.label | call to ymlSource | +| test.cpp:222:10:222:18 | call to ymlSource | semmle.label | call to ymlSource | | test.cpp:223:12:223:12 | *s | semmle.label | *s | | test.cpp:223:13:223:15 | call to operator[] | semmle.label | call to operator[] | | test.cpp:223:13:223:15 | call to operator[] | semmle.label | call to operator[] | | test.cpp:224:11:224:11 | c | semmle.label | c | +| test.cpp:243:10:243:10 | *s [value] | semmle.label | *s [value] | +| test.cpp:243:13:243:17 | value | semmle.label | value | +| test.cpp:243:13:243:17 | value | semmle.label | value | +| test.cpp:247:26:247:39 | call to ymlFieldSource | semmle.label | call to ymlFieldSource | +| test.cpp:247:26:247:39 | call to ymlFieldSource [value] | semmle.label | call to ymlFieldSource [value] | +| test.cpp:248:10:248:16 | *wrapper [value] | semmle.label | *wrapper [value] | +| test.cpp:248:18:248:22 | value | semmle.label | value | +| test.cpp:248:18:248:22 | value | semmle.label | value | +| test.cpp:250:32:250:32 | source_from_callback_template output argument | semmle.label | source_from_callback_template output argument | +| test.cpp:250:32:250:32 | source_from_callback_template output argument [value] | semmle.label | source_from_callback_template output argument [value] | +| test.cpp:251:27:251:27 | source_from_callback_ptr output argument | semmle.label | source_from_callback_ptr output argument | +| test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | semmle.label | source_from_callback_ptr output argument [value] | +| test.cpp:253:32:255:2 | source_from_callback_template output argument | semmle.label | source_from_callback_template output argument | +| test.cpp:253:32:255:2 | source_from_callback_template output argument [value] | semmle.label | source_from_callback_template output argument [value] | +| test.cpp:254:11:254:11 | *s [value] | semmle.label | *s [value] | +| test.cpp:254:14:254:18 | value | semmle.label | value | +| test.cpp:254:14:254:18 | value | semmle.label | value | +| test.cpp:257:27:257:27 | source_from_callback_ptr output argument | semmle.label | source_from_callback_ptr output argument | +| test.cpp:257:27:257:27 | source_from_callback_ptr output argument [value] | semmle.label | source_from_callback_ptr output argument [value] | +| test.cpp:258:11:258:11 | *s [value] | semmle.label | *s [value] | +| test.cpp:258:14:258:18 | value | semmle.label | value | +| test.cpp:258:14:258:18 | value | semmle.label | value | +| test.cpp:263:12:263:12 | *s [value] | semmle.label | *s [value] | +| test.cpp:263:15:263:19 | value | semmle.label | value | +| test.cpp:263:15:263:19 | value | semmle.label | value | +| test.cpp:267:32:267:34 | source_from_callback_template output argument | semmle.label | source_from_callback_template output argument | +| test.cpp:267:32:267:34 | source_from_callback_template output argument [value] | semmle.label | source_from_callback_template output argument [value] | | windows.cpp:22:15:22:29 | *call to GetCommandLineA | semmle.label | *call to GetCommandLineA | -| windows.cpp:22:15:22:29 | *call to GetCommandLineA | semmle.label | *call to GetCommandLineA | +| windows.cpp:22:15:22:29 | call to GetCommandLineA | semmle.label | call to GetCommandLineA | | windows.cpp:24:8:24:11 | * ... | semmle.label | * ... | | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | semmle.label | **call to CommandLineToArgvA | | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | semmle.label | **call to CommandLineToArgvA | | windows.cpp:27:36:27:38 | *cmd | semmle.label | *cmd | | windows.cpp:30:8:30:15 | * ... | semmle.label | * ... | | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | semmle.label | *call to GetEnvironmentStringsA | -| windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | semmle.label | *call to GetEnvironmentStringsA | +| windows.cpp:34:17:34:38 | call to GetEnvironmentStringsA | semmle.label | call to GetEnvironmentStringsA | | windows.cpp:36:10:36:13 | * ... | semmle.label | * ... | | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | semmle.label | GetEnvironmentVariableA output argument | | windows.cpp:41:10:41:13 | * ... | semmle.label | * ... | @@ -599,31 +653,31 @@ nodes | windows.cpp:209:84:209:89 | NtReadFile output argument | semmle.label | NtReadFile output argument | | windows.cpp:211:10:211:16 | * ... | semmle.label | * ... | | windows.cpp:286:23:286:35 | *call to MapViewOfFile | semmle.label | *call to MapViewOfFile | -| windows.cpp:286:23:286:35 | *call to MapViewOfFile | semmle.label | *call to MapViewOfFile | +| windows.cpp:286:23:286:35 | call to MapViewOfFile | semmle.label | call to MapViewOfFile | | windows.cpp:287:20:287:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:289:10:289:16 | * ... | semmle.label | * ... | | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | semmle.label | *call to MapViewOfFile2 | -| windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | semmle.label | *call to MapViewOfFile2 | +| windows.cpp:293:23:293:36 | call to MapViewOfFile2 | semmle.label | call to MapViewOfFile2 | | windows.cpp:294:20:294:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:296:10:296:16 | * ... | semmle.label | * ... | | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | semmle.label | *call to MapViewOfFile3 | -| windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | semmle.label | *call to MapViewOfFile3 | +| windows.cpp:302:23:302:36 | call to MapViewOfFile3 | semmle.label | call to MapViewOfFile3 | | windows.cpp:303:20:303:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:305:10:305:16 | * ... | semmle.label | * ... | | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | semmle.label | *call to MapViewOfFile3FromApp | -| windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | semmle.label | *call to MapViewOfFile3FromApp | +| windows.cpp:311:23:311:43 | call to MapViewOfFile3FromApp | semmle.label | call to MapViewOfFile3FromApp | | windows.cpp:312:20:312:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:314:10:314:16 | * ... | semmle.label | * ... | | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | semmle.label | *call to MapViewOfFileEx | -| windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | semmle.label | *call to MapViewOfFileEx | +| windows.cpp:318:23:318:37 | call to MapViewOfFileEx | semmle.label | call to MapViewOfFileEx | | windows.cpp:319:20:319:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:321:10:321:16 | * ... | semmle.label | * ... | | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | semmle.label | *call to MapViewOfFileFromApp | -| windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | semmle.label | *call to MapViewOfFileFromApp | +| windows.cpp:325:23:325:42 | call to MapViewOfFileFromApp | semmle.label | call to MapViewOfFileFromApp | | windows.cpp:326:20:326:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:328:10:328:16 | * ... | semmle.label | * ... | | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | semmle.label | *call to MapViewOfFileNuma2 | -| windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | semmle.label | *call to MapViewOfFileNuma2 | +| windows.cpp:332:23:332:40 | call to MapViewOfFileNuma2 | semmle.label | call to MapViewOfFileNuma2 | | windows.cpp:333:20:333:52 | *pMapView | semmle.label | *pMapView | | windows.cpp:335:10:335:16 | * ... | semmle.label | * ... | | windows.cpp:403:26:403:36 | *lpParameter [x] | semmle.label | *lpParameter [x] | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected index 858f12bdd69e..32f130cd165d 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected @@ -1,5 +1,5 @@ -| asio_streams.cpp:93:29:93:39 | *recv_buffer | remote-sink | -| asio_streams.cpp:103:29:103:39 | *send_buffer | remote-sink | +| asio_streams.cpp:93:29:93:39 | recv_buffer | remote-sink | +| asio_streams.cpp:103:29:103:39 | send_buffer | remote-sink | | test.cpp:12:10:12:10 | 0 | test-sink | | test.cpp:14:10:14:10 | x | test-sink | | test.cpp:18:10:18:10 | y | test-sink | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/sources.expected b/cpp/ql/test/library-tests/dataflow/external-models/sources.expected index 3556bd9d51dd..9dfb62bdafde 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/sources.