github · asgerf · Sep 11, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
@@ -0,0 +1,10 @@
+private import unified
+private import codeql.unified.internal.dataflow.AllDataFlow
+private import codeql.dataflow.internal.DataFlowImplConsistency
+
+module ConsistencyInput implements InputSig<Location, DataFlowInput> { }
+
+module ConsistencyOutput =
+  MakeConsistency<Location, DataFlowInput, TaintTrackingInput, ConsistencyInput>;
+
+import ConsistencyOutput
@@ -0,0 +1,3 @@
+private import unified
+private import codeql.unified.internal.dataflow.LocalSsa
+import LocalSsaOutput::Consistency
@@ -60,15 +60,20 @@ module Public {
     TopLevelStmt() { this = any(TopLevel t).getBody().getAStmt() }
   }
 
+  /** An identifier appearing in the context of a break/continue label, argument/parameter name, or name of a member lookup. */
+  final class IdentifierLabel extends Identifier {
+    IdentifierLabel() {
+      this = any(MemberAccessExpr e).getMemberNameNode() or
+      this = any(Argument a).getNameNode() or
+      this = any(Parameter p).getExternalNameNode() or
+      this = any(LabeledStmt stmt).getLabelNameNode() or
+      this = any(BreakExpr expr).getLabelNameNode() or
+      this = any(ContinueExpr expr).getLabelNameNode()
+    }
+  }
+
   /** An identifier appearing in the context of an expression, pattern, or type annotation. */
   final class IdentifierExpr extends Identifier {
-    IdentifierExpr() {
-      not this = any(MemberAccessExpr e).getMemberNameNode() and
-      not this = any(Argument a).getNameNode() and
-      not this = any(Parameter p).getExternalNameNode() and
-      not this = any(LabeledStmt stmt).getLabelNameNode() and
-      not this = any(BreakExpr expr).getLabelNameNode() and
-      not this = any(ContinueExpr expr).getLabelNameNode()
-    }
+    IdentifierExpr() { not this instanceof IdentifierLabel }
   }
 }
@@ -0,0 +1,70 @@
+private import unified
+private import NameBinding as NameBinding
+
+/**
+ * Holds if `expr` appears in the context of a type annotation.
+ */
+predicate isInTypeContext(Expr expr) {
+  expr = any(TypeCastExpr n).getType()
+  or
+  expr = any(TypeTestExpr n).getType()
+  or
+  expr = any(VariableDeclaration n).getType()
+  or
+  expr = any(FunctionDeclaration n).getReturnType()
+  or
+  expr = any(FunctionExpr n).getReturnType()
+  or
+  expr = any(AccessorDeclaration n).getType()
+  or
+  expr = any(Parameter n).getType()
+  or
+  expr = any(TypeAliasDeclaration n).getType()
+  or
+  expr = any(BaseType n).getType()
+  or
+  expr = any(TypeParameter n).getBound()
+  or
+  expr = any(AssociatedTypeDeclaration n).getBound()
+  or
+  expr.getParent() instanceof TypeConstraint
+  or
+  isInTypeContext(expr.getEnclosingExpr())
+}
+
+/** Holds if `e` appears in a name-binding position inside `declaration` */
+predicate isInBindingContext(Expr e, AstNode declaration) {
+  NameBinding::bindingContext(e, _, declaration)
+}
+
+/** Holds if `e` is part of the target of `assignment`. */
+predicate isInAssignmentContext(Expr e, AstNode assignment) {
+  e = assignment.(AssignExpr).getTarget()
+  or
+  e = assignment.(CompoundAssignExpr).getTarget()
+  or
+  exists(TupleExpr tuple |
+    isInAssignmentContext(tuple, assignment) and
+    e = tuple.getAnElement().getValue()
+  )
+}
+
+/**
+ * Holds if `e` receives an incoming value because it is part of a binding pattern
+ * or assignment target.
+ */
+predicate hasIncomingValue(Expr e, AstNode declarationOrAssignment) {
+  isInBindingContext(e, declarationOrAssignment)
+  or
+  isInAssignmentContext(e, declarationOrAssignment)
+}
+
+/**
+ * Holds if `e` evaluates to a result.
+ */
+predicate hasResultValue(Expr e) {
+  not isInTypeContext(e) and
+  not isInBindingContext(e, _) and
+  not isInAssignmentContext(e, any(AssignExpr n)) and // non-compound assignment target
+  not e instanceof IdentifierLabel
+}
@@ -197,5 +197,8 @@ module Unified {
         result = arg.getValue()
       )
     }
+
+    /** Gets the number of arguments passed to this call, not counting implicit arguments like receiver. */
+    int getNumberOfArguments() { result = count(this.getAnArgument()) }
   }
 }
@@ -667,6 +667,9 @@ module Public {
     LocalVariable getImplicitQualifierVariable() {
       ResolveImplicitReceiverAccess::access(this, result)
     }
+
+    /** Gets the simple name of this identifier, that is, the name of the member being accessed. */
+    string getName() { result = this.getValue() }
   }
 }
 

@@ -0,0 +1,11 @@
+/** Re-exports all the files in the internal dataflow folder (except DataFlowPublic). */
+
+import Content
+import DataFlowGraph
+import DataFlowInstantiation
+import DataFlowNode
+import DataFlowPlugin
+import Step
+import LocalSsa
+import TaintTrackingInstantiation
+import VariableRefKind
@@ -0,0 +1,37 @@
+private import unified
+private import AllDataFlow
+
+private newtype TContent =
+  TNamedMember(string name) {
+    name = any(Identifier id).getValue()
+    or
+    // Tuple elements can be accessed as named members, e.g. `tuple.0`, `tuple.1`, etc,
+    // so just model their elements as named members.
