From 7197c64e2d01cbc9a78fdfe1c12131b562ef137e Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Mon, 12 Feb 2024 13:49:15 +0100 Subject: [PATCH 1/3] C#: Add more variable capture tests --- .../library-tests/dataflow/global/Capture.cs | 155 ++++++++++++++++- .../dataflow/global/DataFlow.expected | 25 ++- .../dataflow/global/DataFlowPath.expected | 158 +++++++++++++----- .../dataflow/global/GetAnOutNode.expected | 39 ++--- .../dataflow/global/TaintTracking.expected | 25 ++- .../global/TaintTrackingPath.expected | 158 +++++++++++++----- 6 files changed, 441 insertions(+), 119 deletions(-) diff --git a/csharp/ql/test/library-tests/dataflow/global/Capture.cs b/csharp/ql/test/library-tests/dataflow/global/Capture.cs index bfa0da36c90e..7c6c1d8a04cc 100644 --- a/csharp/ql/test/library-tests/dataflow/global/Capture.cs +++ b/csharp/ql/test/library-tests/dataflow/global/Capture.cs @@ -111,10 +111,12 @@ void M() string sink40 = ""; void CaptureOutMultipleLambdas() { - RunAction(() => { + RunAction(() => + { sink40 = "taint source"; }); - RunAction(() => { + RunAction(() => + { nonSink0 = "not tainted"; }); }; @@ -197,10 +199,159 @@ string Id(string s) Check(nonSink0); } + void M1(string s) + { + Action a = () => + { + Check(s); + }; + a(); + } + + void M2() => M1("taint source"); + + Action M3(string s) + { + return () => + { + Check(s); // missing flow from lines 221 and 223 + }; + } + + void M4() => M3("taint source")(); + + void M5() => RunAction(M3("taint source")); + + void M6() + { + List xs = new List { 0, 1, 2 }; + var x = "taint source"; + xs.ForEach(_ => + { + Check(x); + x = "taint source"; + }); + Check(x); + } + + public string Field; + + void M7() + { + var c = new Capture(); + c.Field = "taint source"; + + Action a = () => + { + Check(c.Field); // missing flow from line 242 + c.Field = "taint source"; + }; + a(); + + Check(c.Field); // missing flow from line 247 + } + + void M7(bool b) + { + var c = new Capture(); + if (b) + { + c = null; + } + + Action a = () => + { + c.Field = "taint source"; + }; + a(); + + Check(c.Field); // missing flow from line 264 + } + + void M8() + { + RunAction(x => Check(x), "taint source"); + } + + void M9() + { + var x = "taint source"; + + Action middle = () => + { + Action inner = () => + { + Check(x); + x = "taint source"; + }; + inner(); + }; + + middle(); + + Check(x); + } + + void M10() + { + this.Field = "taint source"; + + Action a = () => + { + Check(this.Field); // missing flow from line 297 + this.Field = "taint source"; + }; + a(); + + Check(this.Field); // missing flow from line 302 + } + + void M11() + { + var x = "taint source"; + Check(x); + x = "safe"; + Check(x); + + Action a = () => + { + x = "taint source"; + Check(x); + x = "safe"; + Check(x); + }; + a(); + } + + void M12() + { + var x = "taint source"; + + void CapturedLocalFunction() => Check(x); // missing flow from line 328 + + void CapturingLocalFunction() => CapturedLocalFunction(); + } + + void M13() + { + var x = "taint source"; + + Action capturedLambda = () => Check(x); + + Action capturingLambda = () => capturedLambda(); + + capturingLambda(); + } + static void Check(T x) { } static void RunAction(Action a) { a.Invoke(); } + + static void RunAction(Action a, T x) + { + a(x); + } } diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected index c57da19dc662..b2244abaa60c 100644 --- a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected +++ b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected @@ -5,13 +5,24 @@ | Capture.cs:72:15:72:20 | access to local variable sink30 | | Capture.cs:84:15:84:20 | access to local variable sink31 | | Capture.cs:93:15:93:20 | access to local variable sink32 | -| Capture.cs:122:15:122:20 | access to local variable sink40 | -| Capture.cs:133:15:133:20 | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | -| Capture.cs:161:15:161:20 | access to local variable sink36 | -| Capture.cs:169:15:169:20 | access to local variable sink37 | -| Capture.cs:195:15:195:20 | access to local variable sink38 | +| Capture.cs:124:15:124:20 | access to local variable sink40 | +| Capture.cs:135:15:135:20 | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | +| Capture.cs:163:15:163:20 | access to local variable sink36 | +| Capture.cs:171:15:171:20 | access to local variable sink37 | +| Capture.cs:197:15:197:20 | access to local variable sink38 | +| Capture.cs:206:19:206:19 | access to parameter s | +| Capture.cs:231:19:231:19 | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | +| Capture.cs:251:15:251:21 | access to field Field | +| Capture.cs:273:30:273:30 | access to parameter x | +| Capture.cs:284:23:284:23 | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | +| Capture.cs:306:15:306:24 | access to field Field | +| Capture.cs:312:15:312:15 | access to local variable x | +| Capture.cs:319:19:319:19 | access to local variable x | +| Capture.cs:339:45:339:45 | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | | GlobalDataFlow.cs:45:50:45:59 | access to parameter sinkParam2 | diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected index 3e7fca0c3e39..6cea5180e89e 100644 --- a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected +++ b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected @@ -14,22 +14,48 @@ edges | Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:79:17:79:22 | access to local variable sink31 : String | provenance | | | Capture.cs:89:13:89:18 | access to local variable sink32 : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | | Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:89:13:89:18 | access to local variable sink32 : String | provenance | | -| Capture.cs:115:17:115:22 | access to local variable sink40 : String | Capture.cs:122:15:122:20 | access to local variable sink40 | provenance | | -| Capture.cs:115:26:115:39 | "taint source" : String | Capture.cs:115:17:115:22 | access to local variable sink40 : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:133:15:133:20 | access to local variable sink33 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:145:15:145:20 | access to local variable sink34 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:154:15:154:20 | access to local variable sink35 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:168:25:168:31 | access to parameter tainted : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:194:25:194:31 | access to parameter tainted : String | provenance | | -| Capture.cs:160:13:160:18 | access to local variable sink36 : String | Capture.cs:161:15:161:20 | access to local variable sink36 | provenance | | -| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | Capture.cs:160:13:160:18 | access to local variable sink36 : String | provenance | | -| Capture.cs:168:25:168:31 | access to parameter tainted : String | Capture.cs:169:15:169:20 | access to local variable sink37 | provenance | | -| Capture.cs:188:26:188:26 | s : String | Capture.cs:191:20:191:22 | call to local function M : String | provenance | | -| Capture.cs:194:13:194:18 | access to local variable sink38 : String | Capture.cs:195:15:195:20 | access to local variable sink38 | provenance | | -| Capture.cs:194:22:194:32 | call to local function Id : String | Capture.cs:194:13:194:18 | access to local variable sink38 : String | provenance | | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:188:26:188:26 | s : String | provenance | | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:194:22:194:32 | call to local function Id : String | provenance | | +| Capture.cs:116:17:116:22 | access to local variable sink40 : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | +| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:116:17:116:22 | access to local variable sink40 : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | | +| Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | | +| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | +| Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | | +| Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | | +| Capture.cs:228:13:228:13 | access to local variable x : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:228:13:228:13 | access to local variable x : String | provenance | | +| Capture.cs:232:13:232:13 | access to local variable x : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:232:13:232:13 | access to local variable x : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | | +| Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | | +| Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:353:45:353:45 | x : String | provenance | | +| Capture.cs:278:13:278:13 | access to local variable x : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:278:13:278:13 | access to local variable x : String | provenance | | +| Capture.cs:285:17:285:17 | access to local variable x : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:285:17:285:17 | access to local variable x : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | | +| Capture.cs:311:13:311:13 | access to local variable x : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | +| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:311:13:311:13 | access to local variable x : String | provenance | | +| Capture.cs:318:13:318:13 | access to local variable x : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | +| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:318:13:318:13 | access to local variable x : String | provenance | | +| Capture.cs:337:13:337:13 | access to local variable x : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | +| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:337:13:337:13 | access to local variable x : String | provenance | | +| Capture.cs:353:45:353:45 | x : String | Capture.cs:355:11:355:11 | access to parameter x : String | provenance | | +| Capture.cs:355:11:355:11 | access to parameter x : String | Capture.cs:273:19:273:19 | x : String | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 : String | provenance | | | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | provenance | | @@ -399,24 +425,61 @@ nodes | Capture.cs:89:13:89:18 | access to local variable sink32 : String | semmle.label | access to local variable sink32 : String | | Capture.cs:89:22:89:35 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:93:15:93:20 | access to local variable sink32 | semmle.label | access to local variable sink32 | -| Capture.cs:115:17:115:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | -| Capture.cs:115:26:115:39 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:122:15:122:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | -| Capture.cs:125:25:125:31 | tainted : String | semmle.label | tainted : String | -| Capture.cs:133:15:133:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | -| Capture.cs:160:13:160:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | -| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | -| Capture.cs:161:15:161:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | -| Capture.cs:168:25:168:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:169:15:169:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | -| Capture.cs:188:26:188:26 | s : String | semmle.label | s : String | -| Capture.cs:191:20:191:22 | call to local function M : String | semmle.label | call to local function M : String | -| Capture.cs:194:13:194:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | -| Capture.cs:194:22:194:32 | call to local function Id : String | semmle.label | call to local function Id : String | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:195:15:195:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | +| Capture.cs:116:17:116:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | +| Capture.cs:116:26:116:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | +| Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String | +| Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | +| Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | +| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | +| Capture.cs:163:15:163:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | +| Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | +| Capture.cs:190:26:190:26 | s : String | semmle.label | s : String | +| Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String | +| Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | +| Capture.cs:196:22:196:32 | call to local function Id : String | semmle.label | call to local function Id : String | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | +| Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | +| Capture.cs:202:20:202:20 | s : String | semmle.label | s : String | +| Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:228:13:228:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:228:17:228:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:231:19:231:19 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:232:13:232:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:232:17:232:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field | +| Capture.cs:273:19:273:19 | x : String | semmle.label | x : String | +| Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x | +| Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:278:13:278:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:285:17:285:17 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | +| Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | +| Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field | +| Capture.cs:311:13:311:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:311:17:311:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:312:15:312:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:318:13:318:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:337:13:337:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:337:17:337:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:339:45:339:45 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:353:45:353:45 | x : String | semmle.label | x : String | +| Capture.cs:355:11:355:11 | access to parameter x : String | semmle.label | access to parameter x : String | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | semmle.label | access to field SinkField0 : String | | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | semmle.label | "taint source" : String | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | semmle.label | access to field SinkField0 | @@ -720,7 +783,7 @@ nodes | Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s | | Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s | subpaths -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:188:26:188:26 | s : String | Capture.cs:191:20:191:22 | call to local function M : String | Capture.cs:194:22:194:32 | call to local function Id : String | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | Capture.cs:196:22:196:32 | call to local function Id : String | | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:71:21:71:46 | call to method Return : String | | GlobalDataFlow.cs:73:94:73:98 | access to local variable sink0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke : String | | GlobalDataFlow.cs:76:19:76:23 | access to local variable sink1 : String | GlobalDataFlow.cs:304:32:304:32 | x : String | GlobalDataFlow.cs:306:9:306:9 | access to parameter y : String | GlobalDataFlow.cs:76:30:76:34 | access to local variable sink2 : String | @@ -745,6 +808,8 @@ subpaths | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | [b (line 24): true] access to local variable x | | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x | | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x | +| Capture.cs:251:15:251:21 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:306:15:306:24 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | access to field SinkField0 | | GlobalDataFlow.cs:491:15:491:22 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:491:15:491:22 | access to field field | access to field field | | GlobalDataFlow.cs:492:15:492:22 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:492:15:492:22 | access to field field | access to field field | @@ -785,14 +850,14 @@ subpaths | Capture.cs:72:15:72:20 | access to local variable sink30 | Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:72:15:72:20 | access to local variable sink30 | access to local variable sink30 | | Capture.cs:84:15:84:20 | access to local variable sink31 | Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:84:15:84:20 | access to local variable sink31 | access to local variable sink31 | | Capture.cs:93:15:93:20 | access to local variable sink32 | Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:93:15:93:20 | access to local variable sink32 | access to local variable sink32 | -| Capture.cs:133:15:133:20 | access to local variable sink33 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:133:15:133:20 | access to local variable sink33 | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:145:15:145:20 | access to local variable sink34 | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:154:15:154:20 | access to local variable sink35 | access to local variable sink35 | -| Capture.cs:161:15:161:20 | access to local variable sink36 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:161:15:161:20 | access to local variable sink36 | access to local variable sink36 | -| Capture.cs:169:15:169:20 | access to local variable sink37 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:169:15:169:20 | access to local variable sink37 | access to local variable sink37 | -| Capture.cs:195:15:195:20 | access to local variable sink38 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:195:15:195:20 | access to local variable sink38 | access to local variable sink38 | +| Capture.cs:135:15:135:20 | access to local variable sink33 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | access to local variable sink35 | +| Capture.cs:163:15:163:20 | access to local variable sink36 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:163:15:163:20 | access to local variable sink36 | access to local variable sink36 | +| Capture.cs:171:15:171:20 | access to local variable sink37 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | access to local variable sink37 | +| Capture.cs:197:15:197:20 | access to local variable sink38 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:197:15:197:20 | access to local variable sink38 | access to local variable sink38 | | GlobalDataFlow.cs:140:15:140:19 | access to local variable sink4 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:140:15:140:19 | access to local variable sink4 | access to local variable sink4 | -| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:115:26:115:39 | "taint source" : String | Capture.cs:122:15:122:20 | access to local variable sink40 | access to local variable sink40 | +| Capture.cs:124:15:124:20 | access to local variable sink40 | Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:124:15:124:20 | access to local variable sink40 | access to local variable sink40 | | GlobalDataFlow.cs:243:15:243:20 | access to local variable sink41 | GlobalDataFlow.cs:241:35:241:48 | "taint source" : String | GlobalDataFlow.cs:243:15:243:20 | access to local variable sink41 | access to local variable sink41 | | GlobalDataFlow.cs:245:15:245:20 | access to local variable sink42 | GlobalDataFlow.cs:241:35:241:48 | "taint source" : String | GlobalDataFlow.cs:245:15:245:20 | access to local variable sink42 | access to local variable sink42 | | GlobalDataFlow.cs:461:15:461:20 | access to local variable sink45 | GlobalDataFlow.cs:457:35:457:48 | "taint source" : String | GlobalDataFlow.cs:461:15:461:20 | access to local variable sink45 | access to local variable sink45 | @@ -801,8 +866,16 @@ subpaths | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink7 | GlobalDataFlow.cs:346:13:346:26 | "taint source" : String | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink7 | access to local variable sink7 | | GlobalDataFlow.cs:164:15:164:19 | access to local variable sink8 | GlobalDataFlow.cs:351:13:351:26 | "taint source" : String | GlobalDataFlow.cs:164:15:164:19 | access to local variable sink8 | access to local variable sink8 | | GlobalDataFlow.cs:185:15:185:19 | access to local variable sink9 | GlobalDataFlow.cs:183:35:183:48 | "taint source" : String | GlobalDataFlow.cs:185:15:185:19 | access to local variable sink9 | access to local variable sink9 | +| Capture.cs:231:19:231:19 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:231:19:231:19 | access to local variable x | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | +| Capture.cs:284:23:284:23 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:284:23:284:23 | access to local variable x | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | +| Capture.cs:312:15:312:15 | access to local variable x | Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | access to local variable x | +| Capture.cs:319:19:319:19 | access to local variable x | Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | access to local variable x | +| Capture.cs:339:45:339:45 | access to local variable x | Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:45:339:45 | access to local variable x | access to local variable x | | Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x | | Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x | +| Capture.cs:206:19:206:19 | access to parameter s | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:206:19:206:19 | access to parameter s | access to parameter s | | GlobalDataFlow.cs:469:32:469:32 | access to parameter s | GlobalDataFlow.cs:473:28:473:41 | "taint source" : String | GlobalDataFlow.cs:469:32:469:32 | access to parameter s | access to parameter s | | Capture.cs:57:27:57:32 | access to parameter sink39 | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:57:27:57:32 | access to parameter sink39 | access to parameter sink39 | | GlobalDataFlow.cs:260:15:260:24 | access to parameter sinkParam0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:260:15:260:24 | access to parameter sinkParam0 | access to parameter sinkParam0 | @@ -817,5 +890,6 @@ subpaths | GlobalDataFlow.cs:290:15:290:24 | access to parameter sinkParam7 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:290:15:290:24 | access to parameter sinkParam7 | access to parameter sinkParam7 | | GlobalDataFlow.cs:317:15:317:24 | access to parameter sinkParam8 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:317:15:317:24 | access to parameter sinkParam8 | access to parameter sinkParam8 | | GlobalDataFlow.cs:323:15:323:24 | access to parameter sinkParam9 | GlobalDataFlow.cs:211:46:211:59 | "taint source" : String | GlobalDataFlow.cs:323:15:323:24 | access to parameter sinkParam9 | access to parameter sinkParam9 | +| Capture.cs:273:30:273:30 | access to parameter x | Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:273:30:273:30 | access to parameter x | access to parameter x | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | access to property SinkProperty0 | | Splitting.cs:21:21:21:33 | call to method Return | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:21:21:21:33 | call to method Return | call to method Return | diff --git a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected index 8f6175b67ce9..76416668e22f 100644 --- a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected +++ b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected @@ -1,4 +1,3 @@ -| Capture.cs:5:7:5:13 | call to constructor Object | normal | Capture.cs:5:7:5:13 | call to constructor Object | | Capture.cs:33:9:33:40 | call to method Select | normal | Capture.cs:33:9:33:40 | call to method Select | | Capture.cs:33:9:33:50 | call to method ToArray | normal | Capture.cs:33:9:33:50 | call to method ToArray | | Capture.cs:71:9:71:21 | call to local function CaptureOut1 | captured sink30 | Capture.cs:71:9:71:21 | SSA call def(sink30) | @@ -6,19 +5,26 @@ | Capture.cs:92:9:92:41 | [transitive] call to method Select | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) | | Capture.cs:92:9:92:41 | call to method Select | normal | Capture.cs:92:9:92:41 | call to method Select | | Capture.cs:92:9:92:51 | call to method ToArray | normal | Capture.cs:92:9:92:51 | call to method ToArray | -| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) | -| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) | -| Capture.cs:132:9:132:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:132:9:132:25 | SSA call def(sink33) | -| Capture.cs:144:9:144:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) | -| Capture.cs:153:9:153:45 | [transitive] call to method Select | captured sink35 | Capture.cs:153:9:153:45 | SSA call def(sink35) | -| Capture.cs:153:9:153:45 | call to method Select | normal | Capture.cs:153:9:153:45 | call to method Select | -| Capture.cs:153:9:153:55 | call to method ToArray | normal | Capture.cs:153:9:153:55 | call to method ToArray | -| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 | normal | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 | -| Capture.cs:168:9:168:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:168:9:168:32 | SSA call def(sink37) | -| Capture.cs:191:20:191:22 | call to local function M | normal | Capture.cs:191:20:191:22 | call to local function M | -| Capture.cs:194:22:194:32 | call to local function Id | normal | Capture.cs:194:22:194:32 | call to local function Id | -| Capture.cs:196:20:196:25 | call to local function Id | normal | Capture.cs:196:20:196:25 | call to local function Id | -| GlobalDataFlow.cs:13:14:13:21 | call to constructor Object | normal | GlobalDataFlow.cs:13:14:13:21 | call to constructor Object | +| Capture.cs:123:9:123:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:123:9:123:35 | SSA call def(nonSink0) | +| Capture.cs:123:9:123:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:123:9:123:35 | SSA call def(sink40) | +| Capture.cs:134:9:134:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:134:9:134:25 | SSA call def(sink33) | +| Capture.cs:146:9:146:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:146:9:146:25 | SSA call def(sink34) | +| Capture.cs:155:9:155:45 | [transitive] call to method Select | captured sink35 | Capture.cs:155:9:155:45 | SSA call def(sink35) | +| Capture.cs:155:9:155:45 | call to method Select | normal | Capture.cs:155:9:155:45 | call to method Select | +| Capture.cs:155:9:155:55 | call to method ToArray | normal | Capture.cs:155:9:155:55 | call to method ToArray | +| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 | normal | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 | +| Capture.cs:170:9:170:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:170:9:170:32 | SSA call def(sink37) | +| Capture.cs:193:20:193:22 | call to local function M | normal | Capture.cs:193:20:193:22 | call to local function M | +| Capture.cs:196:22:196:32 | call to local function Id | normal | Capture.cs:196:22:196:32 | call to local function Id | +| Capture.cs:198:20:198:25 | call to local function Id | normal | Capture.cs:198:20:198:25 | call to local function Id | +| Capture.cs:221:18:221:35 | call to method M3 | normal | Capture.cs:221:18:221:35 | call to method M3 | +| Capture.cs:223:28:223:45 | call to method M3 | normal | Capture.cs:223:28:223:45 | call to method M3 | +| Capture.cs:227:24:227:48 | object creation of type List | normal | Capture.cs:227:24:227:48 | object creation of type List | +| Capture.cs:229:9:233:10 | [transitive] call to method ForEach | captured x | Capture.cs:229:9:233:10 | SSA call def(x) | +| Capture.cs:241:17:241:29 | object creation of type Capture | normal | Capture.cs:241:17:241:29 | object creation of type Capture | +| Capture.cs:256:17:256:29 | object creation of type Capture | normal | Capture.cs:256:17:256:29 | object creation of type Capture | +| Capture.cs:290:9:290:16 | [transitive] delegate call | captured x | Capture.cs:290:9:290:16 | SSA call def(x) | +| Capture.cs:323:9:323:11 | delegate call | captured x | Capture.cs:323:9:323:11 | SSA call def(x) | | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | normal | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | @@ -149,20 +155,17 @@ | GlobalDataFlow.cs:249:24:249:34 | access to property Result | normal | GlobalDataFlow.cs:249:24:249:34 | access to property Result | | GlobalDataFlow.cs:300:17:300:38 | call to method ApplyFunc | normal | GlobalDataFlow.cs:300:17:300:38 | call to method ApplyFunc | | GlobalDataFlow.cs:389:16:389:19 | delegate call | normal | GlobalDataFlow.cs:389:16:389:19 | delegate call | -| GlobalDataFlow.cs:415:11:415:14 | call to constructor Object | normal | GlobalDataFlow.cs:415:11:415:14 | call to constructor Object | | GlobalDataFlow.cs:448:22:448:65 | call to method Join | normal | GlobalDataFlow.cs:448:22:448:65 | call to method Join | | GlobalDataFlow.cs:451:23:451:65 | call to method Join | normal | GlobalDataFlow.cs:451:23:451:65 | call to method Join | | GlobalDataFlow.cs:457:20:457:49 | call to method Run | normal | GlobalDataFlow.cs:457:20:457:49 | call to method Run | | GlobalDataFlow.cs:458:25:458:50 | call to method ConfigureAwait | normal | GlobalDataFlow.cs:458:25:458:50 | call to method ConfigureAwait | | GlobalDataFlow.cs:459:23:459:44 | call to method GetAwaiter | normal | GlobalDataFlow.cs:459:23:459:44 | call to method GetAwaiter | | GlobalDataFlow.cs:460:22:460:40 | call to method GetResult | normal | GlobalDataFlow.cs:460:22:460:40 | call to method GetResult | -| GlobalDataFlow.cs:476:18:476:28 | call to constructor Object | normal | GlobalDataFlow.cs:476:18:476:28 | call to constructor Object | | GlobalDataFlow.cs:488:18:488:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:488:18:488:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:489:18:489:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:489:18:489:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:494:18:494:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:494:18:494:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:495:18:495:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:495:18:495:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:496:18:496:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:496:18:496:34 | object creation of type SimpleClass | -| GlobalDataFlow.cs:503:19:503:32 | call to constructor SimpleClass | normal | GlobalDataFlow.cs:503:19:503:32 | call to constructor SimpleClass | | GlobalDataFlow.cs:507:17:507:36 | object creation of type SubSimpleClass | normal | GlobalDataFlow.cs:507:17:507:36 | object creation of type SubSimpleClass | | GlobalDataFlow.cs:514:17:514:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:514:17:514:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:522:17:522:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:522:17:522:33 | object creation of type SimpleClass | @@ -170,7 +173,6 @@ | GlobalDataFlow.cs:524:17:524:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:524:17:524:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:558:44:558:47 | delegate call | normal | GlobalDataFlow.cs:558:44:558:47 | delegate call | -| GlobalDataFlowStringBuilder.cs:13:14:13:34 | call to constructor Object | normal | GlobalDataFlowStringBuilder.cs:13:14:13:34 | call to constructor Object | | GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append | | GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append | | GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder | @@ -184,7 +186,6 @@ | GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear | normal | GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear | | GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString | | GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString | -| Splitting.cs:1:7:1:15 | call to constructor Object | normal | Splitting.cs:1:7:1:15 | call to constructor Object | | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | | Splitting.cs:20:22:20:30 | call to method Return | normal | Splitting.cs:20:22:20:30 | call to method Return | diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected index 9a2ea6bd3da6..a17520910aff 100644 --- a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected +++ b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected @@ -5,13 +5,24 @@ | Capture.cs:72:15:72:20 | access to local variable sink30 | | Capture.cs:84:15:84:20 | access to local variable sink31 | | Capture.cs:93:15:93:20 | access to local variable sink32 | -| Capture.cs:122:15:122:20 | access to local variable sink40 | -| Capture.cs:133:15:133:20 | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | -| Capture.cs:161:15:161:20 | access to local variable sink36 | -| Capture.cs:169:15:169:20 | access to local variable sink37 | -| Capture.cs:195:15:195:20 | access to local variable sink38 | +| Capture.cs:124:15:124:20 | access to local variable sink40 | +| Capture.cs:135:15:135:20 | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | +| Capture.cs:163:15:163:20 | access to local variable sink36 | +| Capture.cs:171:15:171:20 | access to local variable sink37 | +| Capture.cs:197:15:197:20 | access to local variable sink38 | +| Capture.cs:206:19:206:19 | access to parameter s | +| Capture.cs:231:19:231:19 | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | +| Capture.cs:251:15:251:21 | access to field Field | +| Capture.cs:273:30:273:30 | access to parameter x | +| Capture.cs:284:23:284:23 | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | +| Capture.cs:306:15:306:24 | access to field Field | +| Capture.cs:312:15:312:15 | access to local variable x | +| Capture.cs:319:19:319:19 | access to local variable x | +| Capture.cs:339:45:339:45 | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | | GlobalDataFlow.cs:45:50:45:59 | access to parameter sinkParam2 | diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected index 1a8330776ab8..42883e2b5331 100644 --- a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected +++ b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected @@ -14,22 +14,48 @@ edges | Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:79:17:79:22 | access to local variable sink31 : String | provenance | | | Capture.cs:89:13:89:18 | access to local variable sink32 : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | | Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:89:13:89:18 | access to local variable sink32 : String | provenance | | -| Capture.cs:115:17:115:22 | access to local variable sink40 : String | Capture.cs:122:15:122:20 | access to local variable sink40 | provenance | | -| Capture.cs:115:26:115:39 | "taint source" : String | Capture.cs:115:17:115:22 | access to local variable sink40 : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:133:15:133:20 | access to local variable sink33 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:145:15:145:20 | access to local variable sink34 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:154:15:154:20 | access to local variable sink35 | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:168:25:168:31 | access to parameter tainted : String | provenance | | -| Capture.cs:125:25:125:31 | tainted : String | Capture.cs:194:25:194:31 | access to parameter tainted : String | provenance | | -| Capture.cs:160:13:160:18 | access to local variable sink36 : String | Capture.cs:161:15:161:20 | access to local variable sink36 | provenance | | -| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | Capture.cs:160:13:160:18 | access to local variable sink36 : String | provenance | | -| Capture.cs:168:25:168:31 | access to parameter tainted : String | Capture.cs:169:15:169:20 | access to local variable sink37 | provenance | | -| Capture.cs:188:26:188:26 | s : String | Capture.cs:191:20:191:22 | call to local function M : String | provenance | | -| Capture.cs:194:13:194:18 | access to local variable sink38 : String | Capture.cs:195:15:195:20 | access to local variable sink38 | provenance | | -| Capture.cs:194:22:194:32 | call to local function Id : String | Capture.cs:194:13:194:18 | access to local variable sink38 : String | provenance | | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:188:26:188:26 | s : String | provenance | | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:194:22:194:32 | call to local function Id : String | provenance | | +| Capture.cs:116:17:116:22 | access to local variable sink40 : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | +| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:116:17:116:22 | access to local variable sink40 : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | | +| Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | | +| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | +| Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | | +| Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | | +| Capture.cs:228:13:228:13 | access to local variable x : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:228:13:228:13 | access to local variable x : String | provenance | | +| Capture.cs:232:13:232:13 | access to local variable x : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:232:13:232:13 | access to local variable x : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | | +| Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | | +| Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:353:45:353:45 | x : String | provenance | | +| Capture.cs:278:13:278:13 | access to local variable x : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:278:13:278:13 | access to local variable x : String | provenance | | +| Capture.cs:285:17:285:17 | access to local variable x : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:285:17:285:17 | access to local variable x : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | | +| Capture.cs:311:13:311:13 | access to local variable x : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | +| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:311:13:311:13 | access to local variable x : String | provenance | | +| Capture.cs:318:13:318:13 | access to local variable x : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | +| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:318:13:318:13 | access to local variable x : String | provenance | | +| Capture.cs:337:13:337:13 | access to local variable x : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | +| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:337:13:337:13 | access to local variable x : String | provenance | | +| Capture.cs:353:45:353:45 | x : String | Capture.cs:355:11:355:11 | access to parameter x : String | provenance | | +| Capture.cs:355:11:355:11 | access to parameter x : String | Capture.cs:273:19:273:19 | x : String | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 : String | provenance | | | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | provenance | | @@ -449,24 +475,61 @@ nodes | Capture.cs:89:13:89:18 | access to local variable sink32 : String | semmle.label | access to local variable sink32 : String | | Capture.cs:89:22:89:35 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:93:15:93:20 | access to local variable sink32 | semmle.label | access to local variable sink32 | -| Capture.cs:115:17:115:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | -| Capture.cs:115:26:115:39 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:122:15:122:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | -| Capture.cs:125:25:125:31 | tainted : String | semmle.label | tainted : String | -| Capture.cs:133:15:133:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | -| Capture.cs:160:13:160:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | -| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | -| Capture.cs:161:15:161:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | -| Capture.cs:168:25:168:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:169:15:169:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | -| Capture.cs:188:26:188:26 | s : String | semmle.label | s : String | -| Capture.cs:191:20:191:22 | call to local function M : String | semmle.label | call to local function M : String | -| Capture.cs:194:13:194:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | -| Capture.cs:194:22:194:32 | call to local function Id : String | semmle.label | call to local function Id : String | -| Capture.cs:194:25:194:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:195:15:195:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | +| Capture.cs:116:17:116:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | +| Capture.cs:116:26:116:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | +| Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String | +| Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | +| Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | +| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | +| Capture.cs:163:15:163:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | +| Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | +| Capture.cs:190:26:190:26 | s : String | semmle.label | s : String | +| Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String | +| Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | +| Capture.cs:196:22:196:32 | call to local function Id : String | semmle.label | call to local function Id : String | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | +| Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | +| Capture.cs:202:20:202:20 | s : String | semmle.label | s : String | +| Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:228:13:228:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:228:17:228:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:231:19:231:19 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:232:13:232:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:232:17:232:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field | +| Capture.cs:273:19:273:19 | x : String | semmle.label | x : String | +| Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x | +| Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:278:13:278:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:285:17:285:17 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | +| Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | +| Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field | +| Capture.cs:311:13:311:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:311:17:311:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:312:15:312:15 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:318:13:318:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:337:13:337:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:337:17:337:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:339:45:339:45 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:353:45:353:45 | x : String | semmle.label | x : String | +| Capture.cs:355:11:355:11 | access to parameter x : String | semmle.label | access to parameter x : String | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | semmle.label | access to field SinkField0 : String | | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | semmle.label | "taint source" : String | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | semmle.label | access to field SinkField0 | @@ -823,7 +886,7 @@ nodes | Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s | | Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s | subpaths -| Capture.cs:194:25:194:31 | access to parameter tainted : String | Capture.cs:188:26:188:26 | s : String | Capture.cs:191:20:191:22 | call to local function M : String | Capture.cs:194:22:194:32 | call to local function Id : String | +| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | Capture.cs:196:22:196:32 | call to local function Id : String | | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:71:21:71:46 | call to method Return : String | | GlobalDataFlow.cs:73:94:73:98 | access to local variable sink0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke : String | | GlobalDataFlow.cs:76:19:76:23 | access to local variable sink1 : String | GlobalDataFlow.cs:304:32:304:32 | x : String | GlobalDataFlow.cs:306:9:306:9 | access to parameter y : String | GlobalDataFlow.cs:76:30:76:34 | access to local variable sink2 : String | @@ -853,13 +916,24 @@ subpaths | Capture.cs:72:15:72:20 | access to local variable sink30 | Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:72:15:72:20 | access to local variable sink30 | access to local variable sink30 | | Capture.cs:84:15:84:20 | access to local variable sink31 | Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:84:15:84:20 | access to local variable sink31 | access to local variable sink31 | | Capture.cs:93:15:93:20 | access to local variable sink32 | Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:93:15:93:20 | access to local variable sink32 | access to local variable sink32 | -| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:115:26:115:39 | "taint source" : String | Capture.cs:122:15:122:20 | access to local variable sink40 | access to local variable sink40 | -| Capture.cs:133:15:133:20 | access to local variable sink33 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:133:15:133:20 | access to local variable sink33 | access to local variable sink33 | -| Capture.cs:145:15:145:20 | access to local variable sink34 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:145:15:145:20 | access to local variable sink34 | access to local variable sink34 | -| Capture.cs:154:15:154:20 | access to local variable sink35 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:154:15:154:20 | access to local variable sink35 | access to local variable sink35 | -| Capture.cs:161:15:161:20 | access to local variable sink36 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:161:15:161:20 | access to local variable sink36 | access to local variable sink36 | -| Capture.cs:169:15:169:20 | access to local variable sink37 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:169:15:169:20 | access to local variable sink37 | access to local variable sink37 | -| Capture.cs:195:15:195:20 | access to local variable sink38 | Capture.cs:125:25:125:31 | tainted : String | Capture.cs:195:15:195:20 | access to local variable sink38 | access to local variable sink38 | +| Capture.cs:124:15:124:20 | access to local variable sink40 | Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:124:15:124:20 | access to local variable sink40 | access to local variable sink40 | +| Capture.cs:135:15:135:20 | access to local variable sink33 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | access to local variable sink33 | +| Capture.cs:147:15:147:20 | access to local variable sink34 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | access to local variable sink34 | +| Capture.cs:156:15:156:20 | access to local variable sink35 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | access to local variable sink35 | +| Capture.cs:163:15:163:20 | access to local variable sink36 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:163:15:163:20 | access to local variable sink36 | access to local variable sink36 | +| Capture.cs:171:15:171:20 | access to local variable sink37 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | access to local variable sink37 | +| Capture.cs:197:15:197:20 | access to local variable sink38 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:197:15:197:20 | access to local variable sink38 | access to local variable sink38 | +| Capture.cs:206:19:206:19 | access to parameter s | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:206:19:206:19 | access to parameter s | access to parameter s | +| Capture.cs:231:19:231:19 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:231:19:231:19 | access to local variable x | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | +| Capture.cs:251:15:251:21 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:273:30:273:30 | access to parameter x | Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:273:30:273:30 | access to parameter x | access to parameter x | +| Capture.cs:284:23:284:23 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:284:23:284:23 | access to local variable x | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | +| Capture.cs:306:15:306:24 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | +| Capture.cs:312:15:312:15 | access to local variable x | Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | access to local variable x | +| Capture.cs:319:19:319:19 | access to local variable x | Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | access to local variable x | +| Capture.cs:339:45:339:45 | access to local variable x | Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:45:339:45 | access to local variable x | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | access to property SinkProperty0 | | GlobalDataFlow.cs:45:50:45:59 | access to parameter sinkParam2 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:45:50:45:59 | access to parameter sinkParam2 | access to parameter sinkParam2 | From acd52192d15387ddb786fe1711dc8369228ca921 Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Mon, 12 Feb 2024 14:26:02 +0100 Subject: [PATCH 2/3] C#: Adopt shared variable capture library --- .../DataFlowConsistency.ql | 4 - .../VariableCaptureConsistency.ql | 17 + .../csharp/controlflow/internal/PreSsa.qll | 102 +-- .../semmle/code/csharp/dataflow/Nullness.qll | 24 +- .../lib/semmle/code/csharp/dataflow/SSA.qll | 22 +- .../code/csharp/dataflow/internal/BaseSSA.qll | 32 +- .../dataflow/internal/DataFlowDispatch.qll | 111 +-- .../dataflow/internal/DataFlowPrivate.qll | 724 ++++++++++++------ .../dataflow/internal/DataFlowPublic.qll | 11 + .../code/csharp/dataflow/internal/SsaImpl.qll | 440 +---------- csharp/ql/src/Dead Code/DeadStoreOfLocal.ql | 2 + .../csharp7/LocalTaintFlow.expected | 7 - .../dataflow/defuse/defUseEquivalence.ql | 5 +- .../defuse/parameterUseEquivalence.ql | 4 +- .../dataflow/defuse/useUseEquivalence.ql | 5 +- .../library-tests/dataflow/global/Capture.cs | 12 +- .../dataflow/global/DataFlow.expected | 5 + .../dataflow/global/DataFlowPath.expected | 299 ++++++-- .../dataflow/global/GetAnOutNode.expected | 19 +- .../dataflow/global/TaintTracking.expected | 5 + .../global/TaintTrackingPath.expected | 299 ++++++-- .../dataflow/local/DataFlowStep.expected | 16 - .../dataflow/local/TaintTrackingStep.expected | 16 - .../dataflow/ssa/DefAdjacentRead.expected | 20 - .../dataflow/ssa/ReadAdjacentRead.expected | 4 - .../dataflow/ssa/SSAPhi.expected | 1 - .../ssa/SsaCapturedVariableDef.expected | 45 -- .../dataflow/ssa/SsaCapturedVariableDef.ql | 12 - .../dataflow/ssa/SsaDef.expected | 78 -- .../dataflow/ssa/SsaDefElement.expected | 77 -- .../dataflow/ssa/SsaDefLastRead.expected | 39 - .../dataflow/ssa/SsaExplicitDef.expected | 53 -- .../dataflow/ssa/SsaImplicitCall.expected | 17 - .../dataflow/ssa/SsaRead.expected | 43 -- .../dataflow/ssa/SsaUltimateDef.expected | 96 --- csharp/ql/test/query-tests/Nullness/E.cs | 4 +- .../query-tests/Nullness/NullMaybe.expected | 8 + 37 files changed, 1190 insertions(+), 1488 deletions(-) create mode 100644 csharp/ql/consistency-queries/VariableCaptureConsistency.ql delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql diff --git a/csharp/ql/consistency-queries/DataFlowConsistency.ql b/csharp/ql/consistency-queries/DataFlowConsistency.ql index 0e442236ac53..59e5953f31f9 100644 --- a/csharp/ql/consistency-queries/DataFlowConsistency.ql +++ b/csharp/ql/consistency-queries/DataFlowConsistency.ql @@ -47,8 +47,6 @@ private module Input implements InputSig { or not exists(LocalFlow::getAPostUpdateNodeForArg(n.getControlFlowNode())) or - n instanceof ImplicitCapturedArgumentNode - or n instanceof ParamsArgumentNode or n.asExpr() instanceof CIL::Expr @@ -104,8 +102,6 @@ private module Input implements InputSig { not split = cfn.getASplit() ) or - call instanceof TransitiveCapturedDataFlowCall - or call.(NonDelegateDataFlowCall).getDispatchCall().isReflection() ) } diff --git a/csharp/ql/consistency-queries/VariableCaptureConsistency.ql b/csharp/ql/consistency-queries/VariableCaptureConsistency.ql new file mode 100644 index 000000000000..927741f07bfe --- /dev/null +++ b/csharp/ql/consistency-queries/VariableCaptureConsistency.ql @@ -0,0 +1,17 @@ +import csharp +import semmle.code.csharp.dataflow.internal.DataFlowPrivate::VariableCapture::Flow::ConsistencyChecks +private import semmle.code.csharp.dataflow.internal.DataFlowPrivate::VariableCapture::Flow::ConsistencyChecks as ConsistencyChecks +private import semmle.code.csharp.controlflow.BasicBlocks +private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl + +query predicate uniqueEnclosingCallable(BasicBlock bb, string msg) { + ConsistencyChecks::uniqueEnclosingCallable(bb, msg) and + getNodeCfgScope(bb.getFirstNode()) instanceof Callable +} + +query predicate consistencyOverview(string msg, int n) { none() } + +query predicate uniqueCallableLocation(Callable c, string msg) { + ConsistencyChecks::uniqueCallableLocation(c, msg) and + count(c.getBody()) = 1 +} diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll index 42d9c21102a4..c7c1de2308b6 100644 --- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll +++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll @@ -31,9 +31,52 @@ module PreSsa { } predicate implicitEntryDef(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v) { - not v instanceof LocalScopeVariable and c = v.getACallable() and - scopeFirst(c, bb) + scopeFirst(c, bb) and + ( + not v instanceof LocalScopeVariable + or + v.(SimpleLocalScopeVariable).isReadonlyCapturedBy(c) + ) + } + + /** Holds if `a` is assigned in callable `c`. */ + pragma[nomagic] + private predicate assignableDefinition(Assignable a, Callable c) { + exists(AssignableDefinition def | + def.getTarget() = a and + c = def.getEnclosingCallable() + | + not c instanceof Constructor or + a instanceof LocalScopeVariable + ) + } + + pragma[nomagic] + private predicate assignableUniqueWriter(Assignable a, Callable c) { + c = unique(Callable c0 | assignableDefinition(a, c0) | c0) + } + + /** Holds if `a` is accessed in callable `c`. */ + pragma[nomagic] + private predicate assignableAccess(Assignable a, Callable c) { + exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable()) + } + + /** + * A local scope variable that is amenable to SSA analysis. + * + * This is either a local variable that is not captured, or one + * where all writes happen in the defining callable. + */ + class SimpleLocalScopeVariable extends LocalScopeVariable { + SimpleLocalScopeVariable() { assignableUniqueWriter(this, this.getCallable()) } + + /** Holds if this local scope variable is read-only captured by `c`. */ + predicate isReadonlyCapturedBy(Callable c) { + assignableAccess(this, c) and + c != this.getCallable() + } } module SsaInput implements SsaImplCommon::InputSig { @@ -47,40 +90,6 @@ module PreSsa { ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) } } - /** Holds if `a` is assigned in non-constructor callable `c`. */ - pragma[nomagic] - private predicate assignableDefinition(Assignable a, Callable c) { - exists(AssignableDefinition def | def.getTarget() = a | - c = def.getEnclosingCallable() and - not c instanceof Constructor - ) - } - - /** Holds if `a` is accessed in callable `c`. */ - pragma[nomagic] - private predicate assignableAccess(Assignable a, Callable c) { - exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable()) - } - - pragma[nomagic] - private predicate assignableNoCapturing(Assignable a, Callable c) { - assignableAccess(a, c) and - /* - * The code below is equivalent to - * ```ql - * not exists(Callable other | assignableDefinition(a, other) | other != c) - * ``` - * but it avoids a Cartesian product in the compiler generated antijoin - * predicate. - */ - - ( - not assignableDefinition(a, _) - or - c = unique(Callable c0 | assignableDefinition(a, c0) | c0) - ) - } - pragma[noinline] private predicate assignableNoComplexQualifiers(Assignable a) { forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance()) @@ -94,15 +103,22 @@ module PreSsa { private Callable c; SourceVariable() { + assignableAccess(this, c) and ( - this instanceof LocalScopeVariable + this instanceof SimpleLocalScopeVariable or - this = any(Field f | not f.isVolatile()) - or - this = any(TrivialProperty tp | not tp.isOverridableOrImplementable()) - ) and - assignableNoCapturing(this, c) and - assignableNoComplexQualifiers(this) + ( + this = any(Field f | not f.isVolatile()) + or + this = any(TrivialProperty tp | not tp.isOverridableOrImplementable()) + ) and + ( + not assignableDefinition(this, _) + or + assignableUniqueWriter(this, c) + ) and + assignableNoComplexQualifiers(this) + ) } /** Gets a callable in which this simple assignable can be analyzed. */ diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll index a281c21b657f..53ee9181ec59 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll @@ -218,19 +218,6 @@ private predicate isNullDefaultArgument(Ssa::ExplicitDefinition def, AlwaysNullE ) } -/** - * Holds if `edef` is an implicit entry definition for a captured variable that - * may be guarded, because a call to the capturing callable is guarded. - */ -private predicate isMaybeGuardedCapturedDef(Ssa::ImplicitEntryDefinition edef) { - exists(Ssa::ExplicitDefinition def, ControlFlow::Nodes::ElementNode c, G::Guard g, NullValue nv | - def.isCapturedVariableDefinitionFlowIn(edef, c, _) and - g = def.getARead() and - g.controlsNode(c, nv) and - nv.isNonNull() - ) -} - /** Holds if `def` is an SSA definition that may be `null`. */ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason) { not nonNullDef(def) and @@ -268,7 +255,6 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason) exists(Dereference d | dereferenceAt(_, _, def, d) | d.hasNullableType() and not def instanceof Ssa::PhiNode and - not isMaybeGuardedCapturedDef(def) and reason = def.getSourceVariable().getAssignable() and msg = "because it has a nullable type" ) @@ -583,14 +569,8 @@ class Dereference extends G::DereferenceableExpr { */ predicate isAlwaysNull(Ssa::SourceVariable v) { this = v.getAnAccess() and - // Exclude fields, properties, and captured variables, as they may not have an - // accurate SSA representation - v.getAssignable() = - any(LocalScopeVariable lsv | - strictcount(Callable c | - c = any(AssignableDefinition ad | ad.getTarget() = lsv).getEnclosingCallable() - ) = 1 - ) and + // Exclude fields and properties, as they may not have an accurate SSA representation + v.getAssignable() instanceof LocalScopeVariable and ( forex(Ssa::Definition def0 | this = def0.getARead() | this.isAlwaysNull0(def0)) or diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll index f77e5f7fd982..673bd1a5638f 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll @@ -447,6 +447,8 @@ module Ssa { final AssignableDefinition getADefinition() { result = SsaImpl::getADefinition(this) } /** + * DEPRECATED. + * * Holds if this definition updates a captured local scope variable, and the updated * value may be read from the implicit entry definition `def` using one or more calls * (as indicated by `additionalCalls`), starting from call `c`. @@ -467,13 +469,15 @@ module Ssa { * If this definition is the update of `i` on line 5, then the value may be read inside * `M2` via the call on line 6. */ - final predicate isCapturedVariableDefinitionFlowIn( + deprecated final predicate isCapturedVariableDefinitionFlowIn( ImplicitEntryDefinition def, ControlFlow::Nodes::ElementNode c, boolean additionalCalls ) { - SsaImpl::isCapturedVariableDefinitionFlowIn(this, def, c, additionalCalls) + none() } /** + * DEPRECATED. + * * Holds if this definition updates a captured local scope variable, and the updated * value may be read from the implicit call definition `cdef` using one or more calls * (as indicated by `additionalCalls`). @@ -494,10 +498,10 @@ module Ssa { * If this definition is the update of `i` on line 4, then the value may be read outside * of `M2` via the call on line 5. */ - final predicate isCapturedVariableDefinitionFlowOut( + deprecated final predicate isCapturedVariableDefinitionFlowOut( ImplicitCallDefinition cdef, boolean additionalCalls ) { - SsaImpl::isCapturedVariableDefinitionFlowOut(this, cdef, additionalCalls) + none() } override Element getElement() { result = ad.getElement() } @@ -526,8 +530,6 @@ module Ssa { or SsaImpl::updatesNamedFieldOrProp(bb, i, _, v, _) or - SsaImpl::updatesCapturedVariable(bb, i, _, v, _, _) - or SsaImpl::variableWriteQualifier(bb, i, v, _) ) } @@ -572,10 +574,9 @@ module Ssa { private Call c; ImplicitCallDefinition() { - exists(ControlFlow::BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) | + exists(ControlFlow::BasicBlock bb, SourceVariable v, int i | + this.definesAt(v, bb, i) and SsaImpl::updatesNamedFieldOrProp(bb, i, c, v, _) - or - SsaImpl::updatesCapturedVariable(bb, i, c, v, _, _) ) } @@ -593,9 +594,6 @@ module Ssa { result.getEnclosingCallable() = setter and result.getTarget() = this.getSourceVariable().getAssignable() ) - or - SsaImpl::updatesCapturedVariable(_, _, this.getCall(), _, result, _) and - result.getTarget() = this.getSourceVariable().getAssignable() } override string toString() { diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll index 0933559347ef..f30b1769107e 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll @@ -24,7 +24,16 @@ module BaseSsa { ) } + private predicate implicitEntryDef( + Callable c, ControlFlow::BasicBlocks::EntryBlock bb, SsaInput::SourceVariable v + ) { + v.isReadonlyCapturedBy(c) and + c = bb.getCallable() + } + private module SsaInput implements SsaImplCommon::InputSig { + private import semmle.code.csharp.controlflow.internal.PreSsa + class BasicBlock = ControlFlow::BasicBlock; BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { @@ -35,20 +44,17 @@ module BaseSsa { class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock; - pragma[noinline] - private Callable getAnAssigningCallable(LocalScopeVariable v) { - result = any(AssignableDefinition def | def.getTarget() = v).getEnclosingCallable() - } - - class SourceVariable extends LocalScopeVariable { - SourceVariable() { not getAnAssigningCallable(this) != getAnAssigningCallable(this) } - } + class SourceVariable = PreSsa::SimpleLocalScopeVariable; predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) { exists(AssignableDefinition def | definitionAt(def, bb, i, v) and if def.isCertain() then certain = true else certain = false ) + or + implicitEntryDef(_, bb, v) and + i = -1 and + certain = true } predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) { @@ -87,7 +93,15 @@ module BaseSsa { not result instanceof PhiNode } - Location getLocation() { result = this.getDefinition().getLocation() } + Location getLocation() { + result = this.getDefinition().getLocation() + or + exists(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v | + this.definesAt(v, bb, -1) and + implicitEntryDef(c, bb, v) and + result = c.getLocation() + ) + } } class PhiNode extends SsaImpl::PhiNode, Definition { diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll index d69327cdfb90..c4b3b3261d41 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll @@ -40,35 +40,10 @@ DotNet::Callable getCallableForDataFlow(DotNet::Callable c) { ) } -/** - * Holds if `cfn` corresponds to a call that can reach callable `c` using - * additional calls, and `c` is a callable that either reads or writes to - * a captured variable. - */ -private predicate transitiveCapturedCallTarget(ControlFlow::Nodes::ElementNode cfn, Callable c) { - exists(Ssa::ExplicitDefinition def | - exists(Ssa::ImplicitEntryDefinition edef | - def.isCapturedVariableDefinitionFlowIn(edef, cfn, true) - | - c = edef.getCallable() - ) - or - exists(Ssa::ImplicitCallDefinition cdef | def.isCapturedVariableDefinitionFlowOut(cdef, true) | - cfn = cdef.getControlFlowNode() and - c = def.getEnclosingCallable() - ) - ) -} - newtype TReturnKind = TNormalReturnKind() or TOutReturnKind(int i) { i = any(Parameter p | p.isOut()).getPosition() } or - TRefReturnKind(int i) { i = any(Parameter p | p.isRef()).getPosition() } or - TImplicitCapturedReturnKind(LocalScopeVariable v) { - exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowOut(_, _) | - v = def.getSourceVariable().getAssignable() - ) - } + TRefReturnKind(int i) { i = any(Parameter p | p.isRef()).getPosition() } /** * A summarized callable where the summary should be used for dataflow analysis. @@ -94,7 +69,8 @@ private module Cached { newtype TDataFlowCallable = TDotNetCallable(DotNet::Callable c) { c.isUnboundDeclaration() } or TSummarizedCallable(DataFlowSummarizedCallable sc) or - TFieldOrProperty(FieldOrProperty f) + TFieldOrPropertyCallable(FieldOrProperty f) or + TCapturedVariableCallable(LocalScopeVariable v) { v.isCaptured() } cached newtype TDataFlowCall = @@ -105,9 +81,6 @@ private module Cached { TExplicitDelegateLikeCall(ControlFlow::Nodes::ElementNode cfn, DelegateLikeCall dc) { cfn.getAstNode() = dc } or - TTransitiveCapturedCall(ControlFlow::Nodes::ElementNode cfn) { - transitiveCapturedCallTarget(cfn, _) - } or TCilCall(CIL::Call call) { // No need to include calls that are compiled from source not call.getImplementation().getMethod().compiledFromSource() @@ -120,24 +93,16 @@ private module Cached { cached DataFlowCallable viableCallable(DataFlowCall call) { result = call.getARuntimeTarget() } - private predicate capturedWithFlowIn(LocalScopeVariable v) { - exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowIn(_, _, _) | - v = def.getSourceVariable().getAssignable() - ) - } - cached newtype TParameterPosition = TPositionalParameterPosition(int i) { i = any(Parameter p).getPosition() } or TThisParameterPosition() or - TImplicitCapturedParameterPosition(LocalScopeVariable v) { capturedWithFlowIn(v) } or TDelegateSelfParameterPosition() cached newtype TArgumentPosition = TPositionalArgumentPosition(int i) { i = any(Parameter p).getPosition() } or TQualifierArgumentPosition() or - TImplicitCapturedArgumentPosition(LocalScopeVariable v) { capturedWithFlowIn(v) } or TDelegateSelfArgumentPosition() } @@ -229,18 +194,6 @@ class RefReturnKind extends OutRefReturnKind, TRefReturnKind { override string toString() { result = "ref parameter " + pos } } -/** A value implicitly returned from a callable using a captured variable. */ -class ImplicitCapturedReturnKind extends ReturnKind, TImplicitCapturedReturnKind { - private LocalScopeVariable v; - - ImplicitCapturedReturnKind() { this = TImplicitCapturedReturnKind(v) } - - /** Gets the captured variable. */ - LocalScopeVariable getVariable() { result = v } - - override string toString() { result = "captured " + v } -} - /** A callable used for data flow. */ class DataFlowCallable extends TDataFlowCallable { /** Gets the underlying source code callable, if any. */ @@ -250,7 +203,9 @@ class DataFlowCallable extends TDataFlowCallable { FlowSummary::SummarizedCallable asSummarizedCallable() { this = TSummarizedCallable(result) } /** Gets the underlying field or property, if any. */ - FieldOrProperty asFieldOrProperty() { this = TFieldOrProperty(result) } + FieldOrProperty asFieldOrProperty() { this = TFieldOrPropertyCallable(result) } + + LocalScopeVariable asCapturedVariable() { this = TCapturedVariableCallable(result) } /** Gets the underlying callable. */ DotNet::Callable getUnderlyingCallable() { @@ -262,6 +217,8 @@ class DataFlowCallable extends TDataFlowCallable { result = this.getUnderlyingCallable().toString() or result = this.asFieldOrProperty().toString() + or + result = this.asCapturedVariable().toString() } /** Get the location of this dataflow callable. */ @@ -269,6 +226,8 @@ class DataFlowCallable extends TDataFlowCallable { result = this.getUnderlyingCallable().getLocation() or result = this.asFieldOrProperty().getLocation() + or + result = this.asCapturedVariable().getLocation() } } @@ -389,33 +348,6 @@ class ExplicitDelegateLikeDataFlowCall extends DelegateDataFlowCall, TExplicitDe override Location getLocation() { result = cfn.getLocation() } } -/** - * A call that can reach a callable, using one or more additional calls, which - * reads or updates a captured variable. We model such a chain of calls as just - * a single call for performance reasons. - */ -class TransitiveCapturedDataFlowCall extends DataFlowCall, TTransitiveCapturedCall { - private ControlFlow::Nodes::ElementNode cfn; - - TransitiveCapturedDataFlowCall() { this = TTransitiveCapturedCall(cfn) } - - override DataFlowCallable getARuntimeTarget() { - transitiveCapturedCallTarget(cfn, result.asCallable()) - } - - override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn } - - override DataFlow::ExprNode getNode() { none() } - - override DataFlowCallable getEnclosingCallable() { - result.asCallable() = cfn.getEnclosingCallable() - } - - override string toString() { result = "[transitive] " + cfn.toString() } - - override Location getLocation() { result = cfn.getLocation() } -} - /** A CIL call relevant for data flow. */ class CilDataFlowCall extends DataFlowCall, TCilCall { private CIL::Call call; @@ -482,11 +414,6 @@ class ParameterPosition extends TParameterPosition { /** Holds if this position represents a `this` parameter. */ predicate isThisParameter() { this = TThisParameterPosition() } - /** Holds if this position is used to model flow through captured variables. */ - predicate isImplicitCapturedParameterPosition(LocalScopeVariable v) { - this = TImplicitCapturedParameterPosition(v) - } - /** * Holds if this position represents a reference to a delegate itself. * @@ -501,10 +428,6 @@ class ParameterPosition extends TParameterPosition { or this.isThisParameter() and result = "this" or - exists(LocalScopeVariable v | - this.isImplicitCapturedParameterPosition(v) and result = "captured " + v - ) - or this.isDelegateSelf() and result = "delegate self" } @@ -518,11 +441,6 @@ class ArgumentPosition extends TArgumentPosition { /** Holds if this position represents a qualifier. */ predicate isQualifier() { this = TQualifierArgumentPosition() } - /** Holds if this position is used to model flow through captured variables. */ - predicate isImplicitCapturedArgumentPosition(LocalScopeVariable v) { - this = TImplicitCapturedArgumentPosition(v) - } - /** * Holds if this position represents a reference to a delegate itself. * @@ -537,10 +455,6 @@ class ArgumentPosition extends TArgumentPosition { or this.isQualifier() and result = "qualifier" or - exists(LocalScopeVariable v | - this.isImplicitCapturedArgumentPosition(v) and result = "captured " + v - ) - or this.isDelegateSelf() and result = "delegate self" } @@ -552,10 +466,5 @@ predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { or ppos.isThisParameter() and apos.isQualifier() or - exists(LocalScopeVariable v | - ppos.isImplicitCapturedParameterPosition(v) and - apos.isImplicitCapturedArgumentPosition(v) - ) - or ppos.isDelegateSelf() and apos.isDelegateSelf() } diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll index 09041d0c3d66..64274defca3c 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll @@ -129,29 +129,74 @@ private class ExprNodeImpl extends ExprNode, NodeImpl { } } +/** + * A node that represents the creation of a local function. + * + * Needed for flow through captured variables, where we treat local functions + * as if they were lambdas. + */ +abstract private class LocalFunctionCreationNode extends NodeImpl, TLocalFunctionCreationNode { + ControlFlow::Nodes::ElementNode cfn; + LocalFunction function; + boolean isPostUpdate; + + LocalFunctionCreationNode() { + this = TLocalFunctionCreationNode(cfn, isPostUpdate) and + function = cfn.getAstNode().