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/sources.expected @@ -1,9 +1,9 @@ | asio_streams.cpp:87:34:87:44 | read_until output argument | remote | -| azure.cpp:253:48:253:60 | *call to GetBodyStream | remote | -| azure.cpp:273:62:273:64 | call to GetHeaders | remote | -| azure.cpp:277:45:277:47 | call to GetBody | remote | -| azure.cpp:281:68:281:84 | *call to ExtractBodyStream | remote | -| azure.cpp:289:32:289:40 | call to GetHeader | remote | +| azure.cpp:253:48:253:60 | call to GetBodyStream | remote | +| azure.cpp:273:52:273:61 | call to GetHeaders | remote | +| azure.cpp:277:38:277:44 | call to GetBody | remote | +| azure.cpp:281:68:281:84 | call to ExtractBodyStream | remote | +| azure.cpp:289:32:289:40 | Value output argument | remote | | azure.cpp:293:58:293:67 | call to GetHeaders | remote | | test.cpp:10:10:10:18 | call to ymlSource | local | | test.cpp:56:8:56:16 | call to ymlSource | local | @@ -16,9 +16,9 @@ | test.cpp:186:14:186:22 | call to ymlSource | local | | test.cpp:199:14:199:22 | call to ymlSource | local | | test.cpp:216:18:216:26 | call to ymlSource | local | -| test.cpp:222:10:222:20 | call to ymlSource | local | -| windows.cpp:22:15:22:29 | *call to GetCommandLineA | local | -| windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | local | +| test.cpp:222:10:222:18 | call to ymlSource | local | +| windows.cpp:22:15:22:29 | call to GetCommandLineA | local | +| windows.cpp:34:17:34:38 | call to GetEnvironmentStringsA | local | | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | local | | windows.cpp:168:35:168:40 | ReadFile output argument | local | | windows.cpp:177:23:177:28 | ReadFileEx output argument | local | @@ -27,13 +27,13 @@ | windows.cpp:198:21:198:26 | ReadFile output argument | local | | windows.cpp:201:23:201:29 | ReadFileEx output argument | local | | windows.cpp:209:84:209:89 | NtReadFile output argument | local | -| windows.cpp:286:23:286:35 | *call to MapViewOfFile | local | -| windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | local | -| windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | local | -| windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | local | -| windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | local | -| windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | local | -| windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | local | +| windows.cpp:286:23:286:35 | call to MapViewOfFile | local | +| windows.cpp:293:23:293:36 | call to MapViewOfFile2 | local | +| windows.cpp:302:23:302:36 | call to MapViewOfFile3 | local | +| windows.cpp:311:23:311:43 | call to MapViewOfFile3FromApp | local | +| windows.cpp:318:23:318:37 | call to MapViewOfFileEx | local | +| windows.cpp:325:23:325:42 | call to MapViewOfFileFromApp | local | +| windows.cpp:332:23:332:40 | call to MapViewOfFileNuma2 | local | | windows.cpp:645:45:645:50 | WinHttpReadData output argument | remote | | windows.cpp:652:48:652:53 | WinHttpReadDataEx output argument | remote | | windows.cpp:659:47:659:52 | WinHttpQueryHeaders output argument | remote | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/test.cpp b/cpp/ql/test/library-tests/dataflow/external-models/test.cpp index 44138fd16e79..bfdf213fc3c1 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/test.cpp +++ b/cpp/ql/test/library-tests/dataflow/external-models/test.cpp @@ -240,27 +240,27 @@ using Callback = void(*)(const SourceWrapper*); void source_from_callback_ptr(Callback); void f(const SourceWrapper* s) { - ymlSink(s->value); // $ MISSING: ir=250:32 ir=251:27 + ymlSink(s->value); // $ ir=250:32 ir=251:27 } void test_source_access_path() { SourceWrapper wrapper = ymlFieldSource(); - ymlSink(wrapper.value); // $ MISSING: ir + ymlSink(wrapper.value); // $ ir source_from_callback_template(f); source_from_callback_ptr(f); source_from_callback_template([](const SourceWrapper* s) { - ymlSink(s->value); // $ MISSING: ir + ymlSink(s->value); // $ ir }); source_from_callback_ptr([](const SourceWrapper* s) { - ymlSink(s->value); // $ MISSING: ir + ymlSink(s->value); // $ ir }); struct S { void operator()(const SourceWrapper* s) { - ymlSink(s->value); // $ MISSING: ir + ymlSink(s->value); // $ ir } }; diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected index 7d1e2bc9327a..8492e0c9ddec 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected @@ -18,6 +18,10 @@ postIsInSameCallable reverseRead argHasPostUpdate postWithInFlow +| tests.cpp:60:30:60:31 | remoteMadSourceIndirectArg0 output argument | PostUpdateNode should not be the target of local flow. | +| tests.cpp:63:33:63:33 | remoteMadSourceIndirectArg1 output argument | PostUpdateNode should not be the