From 664453707a36b386a15f6e53f861bfc2786bdbf6 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 5 Dec 2018 11:00:15 +0100
Subject: [PATCH 01/69] C#: Speedup `Assertions::strictlyDominates()` and
 `ControlFlowElement::controlsBlock()`

Only calculate dominance by explicit recursion for split nodes; all other nodes
can use regular CFG dominance.
---
 .../semmle/code/csharp/commons/Assertions.qll | 32 ++++++---
 .../code/csharp/controlflow/BasicBlocks.qll   |  1 +
 .../csharp/controlflow/ControlFlowElement.qll | 72 ++++++++++++++-----
 .../csharp/controlflow/ControlFlowGraph.qll   |  7 ++
 4 files changed, 82 insertions(+), 30 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/commons/Assertions.qll b/csharp/ql/src/semmle/code/csharp/commons/Assertions.qll
index 5fa5bb92ad73..f7f0183b1da6 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Assertions.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Assertions.qll
@@ -51,6 +51,9 @@ class Assertion extends MethodCall {
 
   pragma[nomagic]
   private JoinBlockPredecessor getAPossiblyDominatedPredecessor(JoinBlock jb) {
+    // Only calculate dominance by explicit recursion for split nodes;
+    // all other nodes can use regular CFG dominance
+    this instanceof ControlFlow::Internal::SplitControlFlowElement and
     exists(BasicBlock bb |
       bb = this.getAControlFlowNode().getBasicBlock() |
       result = bb.getASuccessor*()
@@ -70,6 +73,22 @@ class Assertion extends MethodCall {
     )
   }
 
+  pragma[nomagic]
+  private predicate strictlyDominatesSplit(BasicBlock bb) {
+    this.getAControlFlowNode().getBasicBlock().immediatelyDominates(bb)
+    or
+    if bb instanceof JoinBlock then
+      this.isPossiblyDominatedJoinBlock(bb) and
+      forall(BasicBlock pred |
+        pred = this.getAPossiblyDominatedPredecessor(bb) |
+        this.strictlyDominatesSplit(pred)
+        or
+        this.getAControlFlowNode().getBasicBlock() = pred
+      )
+    else
+      this.strictlyDominatesSplit(bb.getAPredecessor())
+  }
+
   /**
    * Holds if this assertion strictly dominates basic block `bb`. That is, `bb`
    * can only be reached from the callable entry point by going via *some* basic
@@ -81,18 +100,9 @@ class Assertion extends MethodCall {
    */
   pragma[nomagic]
   predicate strictlyDominates(BasicBlock bb) {
-    this.getAControlFlowNode().getBasicBlock().immediatelyDominates(bb)
+    this.strictlyDominatesSplit(bb)
     or
-    if bb instanceof JoinBlock then
-      this.isPossiblyDominatedJoinBlock(bb) and
-      forall(BasicBlock pred |
-        pred = this.getAPossiblyDominatedPredecessor(bb) |
-        this.strictlyDominates(pred)
-        or
-        this.getAControlFlowNode().getBasicBlock() = pred
-      )
-    else
-      this.strictlyDominates(bb.getAPredecessor())
+    this.getAControlFlowNode().getBasicBlock().strictlyDominates(bb)
   }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll b/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
index 2edf13d12765..7ab1a0ba3b39 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
@@ -473,6 +473,7 @@ class ConditionBlock extends BasicBlock {
    * successor of this block, and `succ` can only be reached from
    * the callable entry point by going via the `s` edge out of this basic block.
    */
+  pragma[nomagic]
   predicate immediatelyControls(BasicBlock succ, ConditionalSuccessor s) {
     succ = this.getASuccessorByType(s) and
     forall(BasicBlock pred |
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
index fcd0f61aa059..15481f02956c 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
@@ -79,12 +79,23 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
    * `pred` ending with this element, and `pred` is an immediate predecessor
    * of `succ`.
    *
-   * This predicate is different from
-   * `this.getAControlFlowNode().getBasicBlock().(ConditionBlock).immediatelyControls(succ, s)`
-   * in that it takes control flow splitting into account.
+   * Moroever, this control flow element corresponds to multiple control flow nodes,
+   * which is why
+   *
+   * ```
+   * exists(ConditionBlock cb |
+   *   cb.getLastNode() = this.getAControlFlowNode() |
+   *   cb.immediatelyControls(succ, s)
+   * )
+   * ```
+   *
+   * does not work.
    */
   pragma[nomagic]
-  private predicate immediatelyControls(BasicBlock succ, ConditionalSuccessor s) {
+  private predicate immediatelyControlsBlockSplit(BasicBlock succ, ConditionalSuccessor s) {
+    // Only calculate dominance by explicit recursion for split nodes;
+    // all other nodes can use regular CFG dominance
+    this instanceof ControlFlow::Internal::SplitControlFlowElement and
     exists(ConditionBlock cb |
       cb.getLastNode() = this.getAControlFlowNode() |
       succ = cb.getASuccessorByType(s) and
@@ -103,7 +114,7 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
   pragma[nomagic]
   private JoinBlockPredecessor getAPossiblyControlledPredecessor(JoinBlock controlled, ConditionalSuccessor s) {
     exists(BasicBlock mid |
-      this.immediatelyControls(mid, s) |
+      this.immediatelyControlsBlockSplit(mid, s) |
       result = mid.getASuccessor*()
     ) and
     result.getASuccessor() = controlled and
@@ -121,6 +132,20 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
     )
   }
 
