/**

class Node {

/** Gets a textual representation of this element. */

string toString();

/** Gets the location of this node. */

Location getLocation();

}

class ParameterNode extends Node;

class ArgumentNode extends Node;

class ReturnNode extends Node {

ReturnKind getKind();

}

/**

class OutNode extends Node;

/**

class PostUpdateNode extends Node {

/**

Node getPreUpdateNode();

}

class CastNode extends Node;

predicate isParameterNode(ParameterNode p, DataFlowCallable c, ParameterPosition pos);

predicate isArgumentNode(ArgumentNode n, DataFlowCall call, ArgumentPosition pos);

DataFlowCallable nodeGetEnclosingCallable(Node node);

DataFlowType getNodeType(Node node);

predicate nodeIsHidden(Node node);

class DataFlowExpr;

/** Gets the node corresponding to `e`. */

Node exprNode(DataFlowExpr e);

class DataFlowCall {

/** Gets a textual representation of this element. */

string toString();

/** Gets the location of this call. */

Location getLocation();

DataFlowCallable getEnclosingCallable();

}

class DataFlowCallable {

/** Gets a textual representation of this element. */

string toString();

/** Gets the location of this callable. */

Location getLocation();

}

class ReturnKind {

/** Gets a textual representation of this element. */

string toString();

}

/** Gets a viable implementation of the target of the given `Call`. */

DataFlowCallable viableCallable(DataFlowCall c);

/**

default predicate mayBenefitFromCallContext(DataFlowCall call) { none() }

/**

default DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) { none() }

/**

OutNode getAnOutNode(DataFlowCall call, ReturnKind kind);

/**

class DataFlowType {

/** Gets a textual representation of this element. */

string toString();

}

/**

predicate compatibleTypes(DataFlowType t1, DataFlowType t2);

/**

predicate typeStrongerThan(DataFlowType t1, DataFlowType t2);

class Content {

/** Gets a textual representation of this element. */

string toString();

}

/**

predicate forceHighPrecision(Content c);

/**

class ContentSet {

/** Gets a textual representation of this element. */

string toString();

/** Gets a content that may be stored into when storing into this set. */

Content getAStoreContent();

/** Gets a content that may be read from when reading from this set. */

Content getAReadContent();

}

/**

class ContentApprox {

/** Gets a textual representation of this element. */

string toString();

}

/**

ContentApprox getContentApprox(Content c);

class ParameterPosition {

/** Gets a textual representation of this element. */

bindingset[this]

string toString();

}

class ArgumentPosition {

/** Gets a textual representation of this element. */

bindingset[this]

string toString();

}

/**

predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos);

/**

predicate simpleLocalFlowStep(Node node1, Node node2, string model);

/**

bindingset[node1, node2]

default predicate validParameterAliasStep(Node node1, Node node2) { any() }

/**

predicate jumpStep(Node node1, Node node2);

/**

predicate readStep(Node node1, ContentSet c, Node node2);

/**

predicate storeStep(Node node1, ContentSet c, Node node2);

/**

predicate clearsContent(Node n, ContentSet c);

/**

predicate expectsContent(Node n, ContentSet c);

/** A set of `Node`s in a `DataFlowCallable`. */

class NodeRegion {

/** Holds if this region contains `n`. */

predicate contains(Node n);

}

/**

predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call);

default int accessPathLimit() { result = 5 }

/**

predicate allowParameterReturnInSelf(ParameterNode p);

/**

predicate localMustFlowStep(Node node1, Node node2);

class LambdaCallKind;

/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */

predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c);

/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */

predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver);

/** Extra data-flow steps needed for lambda flow analysis. */

predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue);

predicate knownSourceModel(Node source, string model);

predicate knownSinkModel(Node sink, string model);

/**

default predicate neverSkipInPathGraph(Node n) { none() }

/**

default int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() }

/**

class DataFlowSecondLevelScope {

/** Gets a textual representation of this element. */

string toString();

}

/** Gets the second-level scope containing the node `n`, if any. */

default DataFlowSecondLevelScope getSecondLevelScope(Node n) { none() }

bindingset[call, p, arg]

default predicate golangSpecificParamArgFilter(

DataFlowCall call, ParameterNode p, ArgumentNode arg

) {

any()