target of local flow. | +| tests.cpp:295:39:295:40 | memberRemoteMadSourceIndirectArg0 output argument | PostUpdateNode should not be the target of local flow. | +| tests.cpp:369:2:369:4 | qualifierSource output argument | PostUpdateNode should not be the target of local flow. | viableImplInCallContextTooLarge uniqueParameterNodeAtPosition uniqueParameterNodePosition @@ -283,6 +287,42 @@ sourceCallables | tests.cpp:433:6:433:10 | array | | tests.cpp:434:6:434:6 | y | flowSummaryNode +| tests.cpp:36:7:36:20 | sink output argument | | | test_sources | +| tests.cpp:37:7:37:21 | sink output argument | | | test_sources | +| tests.cpp:39:7:39:24 | sink output argument | | | test_sources | +| tests.cpp:40:7:40:27 | sink output argument | | | test_sources | +| tests.cpp:45:10:45:23 | call to localMadSource | | | test_sources | +| tests.cpp:53:7:53:29 | sink output argument | | | test_sources | +| tests.cpp:54:8:54:30 | call to remoteMadSourceIndirect | | | test_sources | +| tests.cpp:55:8:55:36 | call to remoteMadSourceDoubleIndirect | | | test_sources | +| tests.cpp:56:9:56:37 | call to remoteMadSourceDoubleIndirect | | | test_sources | +| tests.cpp:60:30:60:31 | remoteMadSourceIndirectArg0 output argument | | | test_sources | +| tests.cpp:63:33:63:33 | remoteMadSourceIndirectArg1 output argument | | | test_sources | +| tests.cpp:67:10:67:23 | call to localMadSource | | | test_sources | +| tests.cpp:70:7:70:57 | sink output argument | | | test_sources | +| tests.cpp:75:32:75:32 | x | | | remoteMadSourceParam0 | +| tests.cpp:95:14:95:19 | call to source | | | test_sinks | +| tests.cpp:97:24:97:24 | 0 | | | test_sinks | +| tests.cpp:98:17:98:22 | call to source | | | test_sinks | +| tests.cpp:99:15:99:20 | call to source | | | test_sinks | +| tests.cpp:99:25:99:25 | 0 | | | test_sinks | +| tests.cpp:100:15:100:15 | 0 | | | test_sinks | +| tests.cpp:100:18:100:23 | call to source | | | test_sinks | +| tests.cpp:101:15:101:15 | 0 | | | test_sinks | +| tests.cpp:101:18:101:18 | 0 | | | test_sinks | +| tests.cpp:102:15:102:20 | call to source | | | test_sinks | +| tests.cpp:102:28:102:28 | 0 | | | test_sinks | +| tests.cpp:103:15:103:15 | 0 | | | test_sinks | +| tests.cpp:103:28:103:28 | 0 | | | test_sinks | +| tests.cpp:104:15:104:15 | 0 | | | test_sinks | +| tests.cpp:104:21:104:26 | call to source | | | test_sinks | +| tests.cpp:108:22:108:23 | & ... | | | test_sinks | +| tests.cpp:109:22:109:26 | a_ptr | | | test_sinks | +| tests.cpp:110:28:110:33 | & ... | | | test_sinks | +| tests.cpp:111:14:111:27 | call to localMadSource | | | test_sinks | +| tests.cpp:111:14:111:27 | madSinkArg0 output argument | | | test_sinks | +| tests.cpp:112:22:112:44 | call to remoteMadSourceIndirect | | | test_sinks | +| tests.cpp:112:22:112:44 | madSinkIndirectArg0 output argument | | | test_sinks | | tests.cpp:127:5:127:19 | [summary param] 0 in madArg0ToReturn | ParameterNode | madArg0ToReturn | madArg0ToReturn | | tests.cpp:127:5:127:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn | | tests.cpp:128:6:128:28 | [summary param] 0 in madArg0ToReturnIndirect | ParameterNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect | @@ -325,6 +365,12 @@ flowSummaryNode | tests.cpp:148:13:148:40 | [summary param] 0 in madArg0ToReturnFieldIndirect | ParameterNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect | | tests.cpp:148:13:148:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect | | tests.cpp:148:13:148:40 | [summary] to write: ReturnValue.Field[*MyContainer::ptr]/Field[*ptr] in madArg0ToReturnFieldIndirect | | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect | +| tests.cpp:225:14:225:28 | call to madArg0ToReturn | | | test_summaries | +| tests.cpp:225:30:225:44 | madArg0ToReturn output argument | | | test_summaries | +| tests.cpp:226:14:226:37 | call to madArg0ToReturnValueFlow | | | test_summaries | +| tests.cpp:226:39:226:53 | madArg0ToReturnValueFlow output argument | | | test_summaries | +| tests.cpp:227:14:227:36 | call to madArg0IndirectToReturn | | | test_summaries | +| tests.cpp:228:14:228:36 | call to madArg0IndirectToReturn | | | test_summaries | | tests.cpp:250:7:250:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf | | tests.cpp:250:7:250:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf | | tests.cpp:250:7:250:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf | @@ -339,6 +385,27 @@ flowSummaryNode | tests.cpp:254:6:254:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn | | tests.cpp:277:7:277:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn | | tests.cpp:277:7:277:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn | +| tests.cpp:292:10:292:30 | sink output argument | | | test_class_members | +| tests.cpp:295:39:295:40 | memberRemoteMadSourceIndirectArg0 output argument | | | test_class_members | +| tests.cpp:300:11:300:31 | sink output argument | | | test_class_members | +| tests.cpp:301:11:301:33 | sink output argument | | | test_class_members | +| tests.cpp:303:11:303:33 | sink output argument | | | test_class_members | +| tests.cpp:307:23:307:28 | call to source | | | test_class_members | +| tests.cpp:309:33:309:38 | call to source | | | test_class_members | +| tests.cpp:310:57:310:62 | call to source | | | test_class_members | +| tests.cpp:351:26:351:46 | call to memberRemoteMadSource | | | test_class_members | +| tests.cpp:351:26:351:46 | memberMadSinkArg0 output argument | | | test_class_members | +| tests.cpp:362:2:362:4 | mc8 | | | test_class_members | +| tests.cpp:362:24:362:24 | 0 | | | test_class_members | +| tests.cpp:363:2:363:4 | mc8 | | | test_class_members | +| tests.cpp:363:24:363:29 | call to source | | | test_class_members | +| tests.cpp:366:2:366:4 | mc9 | | | test_class_members | +| tests.cpp:367:2:367:4 | mc9 | | | test_class_members | +| tests.cpp:367:24:367:24 | 0 | | | test_class_members | +| tests.cpp:369:2:369:4 | qualifierSource output argument | | | test_class_members | +| tests.cpp:371:2:371:4 | mc8 | | | test_class_members | +| tests.cpp:372:2:372:4 | mc9 | | | test_class_members | +| tests.cpp:372:24:372:24 | 0 | | | test_class_members | | tests.cpp:392:5:392:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn | | tests.cpp:392:5:392:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn | | tests.cpp:392:5:392:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn | From b89e4f124781f1e69a423f6f83de69b823cccff3 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Tue, 18 Aug 2026 16:36:14 +0100 Subject: [PATCH 5/7] C++: Hide flow summary nodes from consistency just like Rust does. --- .../cpp/ir/dataflow/internal/DataFlowImplConsistency.qll | 8 ++++++++ .../dataflow/models-as-data/testModels.expected | 4 ---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll index 6b0de326d114..3b900320882b 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll @@ -6,6 +6,8 @@ private import cpp private import DataFlowImplSpecific private import TaintTrackingImplSpecific +private import DataFlowNodes as Nodes +private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl private import codeql.dataflow.internal.DataFlowImplConsistency private module Input implements InputSig { @@ -14,6 +16,12 @@ private module Input implements InputSig { // complex to model here. any() } + + predicate postWithInFlowExclude(CppDataFlow::Node n) { + n instanceof Nodes::FlowSummaryNode + or + FlowSummaryImpl::Private::Steps::summaryLocalStep(_, n, _, _) + } } module Consistency = MakeConsistency; diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected index 8492e0c9ddec..899b9bf80353 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected @@ -18,10 +18,6 @@ postIsInSameCallable reverseRead argHasPostUpdate postWithInFlow -| tests.cpp:60:30:60:31 | remoteMadSourceIndirectArg0 output argument | PostUpdateNode should not be the target of local flow. | -| tests.cpp:63:33:63:33 | remoteMadSourceIndirectArg1 output argument | PostUpdateNode should not be the target of local flow. | -| tests.cpp:295:39:295:40 | memberRemoteMadSourceIndirectArg0 output argument | PostUpdateNode should not be the target of local flow. | -| tests.cpp:369:2:369:4 | qualifierSource output argument | PostUpdateNode should not be the target of local flow. | viableImplInCallContextTooLarge uniqueParameterNodeAtPosition uniqueParameterNodePosition From 39b226eaa94bcb1f9d09b52d3c81a64bd765c26a Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Tue, 18 Aug 2026 18:45:58 +0100 Subject: [PATCH 6/7] C++: Fixup 'cpp/sql-injection' so that it doesn't require the sink to be an (indirect)expr. --- cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql | 34 ++++++++----------- .../CWE-089/SqlTainted/SqlTainted.expected | 22 ++++++------ 2 files changed, 26 insertions(+), 30 deletions(-) diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql index 802888be271a..0dda69b565d8 100644 --- a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql +++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql @@ -33,15 +33,20 @@ Expr asSinkExpr(DataFlow::Node node) { result = node.asExpr() } +private predicate isSink(DataFlow::Node sink, string extraText) { + exists(SqlLikeFunction runSql, string callChain | + runSql.outermostWrapperFunctionCall(asSinkExpr(sink), callChain) and + extraText = " and then passed to " + callChain + ) + or + // sink defined using models-as-data + sinkNode(sink, "sql-injection") and extraText = "" +} + module SqlTaintedConfig implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node node) { node instanceof FlowSource } - predicate isSink(DataFlow::Node node) { - exists(SqlLikeFunction runSql | runSql.outermostWrapperFunctionCall(asSinkExpr(node), _)) - or - // sink defined using models-as-data - sinkNode(node, "sql-injection") - } + predicate isSink(DataFlow::Node node) { isSink(node, _) } predicate isBarrier(DataFlow::Node node) { node.asExpr().getUnspecifiedType() instanceof IntegralType @@ -68,21 +73,12 @@ module SqlTaintedConfig implements DataFlow::ConfigSig { module SqlTainted = TaintTracking::Global; from - Expr taintedArg, FlowSource taintSource, SqlTainted::PathNode sourceNode, - SqlTainted::PathNode sinkNode, string extraText + FlowSource taintSource, SqlTainted::PathNode sourceNode, SqlTainted::PathNode sinkNode, + string extraText where - ( - exists(SqlLikeFunction runSql, string callChain | - runSql.outermostWrapperFunctionCall(taintedArg, callChain) and - extraText = " and then passed to " + callChain - ) - or - sinkNode(sinkNode.getNode(), "sql-injection") and - extraText = "" - ) and SqlTainted::flowPath(sourceNode, sinkNode) and - taintedArg = asSinkExpr(sinkNode.getNode()) and + isSink(sinkNode.getNode(), extraText) and taintSource = sourceNode.getNode() -select taintedArg, sourceNode, sinkNode, +select sinkNode.getNode(), sourceNode, sinkNode, "This argument to a SQL query function is derived from $@" + extraText + ".", taintSource, "user input (" + taintSource.getSourceType() + ")" diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected index df780acdd8d0..2e00cb866749 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected @@ -1,11 +1,11 @@ #select -| test.c:21:18:21:23 | query1 | test.c:14:27:14:30 | **argv | test.c:21:18:21:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) | -| test.c:51:18:51:23 | query1 | test.c:14:27:14:30 | **argv | test.c:51:18:51:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) | -| test.c:76:17:76:25 | userInput | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLPrepare(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) | -| test.c:77:20:77:28 | userInput | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLExecDirect(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) | -| test.c:106:24:106:29 | query1 | test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | *query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) | -| test.c:107:28:107:33 | query1 | test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | *query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) | -| test.cpp:43:27:43:33 | access to array | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | This argument to a SQL query function is derived from $@ and then passed to pqxx::work::exec1((unnamed parameter 0)). | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) | +| test.c:21:18:21:23 | *query1 | test.c:14:27:14:30 | **argv | test.c:21:18:21:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) | +| test.c:51:18:51:23 | *query1 | test.c:14:27:14:30 | **argv | test.c:51:18:51:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) | +| test.c:76:17:76:25 | *userInput | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLPrepare(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) | +| test.c:77:20:77:28 | *userInput | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLExecDirect(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) | +| test.c:106:24:106:29 | query1 | test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) | +| test.c:107:28:107:33 | query1 | test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) | +| test.cpp:43:27:43:33 | *access to array | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | This argument to a SQL query function is derived from $@ and then passed to pqxx::work::exec1((unnamed parameter 0)). | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) | edges | test.c:14:27:14:30 | **argv | test.c:15:20:15:26 | *access to array | provenance | | | test.c:15:20:15:26 | *access to array | test.c:21:18:21:23 | *query1 | provenance | TaintFunction | @@ -17,8 +17,8 @@ edges | test.c:48:20:48:33 | *globalUsername | test.c:51:18:51:23 | *query1 | provenance | TaintFunction | | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | provenance | | | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | provenance | | -| test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | *query1 | provenance | TaintFunction Sink:MaD:2 | -| test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | *query1 | provenance | TaintFunction Sink:MaD:1 | +| test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | query1 | provenance | TaintFunction Sink:MaD:2 | +| test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | query1 | provenance | TaintFunction Sink:MaD:1 | | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | provenance | | models | 1 | Sink: ; ; false; OCIStmtPrepare2; ; ; Argument[*3]; sql-injection; manual | @@ -37,8 +37,8 @@ nodes | test.c:76:17:76:25 | *userInput | semmle.label | *userInput | | test.c:77:20:77:28 | *userInput | semmle.label | *userInput | | test.c:101:8:101:16 | gets output argument | semmle.label | gets output argument | -| test.c:106:24:106:29 | *query1 | semmle.label | *query1 | -| test.c:107:28:107:33 | *query1 | semmle.label | *query1 | +| test.c:106:24:106:29 | query1 | semmle.label | query1 | +| test.c:107:28:107:33 | query1 | semmle.label | query1 | | test.cpp:39:27:39:30 | **argv | semmle.label | **argv | | test.cpp:43:27:43:33 | *access to array | semmle.label | *access to array | subpaths From 497d9b6a238135ae0dcf552268e71b3272fbe4b9 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Tue, 18 Aug 2026 18:46:19 +0100 Subject: [PATCH 7/7] C++: Accept test changes. Nothing exciting here. --- .../semmle/tests/ExposedSystemData.expected | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected index 6b4be51fd33e..a174000efec8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected @@ -9,11 +9,11 @@ | tests2.cpp:93:14:93:17 | *str1 | tests2.cpp:91:42:91:45 | *str1 | tests2.cpp:93:14:93:17 | *str1 | This operation exposes system data from $@. | tests2.cpp:91:42:91:45 | *str1 | *str1 | | tests2.cpp:102:14:102:15 | *pw | tests2.cpp:101:8:101:15 | *call to getpwuid | tests2.cpp:102:14:102:15 | *pw | This operation exposes system data from $@. | tests2.cpp:101:8:101:15 | *call to getpwuid | *call to getpwuid | | tests2.cpp:111:14:111:19 | *ptr | tests2.cpp:109:12:109:17 | *call to getenv | tests2.cpp:111:14:111:19 | *ptr | This operation exposes system data from $@. | tests2.cpp:109:12:109:17 | *call to getenv | *call to getenv | -| tests2.cpp:138:23:138:34 | *message_data | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:138:23:138:34 | *message_data | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | -| tests2.cpp:144:33:144:40 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:144:33:144:40 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | -| tests2.cpp:147:20:147:27 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:147:20:147:27 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | -| tests2.cpp:155:32:155:39 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:155:32:155:39 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | -| tests2.cpp:158:20:158:27 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:158:20:158:27 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | +| tests2.cpp:138:23:138:34 | message_data | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:138:23:138:34 | message_data | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | +| tests2.cpp:144:33:144:40 | & ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:144:33:144:40 | & ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | +| tests2.cpp:147:20:147:27 | & ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:147:20:147:27 | & ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | +| tests2.cpp:155:32:155:39 | & ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:155:32:155:39 | & ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | +| tests2.cpp:158:20:158:27 | & ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:158:20:158:27 | & ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv | | tests_sockets.cpp:39:19:39:22 | *path | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:39:19:39:22 | *path | This operation exposes system data from $@. | tests_sockets.cpp:26:15:26:20 | *call to getenv | *call to getenv | | tests_sockets.cpp:43:20:43:23 | *path | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:43:20:43:23 | *path | This operation exposes system data from $@. | tests_sockets.cpp:26:15:26:20 | *call to getenv | *call to getenv | | tests_sockets.cpp:76:19:76:22 | *path | tests_sockets.cpp:63:15:63:20 | *call to getenv | tests_sockets.cpp:76:19:76:22 | *path | This operation exposes system data from $@. | tests_sockets.cpp:63:15:63:20 | *call to getenv | *call to getenv | @@ -33,13 +33,13 @@ edges | tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:14:111:19 | *ptr | provenance | | | tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:17:111:19 | *ptr | provenance | | | tests2.cpp:111:17:111:19 | *ptr | tests2.cpp:111:14:111:19 | *ptr | provenance | | -| tests2.cpp:134:2:134:30 | *... = ... | tests2.cpp:138:23:138:34 | *message_data | provenance | Sink:MaD:2 | +| tests2.cpp:134:2:134:30 | *... = ... | tests2.cpp:138:23:138:34 | message_data | provenance | Sink:MaD:2 | | tests2.cpp:134:2:134:30 | *... = ... | tests2.cpp:143:34:143:45 | *message_data | provenance | | | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:134:2:134:30 | *... = ... | provenance | | -| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:144:33:144:40 | *& ... | provenance | Sink:MaD:3 | -| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:147:20:147:27 | *& ... | provenance | Sink:MaD:1 | -| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:155:32:155:39 | *& ... | provenance | Sink:MaD:3 | -| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:158:20:158:27 | *& ... | provenance | Sink:MaD:1 | +| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:144:33:144:40 | & ... | provenance | Sink:MaD:3 | +| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:147:20:147:27 | & ... | provenance | Sink:MaD:1 | +| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:155:32:155:39 | & ... | provenance | Sink:MaD:3 | +| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:158:20:158:27 | & ... | provenance | Sink:MaD:1 | | tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | provenance | MaD:4 | | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:26:15:26:20 | *call to getenv | provenance | | | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:39:19:39:22 | *path | provenance | | @@ -78,13 +78,13 @@ nodes | tests2.cpp:111:17:111:19 | *ptr | semmle.label | *ptr | | tests2.cpp:134:2:134:30 | *... = ... | semmle.label | *... = ... | | tests2.cpp:134:17:134:22 | *call to getenv | semmle.label | *call to getenv | -| tests2.cpp:138:23:138:34 | *message_data | semmle.label | *message_data | +| tests2.cpp:138:23:138:34 | message_data | semmle.label | message_data | | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | semmle.label | zmq_msg_init_data output argument | | tests2.cpp:143:34:143:45 | *message_data | semmle.label | *message_data | -| tests2.cpp:144:33:144:40 | *& ... | semmle.label | *& ... | -| tests2.cpp:147:20:147:27 | *& ... | semmle.label | *& ... | -| tests2.cpp:155:32:155:39 | *& ... | semmle.label | *& ... | -| tests2.cpp:158:20:158:27 | *& ... | semmle.label | *& ... | +| tests2.cpp:144:33:144:40 | & ... | semmle.label | & ... | +| tests2.cpp:147:20:147:27 | & ... | semmle.label | & ... | +| tests2.cpp:155:32:155:39 | & ... | semmle.label | & ... | +| tests2.cpp:158:20:158:27 | & ... | semmle.label | & ... | | tests_sockets.cpp:26:15:26:20 | *call to getenv | semmle.label | *call to getenv | | tests_sockets.cpp:26:15:26:20 | *call to getenv | semmle.label | *call to getenv | | tests_sockets.cpp:39:19:39:22 | *path | semmle.label | *path |