(LocalFunctionStmt).getLocalFunction() + } + + LocalFunction getFunction() { result = function } + + ExprNode getAnAccess(boolean inSameCallable) { + result.getExpr().(LocalFunctionAccess).getTarget() = this.getFunction() and + if result.getEnclosingCallable() = this.getEnclosingCallable() + then inSameCallable = true + else inSameCallable = false + } + + override DataFlowCallable getEnclosingCallableImpl() { + result.asCallable() = cfn.getEnclosingCallable() + } + + override Type getTypeImpl() { none() } + + override DataFlowType getDataFlowType() { result.asDelegate() = function } + + override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() } + + ControlFlow::Nodes::ElementNode getUnderlyingControlFlowNode() { result = cfn } + + override Location getLocationImpl() { result = cfn.getLocation() } +} + +private class LocalFunctionCreationPreNode extends LocalFunctionCreationNode { + LocalFunctionCreationPreNode() { isPostUpdate = false } + + override string toStringImpl() { result = cfn.toString() } +} + /** Calculation of the relative order in which `this` references are read. */ private module ThisFlow { private class BasicBlock = ControlFlow::BasicBlock; + /** Holds if `e` is a `this` access. */ + predicate thisAccessExpr(Expr e) { e instanceof ThisAccess or e instanceof BaseAccess } + /** Holds if `n` is a `this` access at control flow node `cfn`. */ private predicate thisAccess(Node n, ControlFlow::Node cfn) { n.(InstanceParameterNode).getCallable() = cfn.(ControlFlow::Nodes::EntryNode).getCallable() or - n.asExprAtNode(cfn) = any(Expr e | e instanceof ThisAccess or e instanceof BaseAccess) + thisAccessExpr(n.asExprAtNode(cfn)) or - n = - any(InstanceParameterAccessNode pan | - pan.getUnderlyingControlFlowNode() = cfn and pan.isPreUpdate() - ) + cfn = n.(InstanceParameterAccessPreNode).getUnderlyingControlFlowNode() } private predicate thisAccess(Node n, BasicBlock bb, int i) { thisAccess(n, bb.getNode(i)) or - exists(Parameter p | n.(PrimaryConstructorThisAccessNode).getParameter() = p | + exists(Parameter p | n.(PrimaryConstructorThisAccessPreNode).getParameter() = p | bb.getCallable() = p.getCallable() and - i = p.getPosition() + 1 and - not n instanceof PostUpdateNode + i = p.getPosition() + 1 ) } @@ -221,6 +266,234 @@ CIL::DataFlowNode asCilDataFlowNode(Node node) { result = node.asExpr() } +/** Provides logic related to captured variables. */ +module VariableCapture { + private import codeql.dataflow.VariableCapture as Shared + + private predicate closureFlowStep(ControlFlow::Nodes::ExprNode e1, ControlFlow::Nodes::ExprNode e2) { + e1 = LocalFlow::getALastEvalNode(e2) + or + exists(Ssa::Definition def | + LocalFlow::ssaDefAssigns(def.getAnUltimateDefinition(), e1) and + exists(def.getAReadAtNode(e2)) + ) + } + + private module CaptureInput implements Shared::InputSig { + private import csharp as Cs + private import semmle.code.csharp.controlflow.ControlFlowGraph + private import semmle.code.csharp.controlflow.BasicBlocks as BasicBlocks + private import TaintTrackingPrivate as TaintTrackingPrivate + + class BasicBlock extends BasicBlocks::BasicBlock { + Callable getEnclosingCallable() { result = super.getCallable() } + } + + BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { + result = bb.getImmediateDominator() + } + + BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() } + + private predicate thisAccess(ControlFlow::Node cfn, InstanceCallable c) { + ThisFlow::thisAccessExpr(cfn.getAstNode()) and + cfn.getEnclosingCallable().getEnclosingCallable*() = c + } + + private predicate capturedThisAccess(ControlFlow::Node cfn, InstanceCallable c) { + thisAccess(cfn, c) and + cfn.getEnclosingCallable() != c + } + + private newtype TCapturedVariable = + TCapturedLocalScopeVariable(LocalScopeVariable v) { + v.isCaptured() and not v.(Parameter).getCallable() instanceof PrimaryConstructor + } or + TCapturedThis(Callable c) { capturedThisAccess(_, c) } + + /** A captured local scope variable. Includes captured `this` variables. */ + class CapturedVariable extends TCapturedVariable { + LocalScopeVariable asLocalScopeVariable() { this = TCapturedLocalScopeVariable(result) } + + Callable asThis() { this = TCapturedThis(result) } + + Callable getCallable() { + result = this.asLocalScopeVariable().getCallable() + or + result = this.asThis() + } + + Type getType() { + result = this.asLocalScopeVariable().getType() + or + result = this.asThis().getDeclaringType() + } + + string toString() { + result = this.asLocalScopeVariable().toString() + or + result = "this in " + this.asThis() + } + + Location getLocation() { + result = this.asLocalScopeVariable().getLocation() + or + result = this.asThis().getLocation() + } + } + + abstract class CapturedParameter extends CapturedVariable { + abstract ParameterNodeImpl getParameterNode(); + } + + private class CapturedExplicitParameter extends CapturedParameter, TCapturedLocalScopeVariable { + private Parameter p; + + CapturedExplicitParameter() { p = this.asLocalScopeVariable() } + + override ExplicitParameterNode getParameterNode() { result.asParameter() = p } + } + + private class CapturedThisParameter extends CapturedParameter, TCapturedThis { + override InstanceParameterNode getParameterNode() { + result = TInstanceParameterNode(this.asThis()) + } + } + + class Expr extends ControlFlow::Node { + predicate hasCfgNode(BasicBlock bb, int i) { this = bb.getNode(i) } + } + + class VariableWrite extends Expr { + CapturedVariable v; + AssignableDefinition def; + + VariableWrite() { + def.getTarget() = v.asLocalScopeVariable() and + this = def.getAControlFlowNode() and + // the shared variable capture library inserts implicit parameter definitions + not def instanceof AssignableDefinitions::ImplicitParameterDefinition + } + + ControlFlow::Node getRhs() { LocalFlow::defAssigns(def, this, result) } + + CapturedVariable getVariable() { result = v } + } + + class VariableRead extends Expr { + CapturedVariable v; + + VariableRead() { + this.getAstNode().(AssignableRead).getTarget() = v.asLocalScopeVariable() + or + thisAccess(this, v.asThis()) + } + + CapturedVariable getVariable() { result = v } + } + + class ClosureExpr extends Expr { + Callable c; + + ClosureExpr() { lambdaCreationExpr(this.getAstNode(), c) } + + predicate hasBody(Callable body) { body = c } + + predicate hasAliasedAccess(Expr f) { closureFlowStep+(this, f) and not closureFlowStep(f, _) } + } + + class Callable extends Cs::Callable { + predicate isConstructor() { this instanceof Constructor } + } + } + + class CapturedVariable = CaptureInput::CapturedVariable; + + class ClosureExpr = CaptureInput::ClosureExpr; + + module Flow = Shared::Flow; + + private Flow::ClosureNode asClosureNode(Node n) { + result = n.(CaptureNode).getSynthesizedCaptureNode() + or + result.(Flow::ExprNode).getExpr() = + [ + n.(ExprNode).getControlFlowNode(), + n.(LocalFunctionCreationPreNode).getUnderlyingControlFlowNode() + ] + or + result.(Flow::VariableWriteSourceNode).getVariableWrite().getRhs() = + n.(ExprNode).getControlFlowNode() + or + result.(Flow::ExprPostUpdateNode).getExpr() = + [ + n.(PostUpdateNode).getPreUpdateNode().(ExprNode).getControlFlowNode(), + n.(LocalFunctionCreationPostUpdateNode).getUnderlyingControlFlowNode() + ] + or + result.(Flow::ParameterNode).getParameter().getParameterNode() = n + or + result.(Flow::ThisParameterNode).getCallable() = n.(DelegateSelfReferenceNode).getCallable() + } + + CapturedVariable getCapturedVariableContent(CapturedVariableContent c) { + c = TCapturedVariableContent(result) + } + + predicate storeStep(Node node1, CapturedVariableContent c, Node node2) { + Flow::storeStep(asClosureNode(node1), getCapturedVariableContent(c), asClosureNode(node2)) + } + + predicate readStep(Node node1, CapturedVariableContent c, Node node2) { + Flow::readStep(asClosureNode(node1), getCapturedVariableContent(c), asClosureNode(node2)) + } + + predicate valueStep(Node node1, Node node2) { + Flow::localFlowStep(asClosureNode(node1), asClosureNode(node2)) + } + + predicate clearsContent(Node node, CapturedVariableContent c) { + Flow::clearsContent(asClosureNode(node), getCapturedVariableContent(c)) + } + + class CapturedSsaDefinitionExt extends SsaImpl::DefinitionExt { + CapturedSsaDefinitionExt() { + this.getSourceVariable().getAssignable() = any(CapturedVariable v).asLocalScopeVariable() + } + } + + private predicate flowInsensitiveWriteStep( + ExprNode node1, FlowInsensitiveCapturedVariableNode node2, LocalScopeVariable v + ) { + exists(AssignableDefinition def | + def.getSource() = node1.getExpr() and + def.getTarget() = v and + node2.getVariable() = v + ) + } + + private predicate flowInsensitiveReadStep( + FlowInsensitiveCapturedVariableNode node1, ExprNode node2, LocalScopeVariable v + ) { + node1.getVariable() = v and + node2.getExpr().(VariableRead).getTarget() = v + } + + /** + * Holds if there is control-flow insensitive data-flow from `node1` to `node2` + * involving a captured variable. Only used in lambda flow. + */ + predicate flowInsensitiveStep(Node node1, Node node2) { + exists(LocalScopeVariable v | + flowInsensitiveWriteStep(node1, node2, v) and + flowInsensitiveReadStep(_, _, v) + or + flowInsensitiveReadStep(node1, node2, v) and + flowInsensitiveWriteStep(_, _, v) + ) + } +} + /** Provides predicates related to local data flow. */ module LocalFlow { class LocalExprStepConfiguration extends ControlFlowReachabilityConfiguration { @@ -342,6 +615,18 @@ module LocalFlow { } } + predicate defAssigns(AssignableDefinition def, ControlFlow::Node cfnDef, ControlFlow::Node value) { + any(LocalExprStepConfiguration x).hasDefPath(_, value, def, cfnDef) + } + + predicate ssaDefAssigns(Ssa::ExplicitDefinition ssaDef, ControlFlow::Nodes::ExprNode value) { + exists(AssignableDefinition def, ControlFlow::Node cfnDef | + any(LocalExprStepConfiguration conf).hasDefPath(_, value, def, cfnDef) and + ssaDef.getADefinition() = def and + ssaDef.getControlFlowNode() = cfnDef + ) + } + /** * An uncertain SSA definition. Either an uncertain explicit definition or an * uncertain qualifier definition. @@ -442,15 +727,6 @@ module LocalFlow { ) } - predicate localFlowCapturedVarStep(Node nodeFrom, ImplicitCapturedArgumentNode nodeTo) { - // Flow from SSA definition to implicit captured variable argument - exists(Ssa::ExplicitDefinition def, ControlFlow::Nodes::ElementNode call | - def = getSsaDefinitionExt(nodeFrom) and - def.isCapturedVariableDefinitionFlowIn(_, call, _) and - nodeTo = TImplicitCapturedArgumentNode(call, def.getSourceVariable().getAssignable()) - ) - } - private module CilFlow { /** * Holds if `nodeFrom` is a last node referencing SSA definition `def`, which @@ -525,11 +801,6 @@ module LocalFlow { } predicate localFlowStepCommon(Node nodeFrom, Node nodeTo) { - exists(SsaImpl::DefinitionExt def | - localSsaFlowStep(def, nodeFrom, nodeTo) and - not usesInstanceField(def) - ) - or hasNodePath(any(LocalExprStepConfiguration x), nodeFrom, nodeTo) or ThisFlow::adjacentThisRefs(nodeFrom, nodeTo) and @@ -554,14 +825,14 @@ module LocalFlow { */ predicate excludeFromExposedRelations(Node n) { n instanceof FlowSummaryNode or - n instanceof ImplicitCapturedArgumentNode + n instanceof CaptureNode } /** * Gets a node that may execute last in `n`, and which, when it executes last, * will be the value of `n`. */ - private ControlFlow::Nodes::ExprNode getALastEvalNode(ControlFlow::Nodes::ExprNode cfn) { + ControlFlow::Nodes::ExprNode getALastEvalNode(ControlFlow::Nodes::ExprNode cfn) { exists(Expr e | any(LocalExprStepConfiguration x).hasExprPath(_, result, e, cfn) | e instanceof ConditionalExpr or e instanceof Cast or @@ -632,26 +903,32 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) { LocalFlow::localFlowStepCommon(nodeFrom, nodeTo) or exists(SsaImpl::DefinitionExt def | + not LocalFlow::usesInstanceField(def) and + not def instanceof VariableCapture::CapturedSsaDefinitionExt + | + LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo) + or LocalFlow::localSsaFlowStepUseUse(def, nodeFrom, nodeTo) and not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _) and - not LocalFlow::usesInstanceField(def) and nodeFrom != nodeTo - ) - or - // Flow into phi (read)/uncertain SSA definition node from read - exists(Node read | LocalFlow::localFlowSsaInputFromRead(read, _, nodeTo) | - nodeFrom = read and - not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _) or - nodeFrom.(PostUpdateNode).getPreUpdateNode() = read + // Flow into phi (read)/uncertain SSA definition node from read + exists(Node read | LocalFlow::localFlowSsaInputFromRead(read, def, nodeTo) | + nodeFrom = read and + not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _) + or + nodeFrom.(PostUpdateNode).getPreUpdateNode() = read + ) ) or - LocalFlow::localFlowCapturedVarStep(nodeFrom, nodeTo) - or FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(), nodeTo.(FlowSummaryNode).getSummaryNode(), true) or nodeTo.(ObjectCreationNode).getPreUpdateNode() = nodeFrom.(ObjectInitializerNode) + or + VariableCapture::valueStep(nodeFrom, nodeTo) + or + nodeTo = nodeFrom.(LocalFunctionCreationNode).getAnAccess(true) } /** @@ -881,6 +1158,18 @@ private Gvn::GvnType getANonTypeParameterSubTypeRestricted(RelevantGvnType t) { result = getANonTypeParameterSubType(t) } +/** A callable with an implicit `this` parameter. */ +private class InstanceCallable extends Callable { + InstanceCallable() { + this = any(DataFlowCallable dfc).asCallable() and + not this.(Modifiable).isStatic() and + // local functions and delegate capture `this` and should therefore + // not have a `this` parameter + not this instanceof LocalFunction and + not this instanceof AnonymousFunctionExpr + } +} + /** A collection of cached types and predicates to be evaluated in the same stage. */ cached private module Cached { @@ -915,22 +1204,17 @@ private module Cached { TExplicitParameterNode(DotNet::Parameter p) { p = any(DataFlowCallable dfc).asCallable().getAParameter() } or - TInstanceParameterNode(Callable c) { - c = any(DataFlowCallable dfc).asCallable() and - not c.(Modifiable).isStatic() - } or + TInstanceParameterNode(InstanceCallable c) or TDelegateSelfReferenceNode(Callable c) { lambdaCreationExpr(_, c) } or + TLocalFunctionCreationNode(ControlFlow::Nodes::ElementNode cfn, Boolean isPostUpdate) { + cfn.getAstNode() instanceof LocalFunctionStmt + } or TYieldReturnNode(ControlFlow::Nodes::ElementNode cfn) { any(Callable c).canYieldReturn(cfn.getAstNode()) } or TAsyncReturnNode(ControlFlow::Nodes::ElementNode cfn) { any(Callable c | c.(Modifiable).isAsync()).canReturn(cfn.getAstNode()) } or - TImplicitCapturedArgumentNode(ControlFlow::Nodes::ElementNode cfn, LocalScopeVariable v) { - exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowIn(_, cfn, _) | - v = def.getSourceVariable().getAssignable() - ) - } or TMallocNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getAstNode() instanceof ObjectCreation } or TObjectInitializerNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getAstNode().(ObjectCreation).hasInitializer() @@ -953,18 +1237,22 @@ private module Cached { arrayRead(e, read) ) ) + or + lambdaCallExpr(_, cfn) } or TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) or TParamsArgumentNode(ControlFlow::Node callCfn) { callCfn = any(Call c | isParamsArg(c, _, _)).getAControlFlowNode() } or TFlowInsensitiveFieldNode(FieldOrProperty f) { f.isFieldLike() } or + TFlowInsensitiveCapturedVariableNode(LocalScopeVariable v) { v.isCaptured() } or TInstanceParameterAccessNode(ControlFlow::Node cfn, Boolean isPostUpdate) { cfn = getAPrimaryConstructorParameterCfn(_) } or TPrimaryConstructorThisAccessNode(Parameter p, Boolean isPostUpdate) { p.getCallable() instanceof PrimaryConstructor - } + } or + TCaptureNode(VariableCapture::Flow::SynthesizedCaptureNode cn) /** * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local @@ -977,10 +1265,7 @@ private module Cached { LocalFlow::localSsaFlowStepUseUse(_, nodeFrom, nodeTo) and nodeFrom != nodeTo or - exists(SsaImpl::DefinitionExt def | - LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo) and - LocalFlow::usesInstanceField(def) - ) + LocalFlow::localSsaFlowStep(_, nodeFrom, nodeTo) or // Flow into phi (read)/uncertain SSA definition node from read exists(Node read | LocalFlow::localFlowSsaInputFromRead(read, _, nodeTo) | @@ -1003,7 +1288,8 @@ private module Cached { TSyntheticFieldContent(SyntheticField f) or TPrimaryConstructorParameterContent(Parameter p) { p.getCallable() instanceof PrimaryConstructor - } + } or + TCapturedVariableContent(VariableCapture::CapturedVariable v) cached newtype TContentApprox = @@ -1013,7 +1299,8 @@ private module Cached { TSyntheticFieldApproxContent() or TPrimaryConstructorParameterApproxContent(string firstChar) { firstChar = approximatePrimaryConstructorParameterContent(_) - } + } or + TCapturedVariableContentApprox(VariableCapture::CapturedVariable v) pragma[nomagic] private predicate commonSubTypeGeneral(DataFlowTypeOrUnifiable t1, RelevantGvnType t2) { @@ -1063,8 +1350,6 @@ predicate nodeIsHidden(Node n) { or n instanceof AsyncReturnNode or - n instanceof ImplicitCapturedArgumentNode - or n instanceof MallocNode or n instanceof FlowSummaryNode @@ -1080,6 +1365,10 @@ predicate nodeIsHidden(Node n) { n instanceof PrimaryConstructorThisAccessNode or n = any(AssignableDefinitionNode def | not exists(def.getDefinition().getTargetAccess())) + or + n instanceof DelegateSelfReferenceNode + or + n instanceof CaptureNode } /** A CIL SSA definition, viewed as a node in a data flow graph. */ @@ -1233,7 +1522,7 @@ private module ParameterNodes { * This is used for improving lambda dispatch, and will eventually also be * used for tracking flow through captured variables. */ - private class DelegateSelfReferenceNode extends ParameterNodeImpl, TDelegateSelfReferenceNode { + class DelegateSelfReferenceNode extends ParameterNodeImpl, TDelegateSelfReferenceNode { private Callable callable; DelegateSelfReferenceNode() { this = TDelegateSelfReferenceNode(callable) } @@ -1266,35 +1555,6 @@ private module ParameterNodes { LocalScopeVariable getVariable() { result = v } } - /** - * The value of an implicit captured variable parameter at function entry, - * viewed as a node in a data flow graph. - * - * An implicit parameter is added in order to be able to track flow into - * capturing callables, as if an explicit `ref` parameter had been used: - * - * ```csharp - * void M() { void M() { - * int i = 0; int i = 0; - * void In() { => void In(ref int i0) { // implicit i0 parameter - * Use(i); Use(i0); - * } } - * In(); In(ref i); - * } } - * ``` - */ - class ImplicitCapturedParameterNode extends ParameterNodeImpl, SsaDefinitionExtNode { - ImplicitCapturedParameterNode() { def instanceof SsaCapturedEntryDefinition } - - /** Gets the captured variable that this implicit parameter models. */ - LocalScopeVariable getVariable() { result = def.(SsaCapturedEntryDefinition).getVariable() } - - override predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) { - pos.isImplicitCapturedParameterPosition(def.getSourceVariable().getAssignable()) and - c.asCallable() = this.getEnclosingCallable() - } - } - /** A parameter for a library callable with a flow summary. */ class SummaryParameterNode extends ParameterNodeImpl, FlowSummaryNode { private ParameterPosition pos_; @@ -1371,10 +1631,10 @@ private module ArgumentNodes { } /** A data-flow node that represents a delegate passed into itself. */ - class DelegateSelfArgumentNode extends ArgumentNodeImpl { + class DelegateSelfArgumentNode extends ArgumentNodeImpl, ExprNode { private DataFlowCall call_; - DelegateSelfArgumentNode() { lambdaCallExpr(call_, this) } + DelegateSelfArgumentNode() { lambdaCallExpr(call_, this.getControlFlowNode()) } override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { call = call_ and @@ -1382,48 +1642,6 @@ private module ArgumentNodes { } } - /** - * The value of a captured variable as an implicit argument of a call, viewed - * as a node in a data flow graph. - * - * An implicit node is added in order to be able to track flow into capturing - * callables, as if an explicit parameter had been used: - * - * ```csharp - * void M() { void M() { - * int i = 0; int i = 0; - * void Out() { i = 1; } => void Out(ref int i0) { i0 = 1; } - * Out(); Out(ref i); // implicit argument - * Use(i); Use(i) - * } } - * ``` - */ - class ImplicitCapturedArgumentNode extends ArgumentNodeImpl, NodeImpl, - TImplicitCapturedArgumentNode - { - private LocalScopeVariable v; - private ControlFlow::Nodes::ElementNode cfn; - - ImplicitCapturedArgumentNode() { this = TImplicitCapturedArgumentNode(cfn, v) } - - override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) { - pos.isImplicitCapturedArgumentPosition(v) and - call.getControlFlowNode() = cfn - } - - override DataFlowCallable getEnclosingCallableImpl() { - result.asCallable() = cfn.getEnclosingCallable() - } - - override Type getTypeImpl() { result = v.getType() } - - override ControlFlow::Node getControlFlowNodeImpl() { none() } - - override Location getLocationImpl() { result = cfn.getLocation() } - - override string toStringImpl() { result = "[implicit argument] " + v } - } - /** * A node that corresponds to the value of an object creation (`new C()`) before * the constructor has run. @@ -1608,45 +1826,6 @@ private module ReturnNodes { override string toStringImpl() { result = expr.toString() } } - /** - * The value of a captured variable as an implicit return from a call, viewed - * as a node in a data flow graph. - * - * An implicit node is added in order to be able to track flow out of capturing - * callables, as if an explicit `ref` parameter had been used: - * - * ```csharp - * void M() { void M() { - * int i = 0; int i = 0; - * void Out() { void Out(ref int i0) { - * i = 1; => i0 = 1; // implicit return - * } } - * Out(); Out(ref i); - * Use(i); Use(i) - * } } - * ``` - */ - class ImplicitCapturedReturnNode extends ReturnNode, SsaDefinitionExtNode { - private Ssa::ExplicitDefinition edef; - - ImplicitCapturedReturnNode() { - edef = this.getDefinitionExt() and - edef.isCapturedVariableDefinitionFlowOut(_, _) - } - - /** - * Holds if the value at this node may flow out to the implicit call definition - * at `node`, using one or more calls. - */ - predicate flowsOutTo(SsaDefinitionExtNode node, boolean additionalCalls) { - edef.isCapturedVariableDefinitionFlowOut(node.getDefinitionExt(), additionalCalls) - } - - override ImplicitCapturedReturnKind getKind() { - result.getVariable() = edef.getSourceVariable().getAssignable() - } - } - private class SummaryReturnNode extends FlowSummaryNode, ReturnNode { private ReturnKind rk; @@ -1741,32 +1920,6 @@ private module OutNodes { } } - /** - * A data-flow node that reads a value returned implicitly by a callable - * using a captured variable. - */ - class CapturedOutNode extends OutNode, SsaDefinitionExtNode { - private DataFlowCall call; - - CapturedOutNode() { - exists(ImplicitCapturedReturnNode n, boolean additionalCalls, ControlFlow::Node cfn | - n.flowsOutTo(this, additionalCalls) and - cfn = this.getDefinitionExt().(Ssa::Definition).getControlFlowNode() - | - additionalCalls = false and call = csharpCall(_, cfn) - or - additionalCalls = true and - call = TTransitiveCapturedCall(cfn) - ) - } - - override DataFlowCall getCall(ReturnKind kind) { - result = call and - kind.(ImplicitCapturedReturnKind).getVariable() = - this.getDefinitionExt().getSourceVariable().getAssignable() - } - } - /** * A data-flow node that reads a value returned by a callable using an * `out` or `ref` parameter. @@ -1841,10 +1994,10 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode { * Both models need a pre-update this node, and the latter need an additional post-update this access, * all of which are represented by an `InstanceParameterAccessNode` node. */ -class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode { - private ControlFlow::Node cfn; - private boolean isPostUpdate; - private Parameter p; +abstract private class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode { + ControlFlow::Node cfn; + boolean isPostUpdate; + Parameter p; InstanceParameterAccessNode() { this = TInstanceParameterAccessNode(cfn, isPostUpdate) and @@ -1861,8 +2014,6 @@ class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode override Location getLocationImpl() { result = cfn.getLocation() } - override string toStringImpl() { result = "this" } - /** * Gets the underlying control flow node. */ @@ -1872,11 +2023,12 @@ class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode * Gets the primary constructor parameter that this is a this access to. */ Parameter getParameter() { result = p } +} - /** - * Holds if the this parameter access node corresponds to a pre-update node. - */ - predicate isPreUpdate() { isPostUpdate = false } +private class InstanceParameterAccessPreNode extends InstanceParameterAccessNode { + InstanceParameterAccessPreNode() { isPostUpdate = false } + + override string toStringImpl() { result = "this" } } /** @@ -1892,9 +2044,11 @@ class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode * ``` * The synthesized (pre/post-update) this access is represented an `PrimaryConstructorThisAccessNode` node. */ -class PrimaryConstructorThisAccessNode extends NodeImpl, TPrimaryConstructorThisAccessNode { - private Parameter p; - private boolean isPostUpdate; +abstract private class PrimaryConstructorThisAccessNode extends NodeImpl, + TPrimaryConstructorThisAccessNode +{ + Parameter p; + boolean isPostUpdate; PrimaryConstructorThisAccessNode() { this = TPrimaryConstructorThisAccessNode(p, isPostUpdate) } @@ -1919,6 +2073,44 @@ class PrimaryConstructorThisAccessNode extends NodeImpl, TPrimaryConstructorThis predicate isPostUpdate() { isPostUpdate = true } } +private class PrimaryConstructorThisAccessPreNode extends PrimaryConstructorThisAccessNode { + PrimaryConstructorThisAccessPreNode() { isPostUpdate = false } + + override string toStringImpl() { result = "this" } +} + +/** + * A synthesized data flow node representing a closure object that tracks + * captured variables. + */ +class CaptureNode extends NodeImpl, TCaptureNode { + VariableCapture::Flow::SynthesizedCaptureNode cn; + + CaptureNode() { this = TCaptureNode(cn) } + + VariableCapture::Flow::SynthesizedCaptureNode getSynthesizedCaptureNode() { result = cn } + + override DataFlowCallable getEnclosingCallableImpl() { + result.asCallable() = cn.getEnclosingCallable() + } + + override Type getTypeImpl() { + exists(VariableCapture::CapturedVariable v | cn.isVariableAccess(v) and result = v.getType()) + } + + override DataFlowType getDataFlowType() { + if cn.isInstanceAccess() + then result.asDelegate() = cn.getEnclosingCallable() + else result = super.getDataFlowType() + } + + override ControlFlow::Node getControlFlowNodeImpl() { none() } + + override Location getLocationImpl() { result = cn.getLocation() } + + override string toStringImpl() { result = cn.toString() } +} + /** A field or a property. */ class FieldOrProperty extends Assignable, Modifiable { FieldOrProperty() { @@ -2004,6 +2196,30 @@ class FlowInsensitiveFieldNode extends NodeImpl, TFlowInsensitiveFieldNode { override string toStringImpl() { result = "[flow-insensitive] " + f } } +/** + * A data flow node used for control-flow insensitive flow through captured + * variables. + * + * Only used in lambda flow. + */ +class FlowInsensitiveCapturedVariableNode extends NodeImpl, TFlowInsensitiveCapturedVariableNode { + private LocalScopeVariable v; + + FlowInsensitiveCapturedVariableNode() { this = TFlowInsensitiveCapturedVariableNode(v) } + + LocalScopeVariable getVariable() { result = v } + + override DataFlowCallable getEnclosingCallableImpl() { result.asCapturedVariable() = v } + + override Type getTypeImpl() { result = v.getType() } + + override ControlFlow::Node getControlFlowNodeImpl() { none() } + + override Location getLocationImpl() { result = v.getLocation() } + + override string toStringImpl() { result = "[flow-insensitive] " + v } +} + /** * Holds if `pred` can flow to `succ`, by jumping from one callable to * another. Additional steps specified by the configuration are *not* @@ -2026,6 +2242,8 @@ predicate jumpStep(Node pred, Node succ) { or FlowSummaryImpl::Private::Steps::summaryJumpStep(pred.(FlowSummaryNode).getSummaryNode(), succ.(FlowSummaryNode).getSummaryNode()) + or + succ = pred.(LocalFunctionCreationNode).getAnAccess(false) } private class StoreStepConfiguration extends ControlFlowReachabilityConfiguration { @@ -2117,6 +2335,8 @@ predicate storeStep(Node node1, ContentSet c, Node node2) { or FlowSummaryImpl::Private::Steps::summaryStoreStep(node1.(FlowSummaryNode).getSummaryNode(), c, node2.(FlowSummaryNode).getSummaryNode()) + or + VariableCapture::storeStep(node1, c, node2) } private class ReadStepConfiguration extends ControlFlowReachabilityConfiguration { @@ -2208,10 +2428,9 @@ predicate readStep(Node node1, ContentSet c, Node node2) { c = getResultContent() or node1 = - any(InstanceParameterAccessNode n | + any(InstanceParameterAccessPreNode n | n.getUnderlyingControlFlowNode() = node2.(ExprNode).getControlFlowNode() and - n.getParameter() = c.(PrimaryConstructorParameterContent).getParameter() and - n.isPreUpdate() + n.getParameter() = c.(PrimaryConstructorParameterContent).getParameter() ) and node2.asExpr() instanceof ParameterRead or @@ -2247,6 +2466,8 @@ predicate readStep(Node node1, ContentSet c, Node node2) { or FlowSummaryImpl::Private::Steps::summaryReadStep(node1.(FlowSummaryNode).getSummaryNode(), c, node2.(FlowSummaryNode).getSummaryNode()) + or + VariableCapture::readStep(node1, c, node2) } /** @@ -2277,6 +2498,8 @@ predicate clearsContent(Node n, ContentSet c) { ) or n = any(PostUpdateNode n1 | primaryConstructorParameterStore(_, c, n1)).getPreUpdateNode() + or + VariableCapture::clearsContent(n, c) } /** @@ -2325,7 +2548,7 @@ class DataFlowType extends TDataFlowType { * For methods used as method groups in calls there can be multiple * creations associated with the same type. */ - Expr getADelegateCreation() { + ControlFlowElement getADelegateCreation() { exists(Callable callable | lambdaCreationExpr(result, callable) and this = TDelegateDataFlowType(callable) @@ -2350,7 +2573,10 @@ DataFlowType getNodeType(Node n) { result = getNodeType(arg) ) or - n.asExpr() = result.getADelegateCreation() + [ + n.asExpr().(ControlFlowElement), + n.(LocalFunctionCreationPreNode).getUnderlyingControlFlowNode().getAstNode() + ] = result.getADelegateCreation() } /** Gets a string representation of a `DataFlowType`. */ @@ -2570,11 +2796,11 @@ module PostUpdateNodes { private class InstanceParameterAccessPostUpdateNode extends PostUpdateNode, InstanceParameterAccessNode { - private ControlFlow::Node cfn; + InstanceParameterAccessPostUpdateNode() { isPostUpdate = true } - InstanceParameterAccessPostUpdateNode() { this = TInstanceParameterAccessNode(cfn, true) } - - override Node getPreUpdateNode() { result = TInstanceParameterAccessNode(cfn, false) } + override InstanceParameterAccessPreNode getPreUpdateNode() { + result = TInstanceParameterAccessNode(cfn, false) + } override string toStringImpl() { result = "[post] this" } } @@ -2582,16 +2808,37 @@ module PostUpdateNodes { private class PrimaryConstructorThisAccessPostUpdateNode extends PostUpdateNode, PrimaryConstructorThisAccessNode { - private Parameter p; + PrimaryConstructorThisAccessPostUpdateNode() { isPostUpdate = true } - PrimaryConstructorThisAccessPostUpdateNode() { - this = TPrimaryConstructorThisAccessNode(p, true) + override PrimaryConstructorThisAccessPreNode getPreUpdateNode() { + result = TPrimaryConstructorThisAccessNode(p, false) } - override Node getPreUpdateNode() { result = TPrimaryConstructorThisAccessNode(p, false) } - override string toStringImpl() { result = "[post] this" } } + + class LocalFunctionCreationPostUpdateNode extends LocalFunctionCreationNode, PostUpdateNode { + LocalFunctionCreationPostUpdateNode() { isPostUpdate = true } + + override LocalFunctionCreationPreNode getPreUpdateNode() { + result = TLocalFunctionCreationNode(cfn, false) + } + + override string toStringImpl() { result = "[post] " + cfn } + } + + private class CapturePostUpdateNode extends PostUpdateNode, CaptureNode { + private CaptureNode pre; + + CapturePostUpdateNode() { + VariableCapture::Flow::capturePostUpdateNode(this.getSynthesizedCaptureNode(), + pre.getSynthesizedCaptureNode()) + } + + override CaptureNode getPreUpdateNode() { result = pre } + + override string toStringImpl() { result = "[post] " + cn } + } } private import PostUpdateNodes @@ -2645,12 +2892,13 @@ int accessPathLimit() { result = 5 } */ predicate forceHighPrecision(Content c) { c instanceof ElementContent } -private predicate lambdaCreationExpr(Expr creation, Callable c) { +private predicate lambdaCreationExpr(ControlFlowElement creation, Callable c) { c = [ creation.