}

/** Gets the default value for the `fieldFlowBranchLimit` */

default int defaultFieldFlowBranchLimit() { result = 2 }

/** Holds if `fieldFlowBranchLimit` should be ignored for flow going into/out of `c`. */

default predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { none() }

/**

default predicate isEvaluatingInOverlay() { none() }

private import Lang

private import internal.DataFlowImplCommon::MakeImplCommon<Location, Lang>

import DataFlowImplCommonPublic

/** An input configuration for data flow. */

signature module ConfigSig {

/**

predicate isSource(Node source);

/**

predicate isSink(Node sink);

/**

default predicate isBarrier(Node node) { none() }

/** Holds if data flow into `node` is prohibited. */

default predicate isBarrierIn(Node node) { none() }

/** Holds if data flow out of `node` is prohibited. */

default predicate isBarrierOut(Node node) { none() }

/**

default predicate isAdditionalFlowStep(Node node1, Node node2) { none() }

/**

default predicate allowImplicitRead(Node node, ContentSet c) { none() }

/**

default predicate neverSkip(Node node) {

isAdditionalFlowStep(node, _) or isAdditionalFlowStep(_, node)

}

/**

default int fieldFlowBranchLimit() { result = Lang::defaultFieldFlowBranchLimit() }

/** Gets the access path limit. */

default int accessPathLimit() { result = Lang::accessPathLimit() }

/**

default FlowFeature getAFeature() { none() }

/**

default predicate includeHiddenNodes() { none() }

/**

default predicate observeDiffInformedIncrementalMode() { none() }

/**

default Location getASelectedSourceLocation(Node source) { result = source.getLocation() }

/**

default Location getASelectedSinkLocation(Node sink) { result = sink.getLocation() }

}

/** An input configuration for data flow using flow state. */

signature module StateConfigSig {

bindingset[this]

class FlowState;

/**

predicate isSource(Node source, FlowState state);

/**

predicate isSink(Node sink, FlowState state);

/**

default predicate isSink(Node sink) { none() }

/**

default predicate isBarrier(Node node) { none() }

/**

default predicate isBarrier(Node node, FlowState state) { none() }

/** Holds if data flow into `node` is prohibited. */

default predicate isBarrierIn(Node node) { none() }

/** Holds if data flow into `node` is prohibited when the target flow state is `state`. */

default predicate isBarrierIn(Node node, FlowState state) { none() }

/** Holds if data flow out of `node` is prohibited. */

default predicate isBarrierOut(Node node) { none() }

/** Holds if data flow out of `node` is prohibited when the originating flow state is `state`. */

default predicate isBarrierOut(Node node, FlowState state) { none() }

/**

default predicate isAdditionalFlowStep(Node node1, Node node2) { none() }

/**

default predicate isAdditionalFlowStep(

Node node1, FlowState state1, Node node2, FlowState state2

) {

none()

}

/**

default predicate allowImplicitRead(Node node, ContentSet c) { none() }

/**

default predicate neverSkip(Node node) {

isAdditionalFlowStep(node, _) or

isAdditionalFlowStep(_, node) or

isAdditionalFlowStep(node, _, _, _) or

isAdditionalFlowStep(_, _, node, _)

}

/**

default int fieldFlowBranchLimit() { result = Lang::defaultFieldFlowBranchLimit() }

/** Gets the access path limit. */

default int accessPathLimit() { result = Lang::accessPathLimit() }

/**

default FlowFeature getAFeature() { none() }

/**

default predicate includeHiddenNodes() { none() }

/**

default predicate observeDiffInformedIncrementalMode() { none() }

/**

default Location getASelectedSourceLocation(Node source) { result = source.getLocation() }

/**

default Location getASelectedSinkLocation(Node sink) { result = sink.getLocation() }

}

signature module PathGraphSig<TypeWithToString PathNode> {

/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */

predicate edges(PathNode a, PathNode b, string key, string val);

/** Holds if `n` is a node in the graph of data flow path explanations. */

predicate nodes(PathNode n, string key, string val);