+    name = [0 .. 20].toString()
+  }
+
+class Content extends TContent {
+  string asNamedMember() { this = TNamedMember(result) }
+
+  string toString() { result = this.asNamedMember() }
+
+  Location getLocation() { none() }
+}
+
+private newtype TContentSet = TSingleton(Content content)
+
+class ContentSet extends TContentSet {
+  Content asSingleton() { this = TSingleton(result) }
+
+  string toString() { result = this.asSingleton().toString() }
+
+  Location getLocation() { result = this.asSingleton().getLocation() }
+
+  Content getAStoreContent() { result = this.asSingleton() }
+
+  Content getAReadContent() { result = this.asSingleton() }
+}
+
+module ContentSet {
+  ContentSet namedMember(string name) { result.asSingleton().asNamedMember() = name }
+}
@@ -0,0 +1,118 @@
+private import unified
+private import AllDataFlow
+
+predicate step(Node node1, Step step, Node node2) {
+  any(DataFlowPlugin p).step(node1, step, node2)
+  or
+  exists(VariableDeclaration decl |
+    node1.isResultValue(decl.getValue()) and
+    step.value() and
+    node2.isIncomingValue(decl.getPattern())
+  )
+  or
+  exists(AssignExpr assign |
+    node1.isResultValue(assign.getValue()) and
+    step.value() and
+    node2.isIncomingValue(assign.getTarget())
+  )
+  or
+  exists(LocalVariableAccess access |
+    node1.isLocalVariableRead(access, access.getLocalVariable()) and
+    step.value() and
+    node2.isResultValue(access)
+    or
+    node1.isIncomingValue(access) and
+    step.value() and
+    node2.isLocalVariableWrite(access, access.getLocalVariable())
+    or
+    node1.isPostUpdate(access) and
+    step.value() and
+    node2.isLocalVariablePostUpdate(access, access.getLocalVariable())
+  )
+  or
+  exists(UnqualifiedMemberAccess access | access.isInstanceAccess() |
+    node1.isLocalVariableRead(access, access.getImplicitQualifierVariable()) and
+    step.readName(access.getName()) and
+    node2.isResultValue(access)
+    or
+    (node1.isIncomingValue(access) or node1.isPostUpdate(access)) and
+    step.storeName(access.getName()) and
+    node2.isLocalVariablePostUpdate(access, access.getImplicitQualifierVariable())
+  )
+  or
+  exists(StringInterpolationExpr expr |
+    node1.isResultValue(expr.getAnElement()) and
+    step.taint() and
+    node2.isResultValue(expr)
+  )
+  or
+  exists(TupleExpr expr, int i |
+    node1.isResultValue(expr.getElement(i).getValue()) and
+    step.storeName(i.toString()) and
+    node2.isResultValue(expr)
+    or
+    node1.isIncomingValue(expr) and
+    step.readName(i.toString()) and
+    node2.isIncomingValue(expr.getElement(i).getValue())
+  )
+  or
+  exists(MemberAccessExpr expr |
+    node1.isResultValue(expr.getBase()) and
+    step.readName(expr.getMemberName()) and
+    node2.isResultValue(expr)
+    or
+    (node1.isIncomingValue(expr) or node1.isPostUpdate(expr)) and
+    step.storeName(expr.getMemberName()) and
+    node2.isPostUpdate(expr.getBase())
+  )
+  or
+  none() // Temporarily disable compilation errors from unsatisfiable types
+}
+
+/** Holds if `node` should be included in the debug view. */
+private signature predicate relevantNodeSig(AstNode node);
+
+module DebugGraph<relevantNodeSig/1 relevantNode> {
+  private Node adjacent(Node n) {
+    step(n, _, result)
+    or
+    step(result, _, n)
+    or
+    localSsaStep(n, result, _)
+    or
+    localSsaStep(result, n, _)
+  }
+
+  private predicate relevantDataFlowNode(Node node) {
+    relevantNode(node.getWrappedAstNode())
+    or
+    not exists(node.getWrappedAstNode()) and
+    relevantDataFlowNode(adjacent(node))
+  }
+
+  query predicate nodes(Node node, string key, string value) {
+    relevantDataFlowNode(node) and
+    key = "semmle.label" and
+    value = node.toString()
+  }
+
+  query predicate edges(Node node1, Node node2, string key, string value) {
+    key = "semmle.label" and
+    relevantDataFlowNode(node1) and
+    relevantDataFlowNode(node2) and
+    (
+      exists(Step step |
+        step(node1, step, node2) and
+        value = step.toString()
+      )
+      or
+      exists(boolean isUseStep |
+        localSsaStep(node1, node2, isUseStep) and
+        if isUseStep = true then value = "use-use" else value = "def-use"
+      )
+      or
+      node2 = getPostUpdateNode(node1) and
+      value = "post-update"
+    )
+  }
+}