(AnonymousFunctionExpr), creation.(CallableAccess).getTarget().getUnboundDeclaration(), - creation.(AddressOfExpr).getOperand().(CallableAccess).getTarget().getUnboundDeclaration() + creation.(AddressOfExpr).getOperand().(CallableAccess).getTarget().getUnboundDeclaration(), + creation.(LocalFunctionStmt).getLocalFunction() ] } @@ -2677,19 +2925,32 @@ private class LambdaConfiguration extends ControlFlowReachabilityConfiguration { exactScope = false and scope = e2 and isSuccessor = true + or + e1.(LocalFunctionAccess).getParent() = e2.(LocalFunctionCall) and + exactScope = false and + scope = e2 and + isSuccessor = true } } -private predicate lambdaCallExpr(DataFlowCall call, ExprNode receiver) { +private predicate lambdaCallExpr(DataFlowCall call, ControlFlow::Node receiver) { exists(LambdaConfiguration x, DelegateLikeCall dc | - x.hasExprPath(dc.getExpr(), receiver.getControlFlowNode(), dc, call.getControlFlowNode()) + x.hasExprPath(dc.getExpr(), receiver, dc, call.getControlFlowNode()) + ) + or + // In local function calls, `F()`, we use the local function access `F` + // to represent the receiver. Only needed for flow through captured variables. + exists(LambdaConfiguration x, LocalFunctionCall fc | + x.hasExprPath(fc.getAChild(), receiver, fc, call.getControlFlowNode()) ) } /** Holds if `call` is a lambda call where `receiver` is the lambda expression. */ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { ( - lambdaCallExpr(call, receiver) + lambdaCallExpr(call, receiver.(ExprNode).getControlFlowNode()) and + // local function calls can be resolved directly without a flow analysis + not call.getControlFlowNode().getAstNode() instanceof LocalFunctionCall or receiver.(FlowSummaryNode).getSummaryNode() = call.(SummaryCall).getReceiver() ) and @@ -2707,8 +2968,11 @@ private predicate delegateCreationStep(Node nodeFrom, Node nodeTo) { predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { exists(SsaImpl::DefinitionExt def | LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo) and - LocalFlow::usesInstanceField(def) and preservesValue = true + | + LocalFlow::usesInstanceField(def) + or + def instanceof VariableCapture::CapturedSsaDefinitionExt ) or delegateCreationStep(nodeFrom, nodeTo) and @@ -2737,6 +3001,9 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves fa = nodeTo.asExpr() and fa.(FieldOrPropertyRead).hasNonlocalValue() ) + or + VariableCapture::flowInsensitiveStep(nodeFrom, nodeTo) and + preservesValue = true } /** @@ -2751,6 +3018,9 @@ predicate allowParameterReturnInSelf(ParameterNode p) { parameterNode(p, c, pos) and FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos) ) + or + VariableCapture::Flow::heuristicAllowInstanceParameterReturnInSelf(p.(DelegateSelfReferenceNode) + .getCallable()) } /** An approximated `Content`. */ @@ -2773,6 +3043,10 @@ class ContentApprox extends TContentApprox { this = TPrimaryConstructorParameterApproxContent(firstChar) and result = "approximated parameter field " + firstChar ) + or + exists(VariableCapture::CapturedVariable v | + this = TCapturedVariableContentApprox(v) and result = "captured " + v + ) } } @@ -2807,6 +3081,8 @@ ContentApprox getContentApprox(Content c) { or result = TPrimaryConstructorParameterApproxContent(approximatePrimaryConstructorParameterContent(c)) + or + result = TCapturedVariableContentApprox(VariableCapture::getCapturedVariableContent(c)) } /** diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll index 2147b2f7d413..1f99522b34a7 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll @@ -258,6 +258,17 @@ class ElementContent extends Content, TElementContent { override Location getLocation() { result instanceof EmptyLocation } } +/** A captured variable. */ +class CapturedVariableContent extends Content, TCapturedVariableContent { + private VariableCapture::CapturedVariable v; + + CapturedVariableContent() { this = TCapturedVariableContent(v) } + + override string toString() { result = "captured " + v } + + override Location getLocation() { result = v.getLocation() } +} + /** * An entity that represents a set of `Content`s. * diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll index 8b7db48140ab..9757121566b2 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll @@ -5,6 +5,7 @@ import csharp private import codeql.ssa.Ssa as SsaImplCommon private import AssignableDefinitions +private import semmle.code.csharp.controlflow.internal.PreSsa private module SsaInput implements SsaImplCommon::InputSig { class BasicBlock = ControlFlow::BasicBlock; @@ -30,9 +31,6 @@ private module SsaInput implements SsaImplCommon::InputSig { or updatesNamedFieldOrProp(bb, i, _, v, _) and certain = false - or - updatesCapturedVariable(bb, i, _, v, _, _) and - certain = false } /** @@ -724,401 +722,10 @@ private module FieldOrPropsImpl { } } -/** - * As in the SSA construction for fields and properties, SSA construction - * for captured variables relies on implicit update nodes at every call - * site that conceivably could reach an update of the captured variable. - * For example, there is an implicit update of `v` on line 4 in - * - * ```csharp - * int M() { - * int i = 0; - * Action a = () => { i = 1; }; - * a(); // implicit update of `v` - * return i; - * } - * ``` - * - * We find update paths of the form: - * - * ``` - * Call --(callEdge)-->* Callable(update of v) - * ``` - * - * For simplicity, and for performance reasons, we ignore cases where a path - * goes through the callable that introduces `v`; such a path does not - * represent an actual update, as a new copy of `v` is updated. - */ -private module CapturedVariableImpl { - /** - * A local scope variable that is captured, and updated by at least one capturer. - */ - private class CapturedWrittenLocalScopeVariable extends LocalScopeVariable { - CapturedWrittenLocalScopeVariable() { - exists(AssignableDefinition def | def.getTarget() = this | - def.getEnclosingCallable() != this.getCallable() - ) - } - } - - private class CapturedWrittenLocalScopeSourceVariable extends LocalScopeSourceVariable { - CapturedWrittenLocalScopeSourceVariable() { - this.getAssignable() instanceof CapturedWrittenLocalScopeVariable - } - } - - private class CapturedWrittenLocalScopeVariableDefinition extends AssignableDefinition { - CapturedWrittenLocalScopeVariableDefinition() { - this.getTarget() instanceof CapturedWrittenLocalScopeVariable - } - } - - /** - * Holds if `vdef` is an update of captured variable `v` in callable `c` - * that is relevant for SSA construction. - */ - predicate relevantDefinition( - Callable c, CapturedWrittenLocalScopeVariable v, - CapturedWrittenLocalScopeVariableDefinition vdef - ) { - exists(ControlFlow::BasicBlock bb, CapturedWrittenLocalScopeSourceVariable sv | - vdef.getTarget() = v and - vdef.getEnclosingCallable() = c and - sv.getAssignable() = v and - bb.getNode(_) = vdef.getAControlFlowNode() and - c != v.getCallable() - ) - } - - /** - * Holds if `call` occurs in basic block `bb` at index `i`, captured variable - * `v` has an update somewhere, and `v` is likely to be live in `bb` at index - * `i`. - */ - predicate updateCandidate( - ControlFlow::BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v, Call call - ) { - FieldOrPropsImpl::callAt(bb, i, call) and - call.getEnclosingCallable() = v.getEnclosingCallable() and - exists(Assignable a | - a = v.getAssignable() and - relevantDefinition(_, a, _) and - not exists(AssignableDefinitions::OutRefDefinition def | - def.getCall() = call and - def.getTarget() = a - ) - ) - } - - private predicate source( - Call call, CapturedWrittenLocalScopeSourceVariable v, - CapturedWrittenLocalScopeVariable captured, Callable c, boolean libraryDelegateCall - ) { - updateCandidate(_, _, v, call) and - c = getARuntimeTarget(call, libraryDelegateCall) and - captured = v.getAssignable() and - relevantDefinition(_, captured, _) - } - - /** - * Holds if `c` is a relevant part of the call graph for - * `updatesCapturedVariable` based on following edges in forward direction. - */ - private predicate reachableFromSource(Callable c) { - source(_, _, _, c, _) - or - exists(Callable mid | reachableFromSource(mid) | callEdge(mid, c)) - } - - private predicate sink(Callable c, CapturedWrittenLocalScopeVariable captured) { - reachableFromSource(c) and - relevantDefinition(c, captured, _) - } - - private predicate prunedCallable(Callable c) { - sink(c, _) - or - exists(Callable mid | callEdge(c, mid) and prunedCallable(mid)) - } - - private predicate prunedEdge(Callable c1, Callable c2) { - prunedCallable(c1) and - prunedCallable(c2) and - callEdge(c1, c2) - } - - private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2) - - /** - * Holds if `call` may change the value of captured variable `v`. The actual - * update occurs in `writer`. That is, `writer` can be reached from `call` - * using zero or more additional calls (as indicated by `additionalCalls`). - * One of the intermediate callables may be the callable that introduces `v`, - * in which case `call` is not an actual update. - */ - pragma[noopt] - predicate updatesCapturedVariableWriter( - Call call, CapturedWrittenLocalScopeSourceVariable v, Callable writer, boolean additionalCalls - ) { - exists(Callable src, CapturedWrittenLocalScopeVariable captured, boolean libraryDelegateCall | - source(call, v, captured, src, libraryDelegateCall) and - sink(writer, captured) and - ( - src = writer and additionalCalls = libraryDelegateCall - or - edgePlus(src, writer) and additionalCalls = true - ) - ) - } - - /** - * Holds if captured local scope variable `v` is written inside the callable - * to which `bb` belongs. - * - * In this case a pseudo-read is inserted at the exit node at index `i` in `bb`, - * in order to make the write live. - * - * Example: - * - * ```csharp - * class C { - * void M1() { - * int i = 0; - * void M2() { i = 2; }; - * M2(); - * System.Console.WriteLine(i); - * } - * } - * ``` - * - * The write to `i` inside `M2` on line 4 is live because of the implicit call - * definition on line 5. - */ - predicate capturedExitRead( - ControlFlow::BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v - ) { - exists(ControlFlow::Nodes::AnnotatedExitNode exit | - exit.isNormal() and - variableDefinition(bb.getAPredecessor*(), _, v, _) and - exit = bb.getNode(i) - ) - } -} - -/** - * Liveness analysis to restrict the size of the SSA representation for - * captured variables. - * - * Example: - * - * ```csharp - * void M() { - * int i = 0; - * void M2() { - * System.Console.WriteLine(i); - * } - * M2(); - * } - * ``` - * - * The definition of `i` on line 2 is live, because of the call to `M2` on - * line 6. However, that call is not a direct read of `i`, so we account - * for that by inserting an implicit read of `i` on line 6. - * - * The predicates in this module follow the same structure as those in - * `CapturedVariableImpl`. - */ -private module CapturedVariableLivenessImpl { - /** - * Holds if `c` is a callable that captures local scope variable `v`, and - * `c` may read the value of the captured variable. - */ - private predicate capturerReads(Callable c, LocalScopeVariable v) { - exists(LocalScopeSourceVariable sv | - c = sv.getEnclosingCallable() and - v = sv.getAssignable() and - v.getCallable() != c - | - variableReadActual(_, _, sv) - or - refReadBeforeWrite(_, _, sv) - ) - } - - /** - * A local scope variable that is captured, and read by at least one capturer. - */ - private class CapturedReadLocalScopeVariable extends LocalScopeVariable { - CapturedReadLocalScopeVariable() { capturerReads(_, this) } - } - - private class CapturedReadLocalScopeSourceVariable extends LocalScopeSourceVariable { - CapturedReadLocalScopeSourceVariable() { - this.getAssignable() instanceof CapturedReadLocalScopeVariable - } - } - - /** - * Holds if a write to captured source variable `v` may be read by a - * callable reachable from the call `c`. - */ - private predicate implicitReadCandidate( - CapturedReadLocalScopeSourceVariable v, ControlFlow::Nodes::ElementNode c - ) { - exists(ControlFlow::BasicBlock bb, int i | variableWriteDirect(bb, i, v, _) | - c = bb.getNode(any(int j | j > i)) - or - c = bb.getASuccessor+().getANode() - ) - } - - private predicate source( - ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v, - CapturedReadLocalScopeVariable captured, Callable c, boolean libraryDelegateCall - ) { - implicitReadCandidate(v, call) and - c = getARuntimeTarget(call.getAstNode(), libraryDelegateCall) and - captured = v.getAssignable() and - capturerReads(_, captured) - } - - /** - * Holds if `c` is a relevant part of the call graph for - * `readsCapturedVariable` based on following edges in forward direction. - */ - private predicate reachableFromSource(Callable c) { - source(_, _, _, c, _) - or - exists(Callable mid | reachableFromSource(mid) | callEdge(mid, c)) - } - - private predicate sink(Callable c, CapturedReadLocalScopeVariable captured) { - reachableFromSource(c) and - capturerReads(c, captured) - } - - private predicate prunedCallable(Callable c) { - sink(c, _) - or - exists(Callable mid | callEdge(c, mid) and prunedCallable(mid)) - } - - private predicate prunedEdge(Callable c1, Callable c2) { - prunedCallable(c1) and - prunedCallable(c2) and - callEdge(c1, c2) - } - - private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2) - - /** - * Holds if `call` may read the value of captured variable `v`. The actual - * read occurs in `reader`. That is, `reader` can be reached from `call` - * using zero or more additional calls (as indicated by `additionalCalls`). - * One of the intermediate callables may be a callable that writes to `v`, - * in which case `call` is not an actual read. - */ - pragma[noopt] - private predicate readsCapturedVariable( - ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v, Callable reader, - boolean additionalCalls - ) { - exists(Callable src, CapturedReadLocalScopeVariable captured, boolean libraryDelegateCall | - source(call, v, captured, src, libraryDelegateCall) and - sink(reader, captured) and - ( - src = reader and additionalCalls = libraryDelegateCall - or - edgePlus(src, reader) and additionalCalls = true - ) - ) - } - - /** - * Holds if captured local scope variable `v` is written inside the callable - * to which `bb` belongs, and the value may be read via `call` using zero or - * more additional calls (as indicated by `additionalCalls`). - * - * In this case a pseudo-read is inserted at the exit node at index `i` in `bb`, - * in order to make the write live. - * - * Example: - * - * ```csharp - * class C { - * void M1() { - * int i = 0; - * void M2() { i = 2; }; - * M2(); - * System.Console.WriteLine(i); - * } - * } - * ``` - * - * The write to `i` inside `M2` on line 4 is live because of the implicit call - * definition on line 5. - */ - predicate capturedReadOut( - ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v, LocalScopeSourceVariable outer, - Call call, boolean additionalCalls - ) { - exists( - ControlFlow::Nodes::AnnotatedExitNode exit, ControlFlow::BasicBlock pred, - AssignableDefinition adef - | - exit.isNormal() and - variableDefinition(pred, _, v, adef) and - updatesCapturedVariable(_, _, call, outer, adef, additionalCalls) and - pred.getASuccessor*() = bb and - exit = bb.getNode(i) - ) - } - - /** - * Holds if a value written to captured local scope variable `outer` may be - * read as `inner` via `call`, at index `i` in basic block `bb`, using one or - * more calls (as indicated by `additionalCalls`). - * - * Example: - * - * ```csharp - * class C { - * void M1() { - * int i = 0; - * void M2() => System.Console.WriteLine(i); - * i = 1; - * M2(); - * } - * } - * ``` - * - * The write to `i` on line 5 is live because of the call to `M2` on line 6, which - * reaches the entry definition for `i` in `M2` on line 4. - */ - predicate capturedReadIn( - ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable outer, - LocalScopeSourceVariable inner, ControlFlow::Nodes::ElementNode call, boolean additionalCalls - ) { - exists(Callable reader | - implicitReadCandidate(outer, call) and - readsCapturedVariable(call, outer, reader, additionalCalls) and - reader = inner.getEnclosingCallable() and - outer.getAssignable() = inner.getAssignable() and - call = bb.getNode(i) - ) - } -} - -private import CapturedVariableLivenessImpl - private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) { outRefExitRead(bb, i, v) or refReadBeforeWrite(bb, i, v) - or - CapturedVariableImpl::capturedExitRead(bb, i, v) - or - capturedReadIn(bb, i, v, _, _, _) } pragma[noinline] @@ -1223,7 +830,7 @@ cached private module Cached { cached newtype TSourceVariable = - TLocalVar(Callable c, LocalScopeVariable v) { + TLocalVar(Callable c, PreSsa::SimpleLocalScopeVariable v) { c = v.getCallable() or // Local scope variables can be captured @@ -1297,23 +904,6 @@ private module Cached { FieldOrPropsImpl::updatesNamedFieldOrProp(fp, c, setter) } - /** - * Holds if `call` may change the value of captured variable `v`. The actual - * update occurs in `def`. - */ - cached - predicate updatesCapturedVariable( - ControlFlow::BasicBlock bb, int i, Call call, LocalScopeSourceVariable v, - AssignableDefinition def, boolean additionalCalls - ) { - CapturedVariableImpl::updateCandidate(bb, i, v, call) and - exists(Callable writer | - CapturedVariableImpl::relevantDefinition(writer, v.getAssignable(), def) - | - CapturedVariableImpl::updatesCapturedVariableWriter(call, v, writer, additionalCalls) - ) - } - cached predicate variableWriteQualifier( ControlFlow::BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain @@ -1327,32 +917,6 @@ private module Cached { not updatesNamedFieldOrProp(bb, i, _, v, _) } - cached - predicate isCapturedVariableDefinitionFlowIn( - Ssa::ExplicitDefinition def, Ssa::ImplicitEntryDefinition edef, - ControlFlow::Nodes::ElementNode c, boolean additionalCalls - ) { - exists(Ssa::SourceVariable v, Ssa::Definition def0, ControlFlow::BasicBlock bb, int i | - v = def.getSourceVariable() and - capturedReadIn(_, _, v, edef.getSourceVariable(), c, additionalCalls) and - def = def0.getAnUltimateDefinition() and - Impl::ssaDefReachesRead(_, def0, bb, i) and - capturedReadIn(bb, i, v, _, _, _) and - c = bb.getNode(i) - ) - } - - cached - predicate isCapturedVariableDefinitionFlowOut( - Ssa::ExplicitDefinition def, Ssa::ImplicitCallDefinition cdef, boolean additionalCalls - ) { - exists(Ssa::Definition def0 | - def = def0.getAnUltimateDefinition() and - capturedReadOut(_, _, def0.getSourceVariable(), cdef.getSourceVariable(), cdef.getCall(), - additionalCalls) - ) - } - cached predicate explicitDefinition(WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad) { exists(ControlFlow::BasicBlock bb, int i | diff --git a/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql b/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql index 4612091743f2..2c9ff02349f3 100644 --- a/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql +++ b/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql @@ -91,6 +91,8 @@ class RelevantDefinition extends AssignableDefinition { this = any(Ssa::ExplicitDefinition ssaDef).getADefinition() or mayEscape(v) + or + v.isCaptured() ) } diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected index d0e636b1258e..ec78d10b35f9 100644 --- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected +++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected @@ -143,7 +143,6 @@ | CSharp7.cs:137:29:137:38 | (...) => ... | CSharp7.cs:137:24:137:25 | access to local variable f5 | | CSharp7.cs:137:34:137:34 | access to parameter x | CSharp7.cs:137:34:137:38 | ... + ... | | CSharp7.cs:137:38:137:38 | 1 | CSharp7.cs:137:34:137:38 | ... + ... | -| CSharp7.cs:139:9:139:51 | this | CSharp7.cs:139:38:139:39 | this access | | CSharp7.cs:139:20:139:20 | x | CSharp7.cs:139:26:139:26 | access to parameter x | | CSharp7.cs:139:26:139:26 | access to parameter x | CSharp7.cs:139:26:139:30 | ... > ... | | CSharp7.cs:139:26:139:26 | access to parameter x | CSharp7.cs:139:41:139:41 | access to parameter x | @@ -151,24 +150,18 @@ | CSharp7.cs:139:34:139:46 | ... + ... | CSharp7.cs:139:26:139:50 | ... ? ... : ... | | CSharp7.cs:139:38:139:46 | call to local function f7 | CSharp7.cs:139:34:139:46 | ... + ... | | CSharp7.cs:139:50:139:50 | 0 | CSharp7.cs:139:26:139:50 | ... ? ... : ... | -| CSharp7.cs:141:9:141:31 | this | CSharp7.cs:141:26:141:27 | this access | | CSharp7.cs:141:20:141:20 | x | CSharp7.cs:141:29:141:29 | access to parameter x | -| CSharp7.cs:143:9:147:9 | this | CSharp7.cs:146:20:146:21 | this access | -| CSharp7.cs:145:13:145:35 | this | CSharp7.cs:145:30:145:31 | this access | | CSharp7.cs:145:24:145:24 | x | CSharp7.cs:145:33:145:33 | access to parameter x | | CSharp7.cs:149:20:152:9 | (...) => ... | CSharp7.cs:149:16:149:16 | access to local variable a | | CSharp7.cs:157:10:157:17 | this | CSharp7.cs:169:9:169:9 | this access | | CSharp7.cs:160:18:160:18 | t | CSharp7.cs:160:24:160:24 | access to parameter t | -| CSharp7.cs:162:9:167:9 | this | CSharp7.cs:165:13:165:16 | this access | | CSharp7.cs:162:26:162:26 | u | CSharp7.cs:166:22:166:22 | access to parameter u | -| CSharp7.cs:164:13:164:43 | this | CSharp7.cs:164:37:164:40 | this access | | CSharp7.cs:165:13:165:16 | this access | CSharp7.cs:166:20:166:20 | this access | | CSharp7.cs:169:9:169:9 | this access | CSharp7.cs:170:9:170:9 | this access | | CSharp7.cs:173:10:173:19 | this | CSharp7.cs:180:21:180:21 | this access | | CSharp7.cs:175:16:175:18 | access to local variable src | CSharp7.cs:175:16:175:30 | SSA def(src) | | CSharp7.cs:175:16:175:30 | SSA def(src) | CSharp7.cs:180:23:180:25 | access to local variable src | | CSharp7.cs:175:22:175:30 | "tainted" | CSharp7.cs:175:16:175:18 | access to local variable src | -| CSharp7.cs:176:9:176:40 | this | CSharp7.cs:176:31:176:31 | this access | | CSharp7.cs:176:25:176:25 | s | CSharp7.cs:176:33:176:33 | access to parameter s | | CSharp7.cs:176:31:176:34 | call to local function g | CSharp7.cs:176:31:176:39 | ... + ... | | CSharp7.cs:176:38:176:39 | "" | CSharp7.cs:176:31:176:39 | ... + ... | diff --git a/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql index 729d19f6d1ee..1ff95c93b224 100644 --- a/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql +++ b/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql @@ -1,7 +1,10 @@ import csharp +private import semmle.code.csharp.controlflow.internal.PreSsa /** "Naive" def-use implementation. */ -predicate defReaches(AssignableDefinition def, LocalScopeVariable v, ControlFlow::Node cfn) { +predicate defReaches( + AssignableDefinition def, PreSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn +) { def.getTarget() = v and cfn = def.getAControlFlowNode().getASuccessor() or exists(ControlFlow::Node mid | defReaches(def, v, mid) | diff --git a/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql index e83eba4dd7ca..79e0e318e7a6 100644 --- a/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql +++ b/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql @@ -1,8 +1,10 @@ import csharp +private import semmle.code.csharp.controlflow.internal.PreSsa /** "Naive" parameter-use implementation. */ predicate parameterReaches(Parameter p, ControlFlow::Node cfn) { - cfn = p.getCallable().getEntryPoint().getASuccessor() + cfn = p.getCallable().getEntryPoint().getASuccessor() and + p instanceof PreSsa::SimpleLocalScopeVariable or exists(ControlFlow::Node mid | parameterReaches(p, mid) | not mid = diff --git a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql index e09c3d15caab..c32fc80c7824 100644 --- a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql +++ b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql @@ -1,7 +1,10 @@ import csharp +private import semmle.code.csharp.controlflow.internal.PreSsa /** "Naive" use-use implementation. */ -predicate useReaches(LocalScopeVariableRead read, LocalScopeVariable v, ControlFlow::Node cfn) { +predicate useReaches( + LocalScopeVariableRead read, PreSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn +) { read.getTarget() = v and cfn = read.getAControlFlowNode().getASuccessor() or exists(ControlFlow::Node mid | useReaches(read, v, mid) | diff --git a/csharp/ql/test/library-tests/dataflow/global/Capture.cs b/csharp/ql/test/library-tests/dataflow/global/Capture.cs index 7c6c1d8a04cc..be7ebe9cde6d 100644 --- a/csharp/ql/test/library-tests/dataflow/global/Capture.cs +++ b/csharp/ql/test/library-tests/dataflow/global/Capture.cs @@ -214,7 +214,7 @@ Action M3(string s) { return () => { - Check(s); // missing flow from lines 221 and 223 + Check(s); }; } @@ -243,12 +243,12 @@ void M7() Action a = () => { - Check(c.Field); // missing flow from line 242 + Check(c.Field); c.Field = "taint source"; }; a(); - Check(c.Field); // missing flow from line 247 + Check(c.Field); } void M7(bool b) @@ -265,7 +265,7 @@ void M7(bool b) }; a(); - Check(c.Field); // missing flow from line 264 + Check(c.Field); } void M8() @@ -298,12 +298,12 @@ void M10() Action a = () => { - Check(this.Field); // missing flow from line 297 + Check(this.Field); this.Field = "taint source"; }; a(); - Check(this.Field); // missing flow from line 302 + Check(this.Field); } void M11() diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected index b2244abaa60c..427dbd7a7af4 100644 --- a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected +++ b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected @@ -13,15 +13,20 @@ | Capture.cs:171:15:171:20 | access to local variable sink37 | | Capture.cs:197:15:197:20 | access to local variable sink38 | | Capture.cs:206:19:206:19 | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | | Capture.cs:231:19:231:19 | access to local variable x | | Capture.cs:234:15:234:15 | access to local variable x | +| Capture.cs:246:19:246:25 | access to field Field | | Capture.cs:251:15:251:21 | access to field Field | +| Capture.cs:268:15:268:21 | access to field Field | | Capture.cs:273:30:273:30 | access to parameter x | | Capture.cs:284:23:284:23 | access to local variable x | | Capture.cs:292:15:292:15 | access to local variable x | +| Capture.cs:301:19:301:28 | access to field Field | | Capture.cs:306:15:306:24 | access to field Field | | Capture.cs:312:15:312:15 | access to local variable x | | Capture.cs:319:19:319:19 | access to local variable x | +| Capture.cs:330:47:330:47 | access to local variable x | | Capture.cs:339:45:339:45 | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected index 6cea5180e89e..0ed28a45b04a 100644 --- a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected +++ b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected @@ -1,59 +1,166 @@ edges -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | | -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | | -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | provenance | | | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:61:36:61:42 | access to parameter tainted : String | provenance | | +| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | | | Capture.cs:11:17:11:22 | access to local variable sink27 : String | Capture.cs:12:19:12:24 | access to local variable sink27 | provenance | | +| Capture.cs:11:26:11:32 | access to parameter tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | | +| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | Capture.cs:11:26:11:32 | access to parameter tainted : String | provenance | | +| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | | | Capture.cs:20:21:20:26 | access to local variable sink28 : String | Capture.cs:21:23:21:28 | access to local variable sink28 | provenance | | +| Capture.cs:20:30:20:36 | access to parameter tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | | +| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | Capture.cs:20:30:20:36 | access to parameter tainted : String | provenance | | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | provenance | | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | | +| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | | | Capture.cs:29:17:29:22 | access to local variable sink29 : String | Capture.cs:30:19:30:24 | access to local variable sink29 | provenance | | -| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:57:27:57:32 | access to parameter sink39 | provenance | | +| Capture.cs:29:26:29:32 | access to parameter tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | | +| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | provenance | | | Capture.cs:61:36:61:42 | access to parameter tainted : String | Capture.cs:50:50:50:55 | sink39 : String | provenance | | -| Capture.cs:69:13:69:18 | access to local variable sink30 : String | Capture.cs:72:15:72:20 | access to local variable sink30 | provenance | | -| Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:69:13:69:18 | access to local variable sink30 : String | provenance | | -| Capture.cs:79:17:79:22 | access to local variable sink31 : String | Capture.cs:84:15:84:20 | access to local variable sink31 | provenance | | -| Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:79:17:79:22 | access to local variable sink31 : String | provenance | | -| Capture.cs:89:13:89:18 | access to local variable sink32 : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | -| Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:89:13:89:18 | access to local variable sink32 : String | provenance | | -| Capture.cs:116:17:116:22 | access to local variable sink40 : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | -| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:116:17:116:22 | access to local variable sink40 : String | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | +| Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | provenance | | +| Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | Capture.cs:72:15:72:20 | access to local variable sink30 | provenance | | +| Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | provenance | | +| Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | provenance | | +| Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | Capture.cs:84:15:84:20 | access to local variable sink31 | provenance | | +| Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | provenance | | +| Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | +| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | provenance | | +| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | provenance | | +| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | | | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | | | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | | +| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | +| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | provenance | | +| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | +| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | provenance | | +| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | | +| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | | | Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | | +| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | | -| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | -| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | +| Capture.cs:166:37:166:37 | p : String | Capture.cs:168:22:168:22 | access to parameter p : String | provenance | | +| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | | +| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | | +| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | | Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | | | Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | | -| Capture.cs:202:20:202:20 | s : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | provenance | | +| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | | -| Capture.cs:228:13:228:13 | access to local variable x : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | -| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:228:13:228:13 | access to local variable x : String | provenance | | -| Capture.cs:232:13:232:13 | access to local variable x : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | -| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:232:13:232:13 | access to local variable x : String | provenance | | +| Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | provenance | | +| Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | Capture.cs:217:19:217:19 | access to parameter s | provenance | | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | provenance | | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | provenance | | +| Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | provenance | | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | +| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | provenance | | | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | Capture.cs:246:19:246:25 | access to field Field | provenance | | +| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | | | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | | +| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:264:23:264:36 | "taint source" : String | Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | Capture.cs:268:15:268:21 | access to field Field | provenance | | | Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | | | Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:353:45:353:45 | x : String | provenance | | -| Capture.cs:278:13:278:13 | access to