/**

predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out);

}

private import Lang

import Configs<Location, Lang>

/**

signature int explorationLimitSig();

/**

signature module GlobalFlowSig {

/**

class PathNode;

/**

predicate flowPath(PathNode source, PathNode sink);

/**

predicate flow(Node source, Node sink);

/**

predicate flowTo(Node sink);

/**

predicate flowToExpr(DataFlowExpr sink);

}

signature class PathNodeSig {

/** Gets a textual representation of this element. */

string toString();

/** Gets the underlying `Node`. */

Node getNode();

/** Gets the location of this node. */

Location getLocation();

}

import PathGraphSigMod

/**

module MergePathGraph<

PathNodeSig PathNode1, PathNodeSig PathNode2, PathGraphSig<PathNode1> Graph1,

PathGraphSig<PathNode2> Graph2>

{

private newtype TPathNode =

TPathNode1(PathNode1 p) or

TPathNode2(PathNode2 p)

/** A node in a graph of path explanations that is formed by disjoint union of the two given graphs. */

class PathNode extends TPathNode {

/** Gets this as a projection on the first given `PathGraph`. */

PathNode1 asPathNode1() { this = TPathNode1(result) }

/** Gets this as a projection on the second given `PathGraph`. */

PathNode2 asPathNode2() { this = TPathNode2(result) }

/** Gets a textual representation of this element. */

string toString() {

result = this.asPathNode1().toString() or

result = this.asPathNode2().toString()

}

/** Gets the underlying `Node`. */

Node getNode() {

result = this.asPathNode1().getNode() or

result = this.asPathNode2().getNode()

}

/** Gets the location of this node. */

Location getLocation() { result = this.getNode().getLocation() }

/**

deprecated predicate hasLocationInfo(

string filepath, int startline, int startcolumn, int endline, int endcolumn

) {

this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)

}

}

/**

module PathGraph implements PathGraphSig<PathNode> {

/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */

query predicate edges(PathNode a, PathNode b, string key, string val) {

Graph1::edges(a.asPathNode1(), b.asPathNode1(), key, val) or

Graph2::edges(a.asPathNode2(), b.asPathNode2(), key, val)

}

/** Holds if `n` is a node in the graph of data flow path explanations. */

query predicate nodes(PathNode n, string key, string val) {

Graph1::nodes(n.asPathNode1(), key, val) or

Graph2::nodes(n.asPathNode2(), key, val)

}

/**

query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {

Graph1::subpaths(arg.asPathNode1(), par.asPathNode1(), ret.asPathNode1(), out.asPathNode1()) or

Graph2::subpaths(arg.asPathNode2(), par.asPathNode2(), ret.asPathNode2(), out.asPathNode2())

}

}

}

/**

module MergePathGraph3<

PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,

PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>

{

private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;

private module Merged =

MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;

/** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */

class PathNode instanceof Merged::PathNode {

/** Gets this as a projection on the first given `PathGraph`. */

PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }

/** Gets this as a projection on the second given `PathGraph`. */

PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }

/** Gets this as a projection on the third given `PathGraph`. */

PathNode3 asPathNode3() { result = super.asPathNode2() }

/** Gets a textual representation of this element. */

string toString() { result = super.toString() }

/**

deprecated predicate hasLocationInfo(

string filepath, int startline, int startcolumn, int endline, int endcolumn

) {

super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)

}

/** Gets the underlying `Node`. */

Node getNode() { result = super.getNode() }

/** Gets the location of this node. */

Location getLocation() { result = super.getLocation() }

}

/**

module PathGraph implements PathGraphSig<PathNode> {

/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */

query predicate edges(PathNode a, PathNode b, string key, string val) {

Merged::PathGraph::edges(a, b, key, val)

}

/** Holds if `n` is a node in the graph of data flow path explanations. */

query predicate nodes(PathNode n, string key, string val) {

Merged::PathGraph::nodes(n, key, val)

}

/**

query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {

Merged::PathGraph::subpaths(arg, par, ret, out)

}

}

}

/**

module DeduplicatePathGraph<PathNodeSig InputPathNode, PathGraphSig<InputPathNode> Graph> {

// NOTE: there is a known limitation in that this module cannot see which nodes are sources or sinks.

// This only matters in the rare case where a sink PathNode has a non-empty set of succesors, and there is a

// non-sink PathNode with the same `(node, toString)` value and the same successors, but is transitively

// reachable from a different set of PathNodes. (And conversely for sources).

//

pragma[nomagic]

private InputPathNode getAPathNode(Node node, string toString) {

result.getNode() = node and

Graph::nodes(result, _, toString)

}

private signature predicate collapseCandidateSig(Node node, string toString);

private signature predicate stepSig(

InputPathNode node1, InputPathNode node2, string key, string val

);

private signature predicate subpathStepSig(

InputPathNode arg, InputPathNode param, InputPathNode ret, InputPathNode out

);

/**

private module MakeDiscriminatorPass<

collapseCandidateSig/2 collapseCandidate, stepSig/4 step, subpathStepSig/4 subpathStep>

{

/**

private int getOutDegreeFromPathNode(InputPathNode pathNode) {

result =

count(Node node, string toString, string key, string val |

step(pathNode, getAPathNode(node, toString), key, val)

)

}

/**

private int getOutDegreeFromNode(Node node, string toString) {

result =

strictcount(Node node2, string toString2, string key, string val |

step(getAPathNode(node, toString), getAPathNode(node2, toString2), key, val)

)

}

/**

private int getSubpathOutDegreeFromPathNode(InputPathNode pathNode) {

result =

count(Node n1, string s1, Node n2, string s2, Node n3, string s3 |

subpathStep(pathNode, getAPathNode(n1, s1), getAPathNode(n2, s2), getAPathNode(n3, s3))

)

}

/**

private int getSubpathOutDegreeFromNode(Node node, string toString) {

result =

strictcount(Node n1, string s1, Node n2, string s2, Node n3, string s3 |

subpathStep(getAPathNode(node, toString), getAPathNode(n1, s1), getAPathNode(n2, s2),

getAPathNode(n3, s3))

)

}

/** Gets a successor of `node`, including subpath flow-through, but not enter or exit subpath steps. */

InputPathNode stepEx(InputPathNode node) {

step(node, result, _, _) and

not result = enterSubpathStep(node) and

not result = exitSubpathStep(node)

or

// Assuming the input is pruned properly, all subpaths have flow-through.

// This step should be in 'step' as well, but include it here for clarity as we rely on it.

subpathStep(node, _, _, result)

}

InputPathNode enterSubpathStep(InputPathNode node) { subpathStep(node, result, _, _) }

InputPathNode exitSubpathStep(InputPathNode node) { subpathStep(_, _, node, result) }

/** Holds if `(node, toString)` cannot be collapsed (but was a candidate for being collapsed). */

predicate discriminatedPair(Node node, string toString, boolean hasEnter) {

collapseCandidate(node, toString) and

hasEnter = false and

(

// Check if all corresponding PathNodes have the same successor sets when projected to `(node, toString)`.

// To do this, we check that each successor set has the same size as the union of the succesor sets.

// - If the successor sets are equal, then they are also equal to their union, and so have the correct size.

// - Conversely, if two successor sets are not equal, one of them must be missing an element that is present

// in the union, but must still be a subset of the union, and thus be strictly smaller than the union.

getOutDegreeFromPathNode(getAPathNode(node, toString)) <

getOutDegreeFromNode(node, toString)

or

// Same as above but counting associated subpath triples instead

getSubpathOutDegreeFromPathNode(getAPathNode(node, toString)) <

getSubpathOutDegreeFromNode(node, toString)

)

or

collapseCandidate(node, toString) and

(

// Retain flow state if one of the successors requires it to be retained

discriminatedPathNode(stepEx(getAPathNode(node, toString)), hasEnter)

or

// Propagate backwards from parameter to argument

discriminatedPathNode(enterSubpathStep(getAPathNode(node, toString)), false) and

hasEnter = false

or

// Propagate backwards from out to return

discriminatedPathNode(exitSubpathStep(getAPathNode(node, toString)), _) and

hasEnter = true

)