local variable x : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | -| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:278:13:278:13 | access to local variable x : String | provenance | | -| Capture.cs:285:17:285:17 | access to local variable x : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | -| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:285:17:285:17 | access to local variable x : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | provenance | | | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | Capture.cs:301:19:301:28 | access to field Field | provenance | | +| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | | | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | | -| Capture.cs:311:13:311:13 | access to local variable x : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | -| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:311:13:311:13 | access to local variable x : String | provenance | | -| Capture.cs:318:13:318:13 | access to local variable x : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | -| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:318:13:318:13 | access to local variable x : String | provenance | | -| Capture.cs:337:13:337:13 | access to local variable x : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | -| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:337:13:337:13 | access to local variable x : String | provenance | | +| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | +| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | +| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | provenance | | +| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | | +| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | | +| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | Capture.cs:217:19:217:19 | access to parameter s | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | Capture.cs:57:27:57:32 | access to parameter sink39 | provenance | | | Capture.cs:353:45:353:45 | x : String | Capture.cs:355:11:355:11 | access to parameter x : String | provenance | | | Capture.cs:355:11:355:11 | access to parameter x : String | Capture.cs:273:19:273:19 | x : String | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | provenance | | @@ -407,77 +514,168 @@ edges | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:48:13:48:13 | access to local variable s : String | provenance | | nodes | Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String | +| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | semmle.label | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | | Capture.cs:11:17:11:22 | access to local variable sink27 : String | semmle.label | access to local variable sink27 : String | +| Capture.cs:11:26:11:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 | +| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | semmle.label | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | +| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | semmle.label | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | +| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | semmle.label | M(...) : M [captured tainted] : String | | Capture.cs:20:21:20:26 | access to local variable sink28 : String | semmle.label | access to local variable sink28 : String | +| Capture.cs:20:30:20:36 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:21:23:21:28 | access to local variable sink28 | semmle.label | access to local variable sink28 | +| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | semmle.label | access to local function M : M [captured tainted] : String | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | semmle.label | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | +| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String | +| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String | | Capture.cs:29:17:29:22 | access to local variable sink29 : String | semmle.label | access to local variable sink29 : String | +| Capture.cs:29:26:29:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:30:19:30:24 | access to local variable sink29 | semmle.label | access to local variable sink29 | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | semmle.label | access to local variable captureIn3 : Func [captured tainted] : String | | Capture.cs:50:50:50:55 | sink39 : String | semmle.label | sink39 : String | +| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String | +| Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String | | Capture.cs:57:27:57:32 | access to parameter sink39 | semmle.label | access to parameter sink39 | | Capture.cs:61:36:61:42 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:69:13:69:18 | access to local variable sink30 : String | semmle.label | access to local variable sink30 : String | | Capture.cs:69:22:69:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | semmle.label | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | | Capture.cs:72:15:72:20 | access to local variable sink30 | semmle.label | access to local variable sink30 | -| Capture.cs:79:17:79:22 | access to local variable sink31 : String | semmle.label | access to local variable sink31 : String | | Capture.cs:79:26:79:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | semmle.label | [post] access to local function M : M [captured sink31] : String | +| Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | semmle.label | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | | Capture.cs:84:15:84:20 | access to local variable sink31 | semmle.label | access to local variable sink31 | -| Capture.cs:89:13:89:18 | access to local variable sink32 : String | semmle.label | access to local variable sink32 : String | | Capture.cs:89:22:89:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | semmle.label | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | | Capture.cs:93:15:93:20 | access to local variable sink32 | semmle.label | access to local variable sink32 | -| Capture.cs:116:17:116:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | +| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | semmle.label | [post] (...) => ... : (...) => ... [captured sink40] : String | | Capture.cs:116:26:116:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | semmle.label | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | | Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | | Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String | +| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | semmle.label | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | +| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | semmle.label | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | +| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | semmle.label | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | | Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | +| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | semmle.label | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | +| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | semmle.label | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | +| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | semmle.label | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | | Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | +| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | +| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String | +| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | semmle.label | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | semmle.label | access to local variable captureThrough3 : Func [captured tainted] : String | | Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | +| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | semmle.label | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | | Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | +| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | semmle.label | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | | Capture.cs:163:15:163:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | +| Capture.cs:166:37:166:37 | p : String | semmle.label | p : String | +| Capture.cs:168:22:168:22 | access to parameter p : String | semmle.label | access to parameter p : String | +| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | semmle.label | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | | Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | | Capture.cs:190:26:190:26 | s : String | semmle.label | s : String | +| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | semmle.label | M(...) : M [captured s] : String | +| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | semmle.label | access to local function M : M [captured s] : String | | Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String | | Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | | Capture.cs:196:22:196:32 | call to local function Id : String | semmle.label | call to local function Id : String | | Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | | Capture.cs:202:20:202:20 | s : String | semmle.label | s : String | +| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String | +| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String | | Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String | +| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | semmle.label | access to local variable a : Action [captured s] : String | | Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:228:13:228:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:213:22:213:22 | s : String | semmle.label | s : String | +| Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String | +| Capture.cs:217:19:217:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | semmle.label | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:221:21:221:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | semmle.label | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:223:31:223:44 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:228:17:228:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | +| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | semmle.label | [post] (...) => ... : (...) => ... [captured x] : String | | Capture.cs:231:19:231:19 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:232:13:232:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:232:17:232:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x | | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | | Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured c, field Field] : String | +| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:246:19:246:25 | access to field Field | semmle.label | access to field Field | +| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:247:23:247:36 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | semmle.label | access to local variable a : Action [captured c, field Field] : String | | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | | Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field | +| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:264:23:264:36 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:268:15:268:21 | access to field Field | semmle.label | access to field Field | | Capture.cs:273:19:273:19 | x : String | semmle.label | x : String | | Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x | | Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:278:13:278:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | +| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | | Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:285:17:285:17 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | semmle.label | [post] access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | semmle.label | access to local variable inner : Action [captured x] : String | +| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | semmle.label | [post] access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | semmle.label | access to local variable middle : Action [captured x] : String | | Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x | | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | | Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | +| Capture.cs:301:19:301:28 | access to field Field | semmle.label | access to field Field | +| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | +| Capture.cs:302:26:302:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | semmle.label | access to local variable a : Action [captured this in M10, field Field] : String | | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | | Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field | -| Capture.cs:311:13:311:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:311:17:311:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:312:15:312:15 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:318:13:318:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:337:13:337:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:328:17:328:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | semmle.label | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | +| Capture.cs:330:47:330:47 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | | Capture.cs:337:17:337:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | | Capture.cs:339:45:339:45 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | semmle.label | access to local variable capturedLambda : (...) => ... [captured x] : String | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | semmle.label | a : (...) => ... [captured s] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String | +| Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | semmle.label | [post] access to parameter a : (...) => ... [captured sink40] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | semmle.label | access to parameter a : (...) => ... [captured s] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | semmle.label | access to parameter a : (...) => ... [captured sink39] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | semmle.label | access to parameter a : (...) => ... [captured sink39] : String | | Capture.cs:353:45:353:45 | x : String | semmle.label | x : String | | Capture.cs:355:11:355:11 | access to parameter x : String | semmle.label | access to parameter x : String | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | semmle.label | access to field SinkField0 : String | @@ -783,7 +981,10 @@ nodes | Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s | | Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s | subpaths +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | Capture.cs:168:22:168:22 | access to parameter p : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | Capture.cs:196:22:196:32 | call to local function Id : String | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:71:21:71:46 | call to method Return : String | | GlobalDataFlow.cs:73:94:73:98 | access to local variable sink0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke : String | | GlobalDataFlow.cs:76:19:76:23 | access to local variable sink1 : String | GlobalDataFlow.cs:304:32:304:32 | x : String | GlobalDataFlow.cs:306:9:306:9 | access to parameter y : String | GlobalDataFlow.cs:76:30:76:34 | access to local variable sink2 : String | @@ -808,8 +1009,13 @@ subpaths | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | [b (line 24): true] access to local variable x | | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x | | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x | +| Capture.cs:246:19:246:25 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:246:19:246:25 | access to field Field | access to field Field | | Capture.cs:251:15:251:21 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:251:15:251:21 | access to field Field | Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:268:15:268:21 | access to field Field | Capture.cs:264:23:264:36 | "taint source" : String | Capture.cs:268:15:268:21 | access to field Field | access to field Field | +| Capture.cs:301:19:301:28 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:301:19:301:28 | access to field Field | access to field Field | | Capture.cs:306:15:306:24 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | +| Capture.cs:306:15:306:24 | access to field Field | Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | access to field SinkField0 | | GlobalDataFlow.cs:491:15:491:22 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:491:15:491:22 | access to field field | access to field field | | GlobalDataFlow.cs:492:15:492:22 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:492:15:492:22 | access to field field | access to field field | @@ -867,15 +1073,20 @@ subpaths | GlobalDataFlow.cs:164:15:164:19 | access to local variable sink8 | GlobalDataFlow.cs:351:13:351:26 | "taint source" : String | GlobalDataFlow.cs:164:15:164:19 | access to local variable sink8 | access to local variable sink8 | | GlobalDataFlow.cs:185:15:185:19 | access to local variable sink9 | GlobalDataFlow.cs:183:35:183:48 | "taint source" : String | GlobalDataFlow.cs:185:15:185:19 | access to local variable sink9 | access to local variable sink9 | | Capture.cs:231:19:231:19 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:231:19:231:19 | access to local variable x | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | | Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | | Capture.cs:284:23:284:23 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:284:23:284:23 | access to local variable x | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | | Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | | Capture.cs:312:15:312:15 | access to local variable x | Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | access to local variable x | | Capture.cs:319:19:319:19 | access to local variable x | Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | access to local variable x | +| Capture.cs:330:47:330:47 | access to local variable x | Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:47:330:47 | access to local variable x | access to local variable x | | Capture.cs:339:45:339:45 | access to local variable x | Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:45:339:45 | access to local variable x | access to local variable x | | Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x | | Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x | | Capture.cs:206:19:206:19 | access to parameter s | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:206:19:206:19 | access to parameter s | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:217:19:217:19 | access to parameter s | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:217:19:217:19 | access to parameter s | access to parameter s | | GlobalDataFlow.cs:469:32:469:32 | access to parameter s | GlobalDataFlow.cs:473:28:473:41 | "taint source" : String | GlobalDataFlow.cs:469:32:469:32 | access to parameter s | access to parameter s | | Capture.cs:57:27:57:32 | access to parameter sink39 | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:57:27:57:32 | access to parameter sink39 | access to parameter sink39 | | GlobalDataFlow.cs:260:15:260:24 | access to parameter sinkParam0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:260:15:260:24 | access to parameter sinkParam0 | access to parameter sinkParam0 | diff --git a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected index 76416668e22f..ff1e94029b49 100644 --- a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected +++ b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected @@ -1,30 +1,20 @@ +| Capture.cs:5:7:5:13 | call to constructor Object | normal | Capture.cs:5:7:5:13 | call to constructor Object | | Capture.cs:33:9:33:40 | call to method Select | normal | Capture.cs:33:9:33:40 | call to method Select | | Capture.cs:33:9:33:50 | call to method ToArray | normal | Capture.cs:33:9:33:50 | call to method ToArray | -| Capture.cs:71:9:71:21 | call to local function CaptureOut1 | captured sink30 | Capture.cs:71:9:71:21 | SSA call def(sink30) | -| Capture.cs:83:9:83:21 | [transitive] call to local function CaptureOut2 | captured sink31 | Capture.cs:83:9:83:21 | SSA call def(sink31) | -| Capture.cs:92:9:92:41 | [transitive] call to method Select | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) | | Capture.cs:92:9:92:41 | call to method Select | normal | Capture.cs:92:9:92:41 | call to method Select | | Capture.cs:92:9:92:51 | call to method ToArray | normal | Capture.cs:92:9:92:51 | call to method ToArray | -| Capture.cs:123:9:123:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:123:9:123:35 | SSA call def(nonSink0) | -| Capture.cs:123:9:123:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:123:9:123:35 | SSA call def(sink40) | -| Capture.cs:134:9:134:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:134:9:134:25 | SSA call def(sink33) | -| Capture.cs:146:9:146:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:146:9:146:25 | SSA call def(sink34) | -| Capture.cs:155:9:155:45 | [transitive] call to method Select | captured sink35 | Capture.cs:155:9:155:45 | SSA call def(sink35) | | Capture.cs:155:9:155:45 | call to method Select | normal | Capture.cs:155:9:155:45 | call to method Select | | Capture.cs:155:9:155:55 | call to method ToArray | normal | Capture.cs:155:9:155:55 | call to method ToArray | | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 | normal | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 | -| Capture.cs:170:9:170:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:170:9:170:32 | SSA call def(sink37) | | Capture.cs:193:20:193:22 | call to local function M | normal | Capture.cs:193:20:193:22 | call to local function M | | Capture.cs:196:22:196:32 | call to local function Id | normal | Capture.cs:196:22:196:32 | call to local function Id | | Capture.cs:198:20:198:25 | call to local function Id | normal | Capture.cs:198:20:198:25 | call to local function Id | | Capture.cs:221:18:221:35 | call to method M3 | normal | Capture.cs:221:18:221:35 | call to method M3 | | Capture.cs:223:28:223:45 | call to method M3 | normal | Capture.cs:223:28:223:45 | call to method M3 | | Capture.cs:227:24:227:48 | object creation of type List | normal | Capture.cs:227:24:227:48 | object creation of type List | -| Capture.cs:229:9:233:10 | [transitive] call to method ForEach | captured x | Capture.cs:229:9:233:10 | SSA call def(x) | | Capture.cs:241:17:241:29 | object creation of type Capture | normal | Capture.cs:241:17:241:29 | object creation of type Capture | | Capture.cs:256:17:256:29 | object creation of type Capture | normal | Capture.cs:256:17:256:29 | object creation of type Capture | -| Capture.cs:290:9:290:16 | [transitive] delegate call | captured x | Capture.cs:290:9:290:16 | SSA call def(x) | -| Capture.cs:323:9:323:11 | delegate call | captured x | Capture.cs:323:9:323:11 | SSA call def(x) | +| GlobalDataFlow.cs:13:14:13:21 | call to constructor Object | normal | GlobalDataFlow.cs:13:14:13:21 | call to constructor Object | | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | normal | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | @@ -155,17 +145,20 @@ | GlobalDataFlow.cs:249:24:249:34 | access to property Result | normal | GlobalDataFlow.cs:249:24:249:34 | access to property Result | | GlobalDataFlow.cs:300:17:300:38 | call to method ApplyFunc | normal | GlobalDataFlow.cs:300:17:300:38 | call to method ApplyFunc | | GlobalDataFlow.cs:389:16:389:19 | delegate call | normal | GlobalDataFlow.cs:389:16:389:19 | delegate call | +| GlobalDataFlow.cs:415:11:415:14 | call to constructor Object | normal | GlobalDataFlow.cs:415:11:415:14 | call to constructor Object | | GlobalDataFlow.cs:448:22:448:65 | call to method Join | normal | GlobalDataFlow.cs:448:22:448:65 | call to method Join | | GlobalDataFlow.cs:451:23:451:65 | call to method Join | normal | GlobalDataFlow.cs:451:23:451:65 | call to method Join | | GlobalDataFlow.cs:457:20:457:49 | call to method Run | normal | GlobalDataFlow.cs:457:20:457:49 | call to method Run | | GlobalDataFlow.cs:458:25:458:50 | call to method ConfigureAwait | normal | GlobalDataFlow.cs:458:25:458:50 | call to method ConfigureAwait | | GlobalDataFlow.cs:459:23:459:44 | call to method GetAwaiter | normal | GlobalDataFlow.cs:459:23:459:44 | call to method GetAwaiter | | GlobalDataFlow.cs:460:22:460:40 | call to method GetResult | normal | GlobalDataFlow.cs:460:22:460:40 | call to method GetResult | +| GlobalDataFlow.cs:476:18:476:28 | call to constructor Object | normal | GlobalDataFlow.cs:476:18:476:28 | call to constructor Object | | GlobalDataFlow.cs:488:18:488:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:488:18:488:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:489:18:489:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:489:18:489:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:494:18:494:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:494:18:494:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:495:18:495:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:495:18:495:34 | object creation of type SimpleClass | | GlobalDataFlow.cs:496:18:496:34 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:496:18:496:34 | object creation of type SimpleClass | +| GlobalDataFlow.cs:503:19:503:32 | call to constructor SimpleClass | normal | GlobalDataFlow.cs:503:19:503:32 | call to constructor SimpleClass | | GlobalDataFlow.cs:507:17:507:36 | object creation of type SubSimpleClass | normal | GlobalDataFlow.cs:507:17:507:36 | object creation of type SubSimpleClass | | GlobalDataFlow.cs:514:17:514:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:514:17:514:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:522:17:522:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:522:17:522:33 | object creation of type SimpleClass | @@ -173,6 +166,7 @@ | GlobalDataFlow.cs:524:17:524:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:524:17:524:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass | | GlobalDataFlow.cs:558:44:558:47 | delegate call | normal | GlobalDataFlow.cs:558:44:558:47 | delegate call | +| GlobalDataFlowStringBuilder.cs:13:14:13:34 | call to constructor Object | normal | GlobalDataFlowStringBuilder.cs:13:14:13:34 | call to constructor Object | | GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append | | GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append | | GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder | @@ -186,6 +180,7 @@ | GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear | normal | GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear | | GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString | | GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString | +| Splitting.cs:1:7:1:15 | call to constructor Object | normal | Splitting.cs:1:7:1:15 | call to constructor Object | | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | | Splitting.cs:20:22:20:30 | call to method Return | normal | Splitting.cs:20:22:20:30 | call to method Return | diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected index a17520910aff..61ffecc4760f 100644 --- a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected +++ b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected @@ -13,15 +13,20 @@ | Capture.cs:171:15:171:20 | access to local variable sink37 | | Capture.cs:197:15:197:20 | access to local variable sink38 | | Capture.cs:206:19:206:19 | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | | Capture.cs:231:19:231:19 | access to local variable x | | Capture.cs:234:15:234:15 | access to local variable x | +| Capture.cs:246:19:246:25 | access to field Field | | Capture.cs:251:15:251:21 | access to field Field | +| Capture.cs:268:15:268:21 | access to field Field | | Capture.cs:273:30:273:30 | access to parameter x | | Capture.cs:284:23:284:23 | access to local variable x | | Capture.cs:292:15:292:15 | access to local variable x | +| Capture.cs:301:19:301:28 | access to field Field | | Capture.cs:306:15:306:24 | access to field Field | | Capture.cs:312:15:312:15 | access to local variable x | | Capture.cs:319:19:319:19 | access to local variable x | +| Capture.cs:330:47:330:47 | access to local variable x | | Capture.cs:339:45:339:45 | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected index 42883e2b5331..9ccbaf825177 100644 --- a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected +++ b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected @@ -1,59 +1,166 @@ edges -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | | -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | | -| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | provenance | | | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:61:36:61:42 | access to parameter tainted : String | provenance | | +| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | | | Capture.cs:11:17:11:22 | access to local variable sink27 : String | Capture.cs:12:19:12:24 | access to local variable sink27 | provenance | | +| Capture.cs:11:26:11:32 | access to parameter tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | | +| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | Capture.cs:11:26:11:32 | access to parameter tainted : String | provenance | | +| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | | +| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | | | Capture.cs:20:21:20:26 | access to local variable sink28 : String | Capture.cs:21:23:21:28 | access to local variable sink28 | provenance | | +| Capture.cs:20:30:20:36 | access to parameter tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | | +| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | Capture.cs:20:30:20:36 | access to parameter tainted : String | provenance | | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | provenance | | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | | +| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | | | Capture.cs:29:17:29:22 | access to local variable sink29 : String | Capture.cs:30:19:30:24 | access to local variable sink29 | provenance | | -| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:57:27:57:32 | access to parameter sink39 | provenance | | +| Capture.cs:29:26:29:32 | access to parameter tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | | +| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | provenance | | | Capture.cs:61:36:61:42 | access to parameter tainted : String | Capture.cs:50:50:50:55 | sink39 : String | provenance | | -| Capture.cs:69:13:69:18 | access to local variable sink30 : String | Capture.cs:72:15:72:20 | access to local variable sink30 | provenance | | -| Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:69:13:69:18 | access to local variable sink30 : String | provenance | | -| Capture.cs:79:17:79:22 | access to local variable sink31 : String | Capture.cs:84:15:84:20 | access to local variable sink31 | provenance | | -| Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:79:17:79:22 | access to local variable sink31 : String | provenance | | -| Capture.cs:89:13:89:18 | access to local variable sink32 : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | -| Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:89:13:89:18 | access to local variable sink32 : String | provenance | | -| Capture.cs:116:17:116:22 | access to local variable sink40 : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | -| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:116:17:116:22 | access to local variable sink40 : String | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | -| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | +| Capture.cs:69:22:69:35 | "taint source" : String | Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | provenance | | +| Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | Capture.cs:72:15:72:20 | access to local variable sink30 | provenance | | +| Capture.cs:79:26:79:39 | "taint source" : String | Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | provenance | | +| Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | provenance | | +| Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | Capture.cs:84:15:84:20 | access to local variable sink31 | provenance | | +| Capture.cs:89:22:89:35 | "taint source" : String | Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | provenance | | +| Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | Capture.cs:93:15:93:20 | access to local variable sink32 | provenance | | +| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | provenance | | +| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | provenance | | +| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | provenance | | +| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | | | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | | | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | | +| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | | +| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | | +| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | provenance | | +| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | | +| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | | +| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | provenance | | +| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | | +| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | | +| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | | | Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | | +| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | | | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | | -| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | -| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | +| Capture.cs:166:37:166:37 | p : String | Capture.cs:168:22:168:22 | access to parameter p : String | provenance | | +| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | provenance | | +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | provenance | | +| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | | +| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | | +| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | | | Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | | | Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | | -| Capture.cs:202:20:202:20 | s : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | provenance | | +| Capture.cs:202:20:202:20 | s : String | Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | provenance | | +| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | +| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | | | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | | -| Capture.cs:228:13:228:13 | access to local variable x : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | -| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:228:13:228:13 | access to local variable x : String | provenance | | -| Capture.cs:232:13:232:13 | access to local variable x : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | -| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:232:13:232:13 | access to local variable x : String | provenance | | +| Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | provenance | | +| Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | Capture.cs:217:19:217:19 | access to parameter s | provenance | | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | provenance | | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | provenance | | +| Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | provenance | | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | | +| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | | +| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | provenance | | | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | Capture.cs:246:19:246:25 | access to field Field | provenance | | +| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | | | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | | +| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | | +| Capture.cs:264:23:264:36 | "taint source" : String | Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | provenance | | +| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | Capture.cs:268:15:268:21 | access to field Field | provenance | | | Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | | | Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:353:45:353:45 | x : String | provenance | | -| Capture.cs:278:13:278:13 | access to local variable x : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | -| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:278:13:278:13 | access to local variable x : String | provenance | | -| Capture.cs:285:17:285:17 | access to local variable x : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | -| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:285:17:285:17 | access to local variable x : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | provenance | | +| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | provenance | | +| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | provenance | | +| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | | +| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | provenance | | | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | Capture.cs:301:19:301:28 | access to field Field | provenance | | +| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | | +| Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | | +| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | | | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | | -| Capture.cs:311:13:311:13 | access to local variable x : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | -| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:311:13:311:13 | access to local variable x : String | provenance | | -| Capture.cs:318:13:318:13 | access to local variable x : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | -| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:318:13:318:13 | access to local variable x : String | provenance | | -| Capture.cs:337:13:337:13 | access to local variable x : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | -| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:337:13:337:13 | access to local variable x : String | provenance | | +| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | | +| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | | +| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | provenance | | +| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | | +| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | | +| Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | provenance | | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | | +| Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | Capture.cs:339:45:339:45 | access to local variable x | provenance | | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | Capture.cs:217:19:217:19 | access to parameter s | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | provenance | | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | Capture.cs:57:27:57:32 | access to parameter sink39 | provenance | | | Capture.cs:353:45:353:45 | x : String | Capture.cs:355:11:355:11 | access to parameter x : String | provenance | | | Capture.cs:355:11:355:11 | access to parameter x : String | Capture.cs:273:19:273:19 | x : String | provenance | | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | provenance | | @@ -457,77 +564,168 @@ edges | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:48:13:48:13 | access to local variable s : String | provenance | | nodes | Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String | +| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | semmle.label | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | | Capture.cs:11:17:11:22 | access to local variable sink27 : String | semmle.label | access to local variable sink27 : String | +| Capture.cs:11:26:11:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 | +| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | semmle.label | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | +| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | semmle.label | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | +| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | semmle.label | M(...) : M [captured tainted] : String | | Capture.cs:20:21:20:26 | access to local variable sink28 : String | semmle.label | access to local variable sink28 : String | +| Capture.cs:20:30:20:36 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:21:23:21:28 | access to local variable sink28 | semmle.label | access to local variable sink28 | +| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | semmle.label | access to local function M : M [captured tainted] : String | +| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | semmle.label | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | +| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String | +| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String | | Capture.cs:29:17:29:22 | access to local variable sink29 : String | semmle.label | access to local variable sink29 : String | +| Capture.cs:29:26:29:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:30:19:30:24 | access to local variable sink29 | semmle.label | access to local variable sink29 | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String | +| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | semmle.label | access to local variable captureIn3 : Func [captured tainted] : String | | Capture.cs:50:50:50:55 | sink39 : String | semmle.label | sink39 : String | +| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String | +| Capture.cs:55:27:58:17 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String | | Capture.cs:57:27:57:32 | access to parameter sink39 | semmle.label | access to parameter sink39 | | Capture.cs:61:36:61:42 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | -| Capture.cs:69:13:69:18 | access to local variable sink30 : String | semmle.label | access to local variable sink30 : String | | Capture.cs:69:22:69:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:71:9:71:19 | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | semmle.label | [post] access to local function CaptureOut1 : CaptureOut1 [captured sink30] : String | | Capture.cs:72:15:72:20 | access to local variable sink30 | semmle.label | access to local variable sink30 | -| Capture.cs:79:17:79:22 | access to local variable sink31 : String | semmle.label | access to local variable sink31 : String | | Capture.cs:79:26:79:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:81:13:81:13 | [post] access to local function M : M [captured sink31] : String | semmle.label | [post] access to local function M : M [captured sink31] : String | +| Capture.cs:83:9:83:19 | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | semmle.label | [post] access to local function CaptureOut2 : CaptureOut2 [captured sink31] : String | | Capture.cs:84:15:84:20 | access to local variable sink31 | semmle.label | access to local variable sink31 | -| Capture.cs:89:13:89:18 | access to local variable sink32 : String | semmle.label | access to local variable sink32 : String | | Capture.cs:89:22:89:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:92:30:92:40 | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | semmle.label | [post] access to local variable captureOut3 : (...) => ... [captured sink32] : String | | Capture.cs:93:15:93:20 | access to local variable sink32 | semmle.label | access to local variable sink32 | -| Capture.cs:116:17:116:22 | access to local variable sink40 : String | semmle.label | access to local variable sink40 : String | +| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | semmle.label | [post] (...) => ... : (...) => ... [captured sink40] : String | | Capture.cs:116:26:116:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | semmle.label | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | | Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 | | Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String | +| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | semmle.label | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | +| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | semmle.label | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | +| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | semmle.label | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | | Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 | +| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | semmle.label | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | +| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | semmle.label | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | +| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | semmle.label | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | | Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 | +| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | +| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String | +| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | semmle.label | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | +| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | semmle.label | access to local variable captureThrough3 : Func [captured tainted] : String | | Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 | +| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | semmle.label | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | | Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String | +| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | semmle.label | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String | | Capture.cs:163:15:163:20 | access to local variable sink36 | semmle.label | access to local variable sink36 | +| Capture.cs:166:37:166:37 | p : String | semmle.label | p : String | +| Capture.cs:168:22:168:22 | access to parameter p : String | semmle.label | access to parameter p : String | +| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | semmle.label | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | | Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 | | Capture.cs:190:26:190:26 | s : String | semmle.label | s : String | +| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | semmle.label | M(...) : M [captured s] : String | +| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | semmle.label | access to local function M : M [captured s] : String | | Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String | | Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String | | Capture.cs:196:22:196:32 | call to local function Id : String | semmle.label | call to local function Id : String | | Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String | | Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 | | Capture.cs:202:20:202:20 | s : String | semmle.label | s : String | +| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String | +| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String | | Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String | +| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | semmle.label | access to local variable a : Action [captured s] : String | | Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:228:13:228:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:213:22:213:22 | s : String | semmle.label | s : String | +| Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String | +| Capture.cs:217:19:217:19 | access to parameter s | semmle.label | access to parameter s | +| Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | semmle.label | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:221:21:221:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | semmle.label | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:223:31:223:44 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:228:17:228:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | +| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | semmle.label | [post] (...) => ... : (...) => ... [captured x] : String | | Capture.cs:231:19:231:19 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:232:13:232:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:232:17:232:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x | | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | | Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured c, field Field] : String | +| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:246:19:246:25 | access to field Field | semmle.label | access to field Field | +| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:247:23:247:36 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | semmle.label | access to local variable a : Action [captured c, field Field] : String | | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | | Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field | +| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String | +| Capture.cs:264:23:264:36 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String | +| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String | +| Capture.cs:268:15:268:21 | access to field Field | semmle.label | access to field Field | | Capture.cs:273:19:273:19 | x : String | semmle.label | x : String | | Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x | | Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String | -| Capture.cs:278:13:278:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | +| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | | Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:285:17:285:17 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | semmle.label | [post] access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String | +| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | semmle.label | access to local variable inner : Action [captured x] : String | +| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | semmle.label | [post] access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String | +| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | semmle.label | access to local variable middle : Action [captured x] : String | | Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x | | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | | Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | +| Capture.cs:301:19:301:28 | access to field Field | semmle.label | access to field Field | +| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String | +| Capture.cs:302:26:302:39 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String | +| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | semmle.label | access to local variable a : Action [captured this in M10, field Field] : String | | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String | | Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field | -| Capture.cs:311:13:311:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:311:17:311:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:312:15:312:15 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:318:13:318:13 | access to local variable x : String | semmle.label | access to local variable x : String | | Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String | | Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x | -| Capture.cs:337:13:337:13 | access to local variable x : String | semmle.label | access to local variable x : String | +| Capture.cs:328:17:328:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | semmle.label | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | +| Capture.cs:330:47:330:47 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | | Capture.cs:337:17:337:30 | "taint source" : String | semmle.label | "taint source" : String | +| Capture.cs:339:33:339:46 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String | | Capture.cs:339:45:339:45 | access to local variable x | semmle.label | access to local variable x | +| Capture.cs:341:16:341:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:341:34:341:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:341:40:341:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | semmle.label | access to local variable capturedLambda : (...) => ... [captured x] : String | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | +| Capture.cs:343:9:343:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured s] : String | semmle.label | a : (...) => ... [captured s] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String | +| Capture.cs:348:34:348:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String | +| Capture.cs:350:9:350:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | semmle.label | [post] access to parameter a : (...) => ... [captured sink40] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured s] : String | semmle.label | access to parameter a : (...) => ... [captured s] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | semmle.label | access to parameter a : (...) => ... [captured sink39] : String | +| Capture.cs:350:9:350:9 | access to parameter a : (...) => ... [captured sink39] : String | semmle.label | access to parameter a : (...) => ... [captured sink39] : String | | Capture.cs:353:45:353:45 | x : String | semmle.label | x : String | | Capture.cs:355:11:355:11 | access to parameter x : String | semmle.label | access to parameter x : String | | GlobalDataFlow.cs:18:9:18:23 | access to field SinkField0 : String | semmle.label | access to field SinkField0 : String | @@ -886,7 +1084,10 @@ nodes | Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s | | Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s | subpaths +| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | Capture.cs:168:22:168:22 | access to parameter p : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | | Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:22 | call to local function M : String | Capture.cs:196:22:196:32 | call to local function Id : String | +| Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:221:18:221:35 | call to method M3 : (...) => ... [captured s] : String | +| Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:223:28:223:45 | call to method M3 : (...) => ... [captured s] : String | | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:71:21:71:46 | call to method Return : String | | GlobalDataFlow.cs:73:94:73:98 | access to local variable sink0 : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke : String | | GlobalDataFlow.cs:76:19:76:23 | access to local variable sink1 : String | GlobalDataFlow.cs:304:32:304:32 | x : String | GlobalDataFlow.cs:306:9:306:9 | access to parameter y : String | GlobalDataFlow.cs:76:30:76:34 | access to local variable sink2 : String | @@ -924,15 +1125,25 @@ subpaths | Capture.cs:171:15:171:20 | access to local variable sink37 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:171:15:171:20 | access to local variable sink37 | access to local variable sink37 | | Capture.cs:197:15:197:20 | access to local variable sink38 | Capture.cs:127:25:127:31 | tainted : String | Capture.cs:197:15:197:20 | access to local variable sink38 | access to local variable sink38 | | Capture.cs:206:19:206:19 | access to parameter s | Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:206:19:206:19 | access to parameter s | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | Capture.cs:221:21:221:34 | "taint source" : String | Capture.cs:217:19:217:19 | access to parameter s | access to parameter s | +| Capture.cs:217:19:217:19 | access to parameter s | Capture.cs:223:31:223:44 | "taint source" : String | Capture.cs:217:19:217:19 | access to parameter s | access to parameter s | | Capture.cs:231:19:231:19 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:231:19:231:19 | access to local variable x | access to local variable x | +| Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:228:17:228:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | | Capture.cs:234:15:234:15 | access to local variable x | Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:234:15:234:15 | access to local variable x | access to local variable x | +| Capture.cs:246:19:246:25 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:246:19:246:25 | access to field Field | access to field Field | | Capture.cs:251:15:251:21 | access to field Field | Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:251:15:251:21 | access to field Field | Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:251:15:251:21 | access to field Field | access to field Field | +| Capture.cs:268:15:268:21 | access to field Field | Capture.cs:264:23:264:36 | "taint source" : String | Capture.cs:268:15:268:21 | access to field Field | access to field Field | | Capture.cs:273:30:273:30 | access to parameter x | Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:273:30:273:30 | access to parameter x | access to parameter x | | Capture.cs:284:23:284:23 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:284:23:284:23 | access to local variable x | access to local variable x | +| Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | | Capture.cs:292:15:292:15 | access to local variable x | Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | access to local variable x | +| Capture.cs:301:19:301:28 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:301:19:301:28 | access to field Field | access to field Field | | Capture.cs:306:15:306:24 | access to field Field | Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | +| Capture.cs:306:15:306:24 | access to field Field | Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:306:15:306:24 | access to field Field | access to field Field | | Capture.cs:312:15:312:15 | access to local variable x | Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | access to local variable x | | Capture.cs:319:19:319:19 | access to local variable x | Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | access to local variable x | +| Capture.cs:330:47:330:47 | access to local variable x | Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:47:330:47 | access to local variable x | access to local variable x | | Capture.cs:339:45:339:45 | access to local variable x | Capture.cs:337:17:337:30 | "taint source" : String | Capture.cs:339:45:339:45 | access to local variable x | access to local variable x | | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | access to field SinkField0 | | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | access to property SinkProperty0 | diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected index 17838631b584..0e656151f08d 100644 --- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected +++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected @@ -1,31 +1,15 @@ | Capture.cs:5:17:5:17 | this | Capture.cs:13:9:13:14 | this access | -| Capture.cs:7:13:7:13 | access to local variable i | Capture.cs:7:13:7:17 | SSA def(i) | | Capture.cs:7:17:7:17 | 0 | Capture.cs:7:13:7:13 | access to local variable i | -| Capture.cs:9:9:12:9 | SSA capture def(i) | Capture.cs:11:17:11:17 | access to local variable i | | Capture.cs:13:9:13:14 | this access | Capture.cs:23:9:23:14 | this access | -| Capture.cs:15:9:22:9 | this | Capture.cs:21:13:21:18 | this access | -| Capture.cs:17:13:20:13 | SSA capture def(i) | Capture.cs:19:21:19:21 | access to local variable i | | Capture.cs:23:9:23:14 | this access | Capture.cs:34:9:34:14 | this access | -| Capture.cs:25:9:33:9 | this | Capture.cs:32:13:32:18 | this access | -| Capture.cs:27:13:30:13 | SSA capture def(i) | Capture.cs:29:21:29:21 | access to local variable i | -| Capture.cs:31:13:31:13 | access to local variable i | Capture.cs:31:13:31:17 | SSA def(i) | | Capture.cs:31:17:31:17 | 1 | Capture.cs:31:13:31:13 | access to local variable i | | Capture.cs:34:9:34:14 | this access | Capture.cs:40:9:40:15 | this access | -| Capture.cs:38:13:38:13 | access to local variable i | Capture.cs:38:13:38:17 | SSA def(i) | | Capture.cs:38:17:38:17 | 0 | Capture.cs:38:13:38:13 | access to local variable i | | Capture.cs:40:9:40:15 | this access | Capture.cs:51:9:51:15 | this access | -| Capture.cs:40:9:40:17 | SSA call def(i) | Capture.cs:41:13:41:13 | access to local variable i | -| Capture.cs:43:9:50:9 | this | Capture.cs:49:13:49:19 | this access | -| Capture.cs:47:17:47:17 | access to local variable i | Capture.cs:47:17:47:21 | SSA def(i) | | Capture.cs:47:21:47:21 | 0 | Capture.cs:47:17:47:17 | access to local variable i | | Capture.cs:51:9:51:15 | this access | Capture.cs:63:9:63:15 | this access | -| Capture.cs:51:9:51:17 | SSA call def(i) | Capture.cs:52:13:52:13 | access to local variable i | -| Capture.cs:54:9:62:9 | this | Capture.cs:60:13:60:19 | this access | -| Capture.cs:58:17:58:17 | access to local variable i | Capture.cs:58:17:58:21 | SSA def(i) | | Capture.cs:58:21:58:21 | 1 | Capture.cs:58:17:58:17 | access to local variable i | -| Capture.cs:61:13:61:13 | access to local variable i | Capture.cs:61:13:61:17 | SSA def(i) | | Capture.cs:61:17:61:17 | 1 | Capture.cs:61:13:61:13 | access to local variable i | -| Capture.cs:63:9:63:17 | SSA call def(i) | Capture.cs:64:13:64:13 | access to local variable i | | LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:84:21:84:21 | access to parameter b | | LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | LocalDataFlow.cs:52:15:52:19 | access to local variable sink0 | diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected index 6782695246ec..e1ea6fe13d9d 100644 --- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected +++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected @@ -1,31 +1,15 @@ | Capture.cs:5:17:5:17 | this | Capture.cs:13:9:13:14 | this access | -| Capture.cs:7:13:7:13 | access to local variable i | Capture.cs:7:13:7:17 | SSA def(i) | | Capture.cs:7:17:7:17 | 0 | Capture.cs:7:13:7:13 | access to local variable i | -| Capture.cs:9:9:12:9 | SSA capture def(i) | Capture.cs:11:17:11:17 | access to local variable i | | Capture.cs:13:9:13:14 | this access | Capture.cs:23:9:23:14 | this access | -| Capture.cs:15:9:22:9 | this | Capture.cs:21:13:21:18 | this access | -| Capture.cs:17:13:20:13 | SSA capture def(i) | Capture.cs:19:21:19:21 | access to local variable i | | Capture.cs:23:9:23:14 | this access | Capture.cs:34:9:34:14 | this access | -| Capture.cs:25:9:33:9 | this | Capture.cs:32:13:32:18 | this access | -| Capture.cs:27:13:30:13 | SSA capture def(i) | Capture.cs:29:21:29:21 | access to local variable i | -| Capture.cs:31:13:31:13 | access to local variable i | Capture.cs:31:13:31:17 | SSA def(i) | | Capture.cs:31:17:31:17 | 1 | Capture.cs:31:13:31:13 | access to local variable i | | Capture.cs:34:9:34:14 | this access | Capture.cs:40:9:40:15 | this access | -| Capture.cs:38:13:38:13 | access to local variable i | Capture.cs:38:13:38:17 | SSA def(i) | | Capture.cs:38:17:38:17 | 0 | Capture.cs:38:13:38:13 | access to local variable i | | Capture.cs:40:9:40:15 | this access | Capture.cs:51:9:51:15 | this access | -| Capture.cs:40:9:40:17 | SSA call def(i) | Capture.cs:41:13:41:13 | access to local variable i | -| Capture.cs:43:9:50:9 | this | Capture.cs:49:13:49:19 | this access | -| Capture.cs:47:17:47:17 | access to local variable i | Capture.cs:47:17:47:21 | SSA def(i) | | Capture.cs:47:21:47:21 | 0 | Capture.cs:47:17:47:17 | access to local variable i | | Capture.cs:51:9:51:15 | this access | Capture.cs:63:9:63:15 | this access | -| Capture.cs:51:9:51:17 | SSA call def(i) | Capture.cs:52:13:52:13 | access to local variable i | -| Capture.cs:54:9:62:9 | this | Capture.cs:60:13:60:19 | this access | -| Capture.cs:58:17:58:17 | access to local variable i | Capture.cs:58:17:58:21 | SSA def(i) | | Capture.cs:58:21:58:21 | 1 | Capture.cs:58:17:58:17 | access to local variable i | -| Capture.cs:61:13:61:13 | access to local variable i | Capture.cs:61:13:61:17 | SSA def(i) | | Capture.cs:61:17:61:17 | 1 | Capture.cs:61:13:61:13 | access to local variable i | -| Capture.cs:63:9:63:17 | SSA call def(i) | Capture.cs:64:13:64:13 | access to local variable i | | LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:84:21:84:21 | access to parameter b | | LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | LocalDataFlow.cs:52:15:52:19 | access to local variable sink0 | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected index 8cb169726035..05e1e3d3a5ce 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected @@ -1,12 +1,6 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | i | Capture.cs:8:17:8:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | ... = ... | Capture.cs:14:17:14:17 | access to parameter i | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | Int32 x = ... | Capture.cs:34:13:34:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | ... = ... | Capture.cs:16:17:16:17 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | ... = ... | Capture.cs:44:11:44:11 | access to local variable x | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | Action a = ... | Capture.cs:38:9:38:9 | access to local variable a | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | Int32 y = ... | Capture.cs:26:17:26:17 | access to local variable y | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | Action b = ... | Capture.cs:25:13:25:13 | access to local variable b | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | ... = ... | Capture.cs:41:13:41:13 | access to local variable z | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | Action c = ... | Capture.cs:32:9:32:9 | access to local variable c | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | Action b = ... | Capture.cs:53:9:53:9 | access to local variable b | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | strings | Capture.cs:61:9:61:15 | access to parameter strings | @@ -21,22 +15,15 @@ | Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | Expression> e = ... | Capture.cs:87:23:87:23 | access to local variable e | | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | d | Capture.cs:92:24:92:24 | access to parameter d | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | Int32 x = ... | Capture.cs:99:20:99:20 | access to local variable x | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | ... = ... | Capture.cs:106:20:106:20 | access to local variable z | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | Int32 x = ... | Capture.cs:118:17:118:17 | access to local variable x | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | ... = ... | Capture.cs:126:17:126:17 | access to local variable b | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | ... = ... | Capture.cs:134:17:134:17 | access to local variable c | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | Int32 f = ... | Capture.cs:155:13:155:13 | access to local variable f | | Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | MyEventHandler eh = ... | Capture.cs:199:27:199:28 | access to local variable eh | | Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | MyEventHandler eh2 = ... | Capture.cs:204:27:204:29 | access to local variable eh2 | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | Process p = ... | Capture.cs:213:17:213:17 | access to local variable p | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | EventHandler exited = ... | Capture.cs:213:29:213:34 | access to local variable exited | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | Int32 i = ... | Capture.cs:254:27:254:27 | access to local variable i | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | access to local variable i | Capture.cs:255:34:255:34 | access to local variable i | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | b | Consistency.cs:11:17:11:17 | access to parameter b | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | Int32 i = ... | Consistency.cs:16:17:16:17 | access to local variable i | | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | Consistency c | Consistency.cs:26:13:26:13 | access to local variable c | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | ... = ... | Consistency.cs:33:9:33:9 | access to parameter c | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | ... = ... | Consistency.cs:39:39:39:39 | access to local variable i | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | S s | Consistency.cs:45:9:45:9 | access to local variable s | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:47:49:47 | access to parameter a | | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:49:49:49 | access to parameter i | @@ -51,11 +38,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | Int32 z = ... | DefUse.cs:45:13:45:13 | access to local variable z | | DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | access to local variable z | DefUse.cs:48:13:48:13 | access to local variable z | | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | access to local variable z | DefUse.cs:51:13:51:13 | access to local variable z | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | Int32 i = ... | DefUse.cs:61:13:61:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | ... = ... | DefUse.cs:72:9:72:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | ...++ | DefUse.cs:73:13:73:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | ... = ... | DefUse.cs:76:9:76:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | ...-- | DefUse.cs:77:13:77:13 | access to local variable i | | DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | TestClass tc = ... | DefUse.cs:68:9:68:10 | access to local variable tc | | DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | access to local variable x1 | DefUse.cs:81:13:81:14 | access to local variable x1 | | DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | Int32 x2 = ... | DefUse.cs:85:15:85:16 | access to local variable x2 | @@ -77,8 +59,6 @@ | DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:155:9:155:18 | ... = ... | DefUse.cs:156:13:156:18 | access to field Field4 | | DefUse.cs:166:9:166:14 | Field5 | DefUse.cs:184:9:184:18 | ... = ... | DefUse.cs:185:13:185:18 | access to field Field5 | | DefUse.cs:166:9:166:14 | Field5 | DefUse.cs:188:13:188:22 | ... = ... | DefUse.cs:189:17:189:22 | access to field Field5 | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | i | DefUse.cs:169:13:169:13 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | ... = ... | DefUse.cs:174:17:174:17 | access to parameter i | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | Action a = ... | DefUse.cs:181:9:181:9 | access to local variable a | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | ... = ... | DefUse.cs:191:9:191:9 | access to local variable a | | Example.cs:4:9:4:13 | Field | Example.cs:8:9:8:22 | ... = ... | Example.cs:9:13:9:22 | access to field Field | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected index cd51b66ba3bd..1b416d1b4f2d 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected @@ -1,6 +1,3 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:8:17:8:17 | access to parameter i | Capture.cs:33:13:33:13 | access to parameter i | -| Capture.cs:8:13:8:13 | x | Capture.cs:16:17:16:17 | access to local variable x | Capture.cs:17:21:17:21 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:45:13:45:13 | access to local variable x | Capture.cs:47:13:47:13 | access to local variable x | | Capture.cs:10:16:10:16 | a | Capture.cs:38:9:38:9 | access to local variable a | Capture.cs:46:12:46:12 | access to local variable a | | Capture.cs:65:45:65:51 | strings | Capture.cs:68:18:68:24 | access to parameter strings | Capture.cs:70:9:70:15 | access to parameter strings | | Consistency.cs:5:9:5:13 | Field | Consistency.cs:26:13:26:19 | access to field Field | Consistency.cs:27:13:27:19 | access to field Field | @@ -22,7 +19,6 @@ | DefUse.cs:144:22:144:22 | x | DefUse.cs:146:17:146:17 | access to local variable x | DefUse.cs:147:17:147:17 | access to local variable x | | DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:156:13:156:18 | access to field Field4 | DefUse.cs:157:13:157:18 | access to field Field4 | | DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:162:13:162:18 | access to field Field4 | DefUse.cs:163:13:163:18 | access to field Field4 | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:177:21:177:21 | access to parameter i | DefUse.cs:178:21:178:21 | access to parameter i | | Example.cs:4:9:4:13 | Field | Example.cs:14:13:14:22 | access to field Field | Example.cs:15:13:15:22 | access to field Field | | Example.cs:6:23:6:23 | i | Example.cs:8:22:8:22 | access to parameter i | Example.cs:10:13:10:13 | access to parameter i | | Example.cs:6:23:6:23 | i | Example.cs:10:13:10:13 | access to parameter i | Example.cs:11:26:11:26 | access to parameter i | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected index 134190ef871b..8cbd5e6b1b67 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected @@ -4,7 +4,6 @@ | DefUse.cs:6:14:6:14 | y | DefUse.cs:23:9:23:15 | SSA phi(y) | DefUse.cs:18:13:18:18 | SSA def(y) | | DefUse.cs:6:14:6:14 | y | DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:28:13:28:18 | SSA def(y) | | DefUse.cs:6:14:6:14 | y | DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:39:13:39:18 | SSA def(y) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) | DefUse.cs:76:9:76:11 | SSA def(i) | | DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA phi(x1) | DefUse.cs:79:13:79:18 | SSA def(x1) | | DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA phi(x1) | DefUse.cs:80:30:80:31 | SSA def(x1) | | DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | SSA phi(x5) | DefUse.cs:97:13:97:18 | SSA def(x5) | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected deleted file mode 100644 index 48aafe94201d..000000000000 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected +++ /dev/null @@ -1,45 +0,0 @@ -| in | Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:38:9:38:11 | delegate call | false | -| in | Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:44:9:44:12 | call to method M | true | -| in | Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:38:9:38:11 | delegate call | true | -| in | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:25:13:25:15 | delegate call | false | -| in | Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:44:9:44:12 | call to method M | true | -| in | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:25:13:25:15 | delegate call | false | -| in | Capture.cs:59:13:59:13 | i | Capture.cs:59:13:59:17 | SSA def(i) | Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:61:9:61:25 | call to method Select | true | -| in | Capture.cs:67:13:67:13 | c | Capture.cs:67:13:67:19 | SSA def(c) | Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:18:68:50 | call to method Where | true | -| in | Capture.cs:67:13:67:13 | c | Capture.cs:67:13:67:19 | SSA def(c) | Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:70:9:70:25 | call to method Select | true | -| in | Capture.cs:75:13:75:13 | i | Capture.cs:75:13:75:17 | SSA def(i) | Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:77:9:77:25 | call to method Select | true | -| in | Capture.cs:85:13:85:13 | b | Capture.cs:85:13:85:20 | SSA def(b) | Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:87:9:87:24 | call to method Where | true | -| in | Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:9:100:10 | call to local function fn | true | -| in | Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:103:9:107:10 | call to local function fn | true | -| in | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:120:9:120:12 | call to local function M1 | false | -| in | Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:187:13:187:17 | call to local function M10 | true | -| in | Capture.cs:182:17:182:17 | i | Capture.cs:188:13:188:17 | SSA def(i) | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:189:13:189:17 | call to local function M11 | false | -| in | Capture.cs:197:17:197:17 | i | Capture.cs:197:17:197:21 | SSA def(i) | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:200:13:200:19 | delegate call | false | -| in | Capture.cs:197:17:197:17 | i | Capture.cs:197:17:197:21 | SSA def(i) | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:200:13:200:19 | delegate call | false | -| in | Capture.cs:209:17:209:17 | i | Capture.cs:209:17:209:21 | SSA def(i) | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:213:17:213:24 | access to event Exited | true | -| in | Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:233:9:233:12 | call to local function M2 | false | -| in | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:81:9:81:11 | delegate call | false | -| in | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:86:9:86:47 | call to method Select | true | -| in | Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:86:24:86:46 | SSA capture def(a) | Fields.cs:86:9:86:47 | call to method Select | true | -| in | Fields.cs:79:23:79:23 | b | Fields.cs:79:23:79:35 | SSA def(b) | Fields.cs:89:24:89:46 | SSA capture def(b) | Fields.cs:89:9:89:47 | call to method Select | true | -| in | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:77:9:77:11 | delegate call | false | -| in | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:82:9:82:47 | call to method Select | true | -| in | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:82:24:82:46 | SSA capture def(a) | Properties.cs:82:9:82:47 | call to method Select | true | -| in | Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | SSA def(b) | Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:9:85:47 | call to method Select | true | -| out | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | delegate call | false | -| out | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | call to method M | true | -| out | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:38:9:38:11 | delegate call | false | -| out | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:44:9:44:12 | call to method M | true | -| out | Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:32:9:32:11 | delegate call | false | -| out | Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | call to method M | true | -| out | Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:53:9:53:11 | delegate call | false | -| out | Capture.cs:59:13:59:13 | i | Capture.cs:60:36:60:38 | SSA def(i) | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:61:9:61:25 | call to method Select | true | -| out | Capture.cs:75:13:75:13 | i | Capture.cs:76:80:76:80 | SSA def(i) | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:77:9:77:25 | call to method Select | true | -| out | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | call to local function fn | true | -| out | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | call to local function M2 | false | -| out | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:136:9:136:12 | call to local function M3 | false | -| out | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | call to local function M4 | false | -| out | Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | call to local function M6 | false | -| out | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:176:13:176:16 | call to local function M9 | false | -| out | Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | call to local function M3 | false | -| out | DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:181:9:181:11 | delegate call | false | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql b/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql deleted file mode 100644 index f5815998200c..000000000000 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql +++ /dev/null @@ -1,12 +0,0 @@ -import csharp - -from - string inout, Ssa::ExplicitDefinition def, Ssa::Definition targetDef, ControlFlow::Node call, - boolean additionalCalls -where - inout = "in" and def.isCapturedVariableDefinitionFlowIn(targetDef, call, additionalCalls) - or - inout = "out" and - def.isCapturedVariableDefinitionFlowOut(targetDef, additionalCalls) and - targetDef.(Ssa::ImplicitCallDefinition).getControlFlowNode() = call -select inout, def.getSourceVariable(), def, targetDef, call, additionalCalls diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected index 02d622c006ac..aeda9e9b4c13 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected @@ -1,101 +1,37 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:10:20:27:9 | SSA capture def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | | Capture.cs:17:17:17:17 | y | Capture.cs:19:24:23:13 | SSA capture def(y) | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | -| Capture.cs:29:13:29:13 | z | Capture.cs:29:13:29:17 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | -| Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | SSA param(a) | -| Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | -| Capture.cs:59:13:59:13 | i | Capture.cs:59:13:59:17 | SSA def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:31:60:38 | SSA capture def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:36:60:38 | SSA def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | | Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | -| Capture.cs:67:13:67:13 | c | Capture.cs:67:13:67:19 | SSA def(c) | | Capture.cs:67:13:67:13 | c | Capture.cs:68:32:68:49 | SSA capture def(c) | | Capture.cs:67:13:67:13 | c | Capture.cs:69:9:69:62 | SSA capture def(c) | | Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | | Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | | Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | -| Capture.cs:75:13:75:13 | i | Capture.cs:75:13:75:17 | SSA def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:67:76:81 | SSA capture def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:80:76:80 | SSA def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | | Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | | Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | | Capture.cs:81:28:81:28 | i | Capture.cs:81:34:81:36 | SSA def(i) | | Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | -| Capture.cs:85:13:85:13 | b | Capture.cs:85:13:85:20 | SSA def(b) | | Capture.cs:85:13:85:13 | b | Capture.cs:86:68:86:73 | SSA capture def(b) | | Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | SSA def(e) | | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | -| Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | -| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | -| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | -| Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | -| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | -| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | -| Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | -| Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) | -| Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | -| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) | -| Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | -| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | -| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | -| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | -| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | -| Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | | Capture.cs:182:17:182:17 | i | Capture.cs:183:13:186:13 | SSA capture def(i) | -| Capture.cs:182:17:182:17 | i | Capture.cs:188:13:188:17 | SSA def(i) | -| Capture.cs:197:17:197:17 | i | Capture.cs:197:17:197:21 | SSA def(i) | | Capture.cs:197:17:197:17 | i | Capture.cs:198:33:198:44 | SSA capture def(i) | | Capture.cs:197:17:197:17 | i | Capture.cs:203:34:203:45 | SSA capture def(i) | | Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | SSA def(eh) | | Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | SSA def(eh2) | -| Capture.cs:209:17:209:17 | i | Capture.cs:209:17:209:21 | SSA def(i) | | Capture.cs:209:17:209:17 | i | Capture.cs:212:39:212:71 | SSA capture def(i) | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | -| Capture.cs:229:13:229:13 | i | Capture.cs:231:9:231:49 | SSA capture def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | SSA def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | @@ -103,8 +39,6 @@ | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | SSA param(i) | @@ -129,13 +63,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | SSA def(i) | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | | DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | | DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | @@ -162,11 +89,6 @@ | DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | SSA def(x) | | DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | | DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | SSA param(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:170:9:170:13 | SSA def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:175:32:179:13 | SSA capture def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected index 4ec9fbf90b08..693098347066 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected @@ -1,110 +1,44 @@ -| Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:6:16:6:16 | i | -| Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:8:13:8:17 | Int32 x = ... | | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:10:16:27:9 | Action a = ... | -| Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:10:20:27:9 | (...) => ... | -| Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:13:13:13:17 | ... = ... | -| Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:15:13:15:17 | ... = ... | | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:17:17:17:21 | Int32 y = ... | | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:19:20:23:13 | Action b = ... | -| Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:19:24:23:13 | (...) => ... | | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:19:24:23:13 | (...) => ... | -| Capture.cs:29:13:29:17 | SSA def(z) | Capture.cs:29:13:29:17 | Int32 z = ... | | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:30:16:30:35 | Action c = ... | -| Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:30:28:30:32 | ... = ... | -| Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:32:9:32:11 | delegate call | -| Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:37:9:37:13 | ... = ... | -| Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | delegate call | -| Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:38:9:38:11 | delegate call | -| Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:43:9:43:13 | ... = ... | -| Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | call to method M | -| Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:44:9:44:12 | call to method M | -| Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | call to method M | -| Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:50:20:50:20 | a | | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:52:16:52:43 | Action b = ... | -| Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:52:28:52:40 | ... = ... | -| Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:53:9:53:11 | delegate call | | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:57:57:57:63 | strings | -| Capture.cs:59:13:59:17 | SSA def(i) | Capture.cs:59:13:59:17 | Int32 i = ... | | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:60:27:60:38 | Func e = ... | -| Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:60:31:60:38 | (...) => ... | -| Capture.cs:60:36:60:38 | SSA def(i) | Capture.cs:60:36:60:38 | ...++ | -| Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:61:9:61:25 | call to method Select | | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:65:45:65:51 | strings | -| Capture.cs:67:13:67:19 | SSA def(c) | Capture.cs:67:13:67:19 | Char c = ... | | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:32:68:32 | s | | Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:32:68:49 | (...) => ... | | Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:69:9:69:62 | M | | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:25:69:25 | s | | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:73:67:73:73 | strings | -| Capture.cs:75:13:75:17 | SSA def(i) | Capture.cs:75:13:75:17 | Int32 i = ... | | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:76:63:76:81 | Expression> e = ... | -| Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:76:67:76:81 | (...) => ... | -| Capture.cs:76:80:76:80 | SSA def(i) | Capture.cs:76:72:76:81 | call to method Inc | -| Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:77:9:77:25 | call to method Select | | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:28:81:28 | i | | Capture.cs:81:34:81:36 | SSA def(i) | Capture.cs:81:34:81:36 | ...++ | | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:83:65:83:71 | strings | -| Capture.cs:85:13:85:20 | SSA def(b) | Capture.cs:85:13:85:20 | Boolean b = ... | | Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:86:64:86:73 | Expression> e = ... | | Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:86:68:86:73 | (...) => ... | | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:18:92:18 | d | -| Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | Int32 y = ... | | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | (...) => ... | | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... | -| Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | Int32 z = ... | -| Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | call to local function fn | -| Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | ... = ... | -| Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | Int32 a = ... | | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | M1 | | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... | -| Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | Int32 b = ... | -| Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | ... = ... | -| Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | call to local function M2 | -| Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | Int32 c = ... | -| Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... | -| Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:136:9:136:12 | call to local function M3 | -| Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | Int32 d = ... | -| Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | ... = ... | -| Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | call to local function M4 | -| Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | Int32 e = ... | -| Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | M5 | -| Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | ... = ... | -| Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... | -| Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... | -| Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | call to local function M6 | | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | M7 | -| Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | Int32 h = ... | -| Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... | -| Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... | -| Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:176:13:176:16 | call to local function M9 | -| Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:182:17:182:21 | Int32 i = ... | | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:183:13:186:13 | M11 | -| Capture.cs:188:13:188:17 | SSA def(i) | Capture.cs:188:13:188:17 | ... = ... | -| Capture.cs:197:17:197:21 | SSA def(i) | Capture.cs:197:17:197:21 | Int32 i = ... | | Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:198:28:198:44 | MyEventHandler eh = ... | | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:33:198:44 | (...) => ... | | Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:203:28:203:45 | MyEventHandler eh2 = ... | | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:34:203:45 | (...) => ... | -| Capture.cs:209:17:209:21 | SSA def(i) | Capture.cs:209:17:209:21 | Int32 i = ... | | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:210:24:210:59 | Process p = ... | | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:212:30:212:71 | EventHandler exited = ... | | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:39:212:71 | (...) => ... | -| Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:231:9:231:49 | M2 | -| Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:232:9:232:13 | ... = ... | -| Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:235:21:235:25 | ... = ... | -| Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | call to local function M3 | -| Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | Int32 i = ... | -| Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | ... = ... | | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... | -| Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:9:254:28 | call to local function CaptureAndRef | | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b | | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... | | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... | | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:9:25:30 | call to method Out | | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:9:25:30 | call to method Out | | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... | -| Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | Int32 i | -| Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | ... = ... | | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s | | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a | | Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:37:49:37 | i | @@ -126,15 +60,9 @@ | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:9:50:24 | call to method refMethod | | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... | | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... | -| DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | Int32 i = ... | -| DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | ... = ... | | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | ... = ... | | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | ... = ... | | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | TestClass tc = ... | -| DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:71:9:71:13 | ... = ... | -| DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:72:9:72:11 | ...++ | -| DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:75:9:75:13 | ... = ... | -| DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:76:9:76:11 | ...-- | | DefUse.cs:79:13:79:18 | SSA def(x1) | DefUse.cs:79:13:79:18 | Int32 x1 = ... | | DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:80:16:80:32 | call to method refMethod | | DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:83:13:83:18 | Int32 x2 = ... | @@ -156,12 +84,7 @@ | DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:144:22:144:22 | String x | | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:155:9:155:18 | ... = ... | | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:160:10:160:16 | FieldM2 | -| DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:167:23:167:23 | i | -| DefUse.cs:170:9:170:13 | SSA def(i) | DefUse.cs:170:9:170:13 | ... = ... | | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:171:23:180:9 | Action a = ... | -| DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:173:13:173:17 | ... = ... | -| DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:175:32:179:13 | (...) => ... | -| DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:181:9:181:11 | delegate call | | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:184:9:184:18 | ... = ... | | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:186:9:190:9 | ... = ... | | DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:188:13:188:22 | ... = ... | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected index fe4cfec2ec0f..d94da54d008b 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected @@ -1,25 +1,10 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:33:13:33:13 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:12:17:12:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:14:17:14:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:39:13:39:13 | access to parameter i | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:34:13:34:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:17:21:17:21 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:21:21:21:21 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:40:13:40:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:44:11:44:11 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:47:13:47:13 | access to local variable x | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:46:12:46:12 | access to local variable a | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:26:17:26:17 | access to local variable y | | Capture.cs:17:17:17:17 | y | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:22:21:22:21 | access to local variable y | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:25:13:25:13 | access to local variable b | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:35:13:35:13 | access to local variable z | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:41:13:41:13 | access to local variable z | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:32:9:32:9 | access to local variable c | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:54:9:54:9 | access to parameter a | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:53:9:53:9 | access to local variable b | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:61:9:61:15 | access to parameter strings | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:60:36:60:36 | access to local variable i | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:62:13:62:13 | access to local variable i | | Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:61:24:61:24 | access to local variable e | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:70:9:70:15 | access to parameter strings | | Capture.cs:67:13:67:13 | c | Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:48:68:48 | access to local variable c | @@ -27,8 +12,6 @@ | Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:37:68:37 | access to parameter s | | Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:59:69:59 | access to parameter s | | Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:77:9:77:15 | access to parameter strings | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:76:80:76:80 | access to local variable i | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:78:13:78:13 | access to local variable i | | Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:77:24:77:24 | access to local variable e | | Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:34:81:34 | access to parameter i | | Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:87:9:87:15 | access to parameter strings | @@ -37,17 +20,9 @@ | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:24:92:24 | access to parameter d | | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:98:21:98:21 | access to local variable y | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:99:20:99:20 | access to local variable x | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:106:20:106:20 | access to local variable z | | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:117:21:117:21 | access to local variable a | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:118:17:118:17 | access to local variable x | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:126:17:126:17 | access to local variable b | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:134:17:134:17 | access to local variable c | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:137:13:137:13 | access to local variable c | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:145:13:145:13 | access to local variable d | -| Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:150:17:150:17 | access to local variable e | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:155:13:155:13 | access to local variable f | | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:165:17:165:17 | access to local variable g | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:177:17:177:17 | access to local variable h | | Capture.cs:182:17:182:17 | i | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:185:21:185:21 | access to local variable i | | Capture.cs:197:17:197:17 | i | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:43:198:43 | access to local variable i | | Capture.cs:197:17:197:17 | i | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:44:203:44 | access to local variable i | @@ -56,17 +31,12 @@ | Capture.cs:209:17:209:17 | i | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:70:212:70 | access to local variable i | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:213:17:213:17 | access to local variable p | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:213:29:213:34 | access to local variable exited | -| Capture.cs:229:13:229:13 | i | Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:231:47:231:47 | access to local variable i | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:237:34:237:34 | access to local variable i | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:254:27:254:27 | access to local variable i | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:255:34:255:34 | access to local variable i | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:11:17:11:17 | access to parameter b | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i | | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:27:13:27:13 | access to local variable c | | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:27:13:27:19 | access to field Field | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:33:9:33:9 | access to parameter c | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:39:39:39 | access to local variable i | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:46:13:46:13 | access to local variable s | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:47:49:47 | access to parameter a | | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:49:49:49 | access to parameter i | @@ -87,11 +57,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z | | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:54:13:54:17 | access to field Field | | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:57:13:57:16 | access to property Prop | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:61:13:61:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:72:9:72:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:73:13:73:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:76:9:76:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:77:13:77:13 | access to local variable i | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:64:13:64:18 | access to field Field2 | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:80:37:80:42 | access to field Field2 | | DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:69:13:69:18 | access to field Field3 | @@ -113,10 +78,6 @@ | DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:147:17:147:17 | access to local variable x | | DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:157:13:157:18 | access to field Field4 | | DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:163:13:163:18 | access to field Field4 | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:169:13:169:13 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:174:17:174:17 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:178:21:178:21 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:182:13:182:13 | access to parameter i | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:181:9:181:9 | access to local variable a | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:191:9:191:9 | access to local variable a | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:185:13:185:18 | access to field Field5 | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected index 56d86ea53cdb..000751cad1b4 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected @@ -1,76 +1,32 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:6:16:6:16 | i | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:13:13:13:17 | ... = ... | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:8:13:8:17 | Int32 x = ... | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:15:13:15:17 | ... = ... | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:43:9:43:13 | ... = ... | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:10:16:27:9 | Action a = ... | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:17:17:17:21 | Int32 y = ... | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:19:20:23:13 | Action b = ... | -| Capture.cs:29:13:29:13 | z | Capture.cs:29:13:29:17 | SSA def(z) | Capture.cs:29:13:29:17 | Int32 z = ... | -| Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:30:28:30:32 | ... = ... | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:37:9:37:13 | ... = ... | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:30:16:30:35 | Action c = ... | -| Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:50:20:50:20 | a | -| Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:52:28:52:40 | ... = ... | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:52:16:52:43 | Action b = ... | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:57:57:57:63 | strings | -| Capture.cs:59:13:59:13 | i | Capture.cs:59:13:59:17 | SSA def(i) | Capture.cs:59:13:59:17 | Int32 i = ... | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:36:60:38 | SSA def(i) | Capture.cs:60:36:60:38 | ...++ | | Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:60:27:60:38 | Func e = ... | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:65:45:65:51 | strings | -| Capture.cs:67:13:67:13 | c | Capture.cs:67:13:67:19 | SSA def(c) | Capture.cs:67:13:67:19 | Char c = ... | | Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:32:68:32 | s | | Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:25:69:25 | s | | Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:73:67:73:73 | strings | -| Capture.cs:75:13:75:13 | i | Capture.cs:75:13:75:17 | SSA def(i) | Capture.cs:75:13:75:17 | Int32 i = ... | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:80:76:80 | SSA def(i) | Capture.cs:76:80:76:80 | access to local variable i | | Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:76:63:76:81 | Expression> e = ... | | Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:28:81:28 | i | | Capture.cs:81:28:81:28 | i | Capture.cs:81:34:81:36 | SSA def(i) | Capture.cs:81:34:81:36 | ...++ | | Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:83:65:83:71 | strings | -| Capture.cs:85:13:85:13 | b | Capture.cs:85:13:85:20 | SSA def(b) | Capture.cs:85:13:85:20 | Boolean b = ... | | Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:86:64:86:73 | Expression> e = ... | | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:18:92:18 | d | -| Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | Int32 y = ... | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... | -| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | Int32 z = ... | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | ... = ... | -| Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | Int32 a = ... | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... | -| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | Int32 b = ... | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | ... = ... | -| Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | Int32 c = ... | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... | -| Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | Int32 d = ... | -| Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | ... = ... | -| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | Int32 e = ... | -| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | ... = ... | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... | -| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... | -| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | Int32 h = ... | -| Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... | -| Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... | -| Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:182:17:182:21 | Int32 i = ... | -| Capture.cs:182:17:182:17 | i | Capture.cs:188:13:188:17 | SSA def(i) | Capture.cs:188:13:188:17 | ... = ... | -| Capture.cs:197:17:197:17 | i | Capture.cs:197:17:197:21 | SSA def(i) | Capture.cs:197:17:197:21 | Int32 i = ... | | Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:198:28:198:44 | MyEventHandler eh = ... | | Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:203:28:203:45 | MyEventHandler eh2 = ... | -| Capture.cs:209:17:209:17 | i | Capture.cs:209:17:209:21 | SSA def(i) | Capture.cs:209:17:209:21 | Int32 i = ... | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:210:24:210:59 | Process p = ... | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:212:30:212:71 | EventHandler exited = ... | -| Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:232:9:232:13 | ... = ... | -| Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:235:21:235:25 | ... = ... | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | Int32 i = ... | -| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | ... = ... | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:27:254:27 | access to local variable i | | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... | | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | Consistency c | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | Int32 i | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | ... = ... | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a | | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:37:49:37 | i | @@ -92,12 +48,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z | | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... | | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | Int32 i = ... | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | ... = ... | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:71:9:71:13 | ... = ... | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:72:9:72:11 | ...++ | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:75:9:75:13 | ... = ... | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:76:9:76:11 | ...-- | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | ... = ... | | DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | ... = ... | | DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | TestClass tc = ... | @@ -122,9 +72,6 @@ | DefUse.cs:142:68:142:69 | ie | DefUse.cs:142:68:142:69 | SSA param(ie) | DefUse.cs:142:68:142:69 | ie | | DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:144:22:144:22 | String x | | DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:155:9:155:18 | ... = ... | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:167:23:167:23 | i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:170:9:170:13 | SSA def(i) | DefUse.cs:170:9:170:13 | ... = ... | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:173:13:173:17 | ... = ... | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:171:23:180:9 | Action a = ... | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:186:9:190:9 | ... = ... | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:184:9:184:18 | ... = ... | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected index 22a56a7da24d..189720acf12e 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected @@ -1,20 +1,3 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:13:13:13:17 | ... = ... | -| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:13:13:13:17 | ... = ... | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:15:13:15:17 | ... = ... | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:15:13:15:17 | ... = ... | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:30:28:30:32 | ... = ... | -| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:30:28:30:32 | ... = ... | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:52:28:52:40 | ... = ... | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:60:36:60:38 | ...++ | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:76:80:76:80 | access to local variable i | -| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:105:13:105:17 | ... = ... | -| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:125:13:125:17 | ... = ... | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:133:13:133:17 | ... = ... | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:142:13:142:17 | ... = ... | -| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:158:13:158:17 | ... = ... | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:174:17:174:21 | ... = ... | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:235:21:235:25 | ... = ... | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:173:13:173:17 | ... = ... | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:191:9:191:11 | SSA call def(this.Field5) | DefUse.cs:188:13:188:22 | ... = ... | | Example.cs:8:9:8:18 | this.Field | Example.cs:13:13:13:23 | SSA call def(this.Field) | Example.cs:8:9:8:22 | ... = ... | | Example.cs:8:9:8:18 | this.Field | Example.cs:13:13:13:23 | SSA call def(this.Field) | Example.cs:11:13:11:30 | ... = ... | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected index 48acb24891f5..8df92f847553 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected @@ -1,29 +1,11 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:8:17:8:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:33:13:33:13 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:12:17:12:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:14:17:14:17 | access to parameter i | -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:39:13:39:13 | access to parameter i | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:34:13:34:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:16:17:16:17 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:17:21:17:21 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:21:21:21:21 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:40:13:40:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:44:11:44:11 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:45:13:45:13 | access to local variable x | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:47:13:47:13 | access to local variable x | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:38:9:38:9 | access to local variable a | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:46:12:46:12 | access to local variable a | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:26:17:26:17 | access to local variable y | | Capture.cs:17:17:17:17 | y | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:22:21:22:21 | access to local variable y | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:25:13:25:13 | access to local variable b | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:35:13:35:13 | access to local variable z | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:41:13:41:13 | access to local variable z | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:32:9:32:9 | access to local variable c | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:54:9:54:9 | access to parameter a | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:53:9:53:9 | access to local variable b | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:61:9:61:15 | access to parameter strings | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:60:36:60:36 | access to local variable i | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:62:13:62:13 | access to local variable i | | Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:61:24:61:24 | access to local variable e | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:68:18:68:24 | access to parameter strings | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:70:9:70:15 | access to parameter strings | @@ -32,8 +14,6 @@ | Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:37:68:37 | access to parameter s | | Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:59:69:59 | access to parameter s | | Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:77:9:77:15 | access to parameter strings | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:76:80:76:80 | access to local variable i | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:78:13:78:13 | access to local variable i | | Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:77:24:77:24 | access to local variable e | | Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:34:81:34 | access to parameter i | | Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:87:9:87:15 | access to parameter strings | @@ -42,17 +22,9 @@ | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:24:92:24 | access to parameter d | | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:98:21:98:21 | access to local variable y | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:99:20:99:20 | access to local variable x | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:106:20:106:20 | access to local variable z | | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:117:21:117:21 | access to local variable a | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:118:17:118:17 | access to local variable x | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:126:17:126:17 | access to local variable b | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:134:17:134:17 | access to local variable c | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:137:13:137:13 | access to local variable c | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:145:13:145:13 | access to local variable d | -| Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:150:17:150:17 | access to local variable e | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:155:13:155:13 | access to local variable f | | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:165:17:165:17 | access to local variable g | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:177:17:177:17 | access to local variable h | | Capture.cs:182:17:182:17 | i | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:185:21:185:21 | access to local variable i | | Capture.cs:197:17:197:17 | i | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:43:198:43 | access to local variable i | | Capture.cs:197:17:197:17 | i | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:44:203:44 | access to local variable i | @@ -61,10 +33,6 @@ | Capture.cs:209:17:209:17 | i | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:70:212:70 | access to local variable i | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:213:17:213:17 | access to local variable p | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:213:29:213:34 | access to local variable exited | -| Capture.cs:229:13:229:13 | i | Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:231:47:231:47 | access to local variable i | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:237:34:237:34 | access to local variable i | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:254:27:254:27 | access to local variable i | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:255:34:255:34 | access to local variable i | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:11:17:11:17 | access to parameter b | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i | @@ -73,7 +41,6 @@ | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:26:13:26:19 | access to field Field | | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:27:13:27:19 | access to field Field | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:33:9:33:9 | access to parameter c | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:39:39:39 | access to local variable i | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:45:9:45:9 | access to local variable s | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:46:13:46:13 | access to local variable s | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:47:49:47 | access to parameter a | @@ -102,11 +69,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z | | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:54:13:54:17 | access to field Field | | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:57:13:57:16 | access to property Prop | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:61:13:61:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:72:9:72:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:73:13:73:13 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:76:9:76:9 | access to local variable i | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:77:13:77:13 | access to local variable i | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:64:13:64:18 | access to field Field2 | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:80:37:80:42 | access to field Field2 | | DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:69:13:69:18 | access to field Field3 | @@ -133,11 +95,6 @@ | DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:157:13:157:18 | access to field Field4 | | DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:162:13:162:18 | access to field Field4 | | DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:163:13:163:18 | access to field Field4 | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:169:13:169:13 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:174:17:174:17 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:177:21:177:21 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:178:21:178:21 | access to parameter i | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:182:13:182:13 | access to parameter i | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:181:9:181:9 | access to local variable a | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:191:9:191:9 | access to local variable a | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:185:13:185:18 | access to field Field5 | diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected index bf7db2924299..311df0042704 100644 --- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected +++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected @@ -1,118 +1,37 @@ -| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:6:16:6:16 | SSA param(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:10:20:27:9 | SSA capture def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:13:13:13:17 | SSA def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:6:16:6:16 | SSA param(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | SSA call def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:6:16:6:16 | SSA param(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:38:9:38:11 | SSA call def(i) | -| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | SSA call def(i) | -| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:8:13:8:17 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:15:13:15:17 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:19:24:23:13 | SSA capture def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:8:13:8:17 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:38:9:38:11 | SSA call def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:43:9:43:13 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:43:9:43:13 | SSA def(x) | -| Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:44:9:44:12 | SSA call def(x) | | Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:10:16:27:9 | SSA def(a) | | Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:17:17:17:21 | SSA def(y) | | Capture.cs:17:17:17:17 | y | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:19:24:23:13 | SSA capture def(y) | | Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:19:20:23:13 | SSA def(b) | -| Capture.cs:29:13:29:13 | z | Capture.cs:29:13:29:17 | SSA def(z) | Capture.cs:29:13:29:17 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:30:28:30:32 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:29:13:29:17 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:32:9:32:11 | SSA call def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:37:9:37:13 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:37:9:37:13 | SSA def(z) | -| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | SSA call def(z) | | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:30:16:30:35 | SSA def(c) | -| Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:50:20:50:20 | SSA param(a) | -| Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:52:28:52:40 | SSA def(a) | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:50:20:50:20 | SSA param(a) | -| Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:53:9:53:11 | SSA call def(a) | | Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:52:16:52:43 | SSA def(b) | | Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:57:57:57:63 | SSA param(strings) | -| Capture.cs:59:13:59:13 | i | Capture.cs:59:13:59:17 | SSA def(i) | Capture.cs:59:13:59:17 | SSA def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:60:31:60:38 | SSA capture def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:60:36:60:38 | SSA def(i) | Capture.cs:60:36:60:38 | SSA def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:59:13:59:17 | SSA def(i) | -| Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:61:9:61:25 | SSA call def(i) | | Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:60:27:60:38 | SSA def(e) | | Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:65:45:65:51 | SSA param(strings) | -| Capture.cs:67:13:67:13 | c | Capture.cs:67:13:67:19 | SSA def(c) | Capture.cs:67:13:67:19 | SSA def(c) | | Capture.cs:67:13:67:13 | c | Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:32:68:49 | SSA capture def(c) | | Capture.cs:67:13:67:13 | c | Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:69:9:69:62 | SSA capture def(c) | | Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:32:68:32 | SSA param(s) | | Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:25:69:25 | SSA param(s) | | Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:73:67:73:73 | SSA param(strings) | -| Capture.cs:75:13:75:13 | i | Capture.cs:75:13:75:17 | SSA def(i) | Capture.cs:75:13:75:17 | SSA def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:76:67:76:81 | SSA capture def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:76:80:76:80 | SSA def(i) | Capture.cs:76:80:76:80 | SSA def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:75:13:75:17 | SSA def(i) | -| Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:77:9:77:25 | SSA call def(i) | | Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:76:63:76:81 | SSA def(e) | | Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:28:81:28 | SSA param(i) | | Capture.cs:81:28:81:28 | i | Capture.cs:81:34:81:36 | SSA def(i) | Capture.cs:81:34:81:36 | SSA def(i) | | Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:83:65:83:71 | SSA param(strings) | -| Capture.cs:85:13:85:13 | b | Capture.cs:85:13:85:20 | SSA def(b) | Capture.cs:85:13:85:20 | SSA def(b) | | Capture.cs:85:13:85:13 | b | Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:86:68:86:73 | SSA capture def(b) | | Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:86:64:86:73 | SSA def(e) | | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:18:92:18 | SSA param(d) | -| Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | SSA def(y) | | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | SSA capture def(y) | | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | SSA def(x) | -| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | SSA def(z) | -| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:102:13:102:18 | SSA def(z) | -| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | SSA call def(z) | -| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | SSA def(z) | -| Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | SSA def(a) | | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | SSA capture def(a) | | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | SSA def(x) | -| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | SSA def(b) | -| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | SSA def(b) | -| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:122:13:122:18 | SSA def(b) | -| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | SSA call def(b) | -| Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | SSA def(c) | -| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | SSA def(c) | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:130:13:130:18 | SSA def(c) | -| Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:136:9:136:12 | SSA call def(c) | -| Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | SSA def(d) | -| Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | SSA def(d) | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:139:13:139:18 | SSA def(d) | -| Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | SSA call def(d) | -| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | SSA def(e) | -| Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | SSA capture def(e) | -| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | SSA def(e) | -| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | SSA def(f) | -| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | SSA def(f) | -| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:154:13:154:18 | SSA def(f) | -| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | SSA call def(f) | | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | SSA capture def(g) | -| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:171:13:171:17 | SSA def(h) | -| Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:176:13:176:16 | SSA call def(h) | -| Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:182:17:182:21 | SSA def(i) | | Capture.cs:182:17:182:17 | i | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:183:13:186:13 | SSA capture def(i) | -| Capture.cs:182:17:182:17 | i | Capture.cs:188:13:188:17 | SSA def(i) | Capture.cs:188:13:188:17 | SSA def(i) | -| Capture.cs:197:17:197:17 | i | Capture.cs:197:17:197:21 | SSA def(i) | Capture.cs:197:17:197:21 | SSA def(i) | | Capture.cs:197:17:197:17 | i | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:33:198:44 | SSA capture def(i) | | Capture.cs:197:17:197:17 | i | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:34:203:45 | SSA capture def(i) | | Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:198:28:198:44 | SSA def(eh) | | Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:203:28:203:45 | SSA def(eh2) | -| Capture.cs:209:17:209:17 | i | Capture.cs:209:17:209:21 | SSA def(i) | Capture.cs:209:17:209:21 | SSA def(i) | | Capture.cs:209:17:209:17 | i | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:39:212:71 | SSA capture def(i) | | Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:210:24:210:59 | SSA def(p) | | Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:212:30:212:71 | SSA def(exited) | -| Capture.cs:229:13:229:13 | i | Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:231:9:231:49 | SSA capture def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:232:9:232:13 | SSA def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:235:21:235:25 | SSA def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:232:9:232:13 | SSA def(i) | -| Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | SSA call def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | SSA def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | SSA def(i) | -| Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:27:254:27 | SSA def(i) | | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | SSA def(j) | | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | SSA param(b) | | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | SSA def(i) | @@ -120,8 +39,6 @@ | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | SSA def(c) | | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | SSA def(c) | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | SSA def(i) | -| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | SSA def(i) | | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | SSA def(s) | | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | SSA param(a) | | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:37:49:37 | SSA param(i) | @@ -149,13 +66,6 @@ | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:23:50:23 | SSA def(z) | | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | SSA def(this.Field) | | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) | DefUse.cs:76:9:76:11 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:71:9:71:13 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:72:9:72:11 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:75:9:75:13 | SSA def(i) | -| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:76:9:76:11 | SSA def(i) | | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | | DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | | DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | SSA def(tc) | @@ -184,12 +94,6 @@ | DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:144:22:144:22 | SSA def(x) | | DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | | DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:167:23:167:23 | SSA param(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:170:9:170:13 | SSA def(i) | DefUse.cs:170:9:170:13 | SSA def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:173:13:173:17 | SSA def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:175:32:179:13 | SSA capture def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:170:9:170:13 | SSA def(i) | -| DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:181:9:181:11 | SSA call def(i) | | DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:171:23:180:9 | SSA def(a) | | DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:186:9:190:9 | SSA def(a) | | DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | diff --git a/csharp/ql/test/query-tests/Nullness/E.cs b/csharp/ql/test/query-tests/Nullness/E.cs index ec2dee0d66fc..ec1fa1613923 100644 --- a/csharp/ql/test/query-tests/Nullness/E.cs +++ b/csharp/ql/test/query-tests/Nullness/E.cs @@ -420,14 +420,14 @@ static bool Ex42(int? i, IEnumerable @is) static bool Ex43(int? i, IEnumerable @is) { if (i.HasValue) - return @is.Any(j => j == i.Value); // GOOD + return @is.Any(j => j == i.Value); // GOOD (FALSE POSITIVE) return false; } static bool Ex44(int? i, IEnumerable @is) { if (i.HasValue) - @is = @is.Where(j => j == i.Value); // BAD (always) (FALSE NEGATIVE) + @is = @is.Where(j => j == i.Value); // BAD (always) i = null; return @is.Any(); } diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected index 3789903e8b5b..631c2cd77660 100644 --- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected +++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected @@ -408,6 +408,10 @@ nodes | E.cs:405:16:405:16 | access to local variable i | | E.cs:417:24:417:40 | SSA capture def(i) | | E.cs:417:34:417:34 | access to parameter i | +| E.cs:423:28:423:44 | SSA capture def(i) | +| E.cs:423:38:423:38 | access to parameter i | +| E.cs:430:29:430:45 | SSA capture def(i) | +| E.cs:430:39:430:39 | access to parameter i | | E.cs:435:29:435:29 | SSA param(s) | | E.cs:437:13:437:21 | [true] ... is ... | | E.cs:439:13:439:13 | access to parameter s | @@ -803,6 +807,8 @@ edges | E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i | | E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i | | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | +| E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | +| E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | | E.cs:435:29:435:29 | SSA param(s) | E.cs:437:13:437:21 | [true] ... is ... | | E.cs:437:13:437:21 | [true] ... is ... | E.cs:439:13:439:13 | access to parameter s | | Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:9:13:9:30 | [false] !... | @@ -919,6 +925,8 @@ edges | E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:58:382:67 | ... == ... | this | | E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:384:27:384:36 | ... == ... | this | | E.cs:417:34:417:34 | access to parameter i | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:415:27:415:27 | i | i | E.cs:415:27:415:27 | i | this | +| E.cs:423:38:423:38 | access to parameter i | E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:420:27:420:27 | i | i | E.cs:420:27:420:27 | i | this | +| E.cs:430:39:430:39 | access to parameter i | E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:427:27:427:27 | i | i | E.cs:427:27:427:27 | i | this | | GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this | | NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null at this access because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this | | Params.cs:14:17:14:20 | access to parameter args | Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args | Variable $@ may be null at this access because of $@ null argument. | Params.cs:12:36:12:39 | args | args | Params.cs:20:12:20:15 | null | this | From 4bd79c0eb393f8b52850c300e97f4e2577d29421 Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Mon, 26 Feb 2024 09:58:23 +0100 Subject: [PATCH 3/3] Add change note --- .../ql/lib/change-notes/2024-02-26-variable-capture-flow.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md new file mode 100644 index 000000000000..66ab65083dc3 --- /dev/null +++ b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md @@ -0,0 +1,4 @@ +--- +category: majorAnalysis +--- +* Improved support for flow through captured variables that properly adheres to inter-procedural control flow. \ No newline at end of file