+  cached
+  private predicate controlsBlockSplit(BasicBlock controlled, ConditionalSuccessor s) {
+    this.immediatelyControlsBlockSplit(controlled, s)
+    or
+    if controlled instanceof JoinBlock then
+      this.isPossiblyControlledJoinBlock(controlled, s) and
+      forall(BasicBlock pred |
+        pred = this.getAPossiblyControlledPredecessor(controlled, s) |
+        this.controlsBlock(pred, s)
+      )
+    else
+      this.controlsBlockSplit(controlled.getAPredecessor(), s)
+  }
+
   /**
    * Holds if basic block `controlled` is controlled by this control flow element
    * with conditional value `s`. That is, `controlled` can only be reached from
@@ -128,21 +153,23 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
    * ending with this element.
    *
    * This predicate is different from
-   * `this.getAControlFlowNode().getBasicBlock().(ConditionBlock).controls(controlled, s)`
-   * in that it takes control flow splitting into account.
+   *
+   * ```
+   * exists(ConditionBlock cb |
+   *   cb.getLastNode() = this.getAControlFlowNode() |
+   *   cb.controls(controlled, s)
+   * )
+   * ```
+   *
+   * as control flow splitting is taken into account.
    */
-  cached
   predicate controlsBlock(BasicBlock controlled, ConditionalSuccessor s) {
-    this.immediatelyControls(controlled, s)
+    this.controlsBlockSplit(controlled, s)
     or
-    if controlled instanceof JoinBlock then
-      this.isPossiblyControlledJoinBlock(controlled, s) and
-      forall(BasicBlock pred |
-        pred = this.getAPossiblyControlledPredecessor(controlled, s) |
-        this.controlsBlock(pred, s)
-      )
-    else
-      this.controlsBlock(controlled.getAPredecessor(), s)
+    exists(ConditionBlock cb |
+      cb.getLastNode() = this.getAControlFlowNode() |
+      cb.controls(controlled, s)
+    )
   }
 
   /**
@@ -151,8 +178,15 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
    * from the callable entry point by going via the `s` edge out of this element.
    *
    * This predicate is different from
-   * `this.getAControlFlowNode().getBasicBlock().(ConditionBlock).controls(controlled.getAControlFlowNode().getBasicBlock(), s)`
-   * in that it takes control flow splitting into account.
+   *
+   * ```
+   * exists(ConditionBlock cb |
+   *   cb.getLastNode() = this.getAControlFlowNode() |
+   *   cb.controls(controlled.getAControlFlowNode().getBasicBlock(), s)
+   * )
+   * ```
+   *
+   * as control flow splitting is taken into account.
    */
   pragma[inline] // potentially very large predicate, so must be inlined
   predicate controlsElement(ControlFlowElement controlled, ConditionalSuccessor s) {
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
index 8a594bbeb69d..8d2600469438 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
@@ -4185,6 +4185,13 @@ module ControlFlow {
       }
     }
     import Cached
+
+    /** A control flow element that is split into multiple control flow nodes. */
+    class SplitControlFlowElement extends ControlFlowElement {
+      SplitControlFlowElement() {
+        strictcount(this.getAControlFlowNode()) > 1
+      }
+    }
   }
   private import Internal
 }

From e05bbb0f106f0b6793c5d7c392562648c88dab7d Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 7 Dec 2018 15:46:27 +0100
Subject: [PATCH 02/69] C#: Fix always-`null` bug in TRAP writer

---
 csharp/extractor/Semmle.Extraction/TrapWriter.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/extractor/Semmle.Extraction/TrapWriter.cs b/csharp/extractor/Semmle.Extraction/TrapWriter.cs
index cdc31019d1f1..25003e4e53d6 100644
--- a/csharp/extractor/Semmle.Extraction/TrapWriter.cs
+++ b/csharp/extractor/Semmle.Extraction/TrapWriter.cs
@@ -285,7 +285,7 @@ private void ArchiveContents(string fullInputPath, string contents)
         public static string NestPaths(ILogger logger, string outerpath, string innerpath, InnerPathComputation innerPathComputation)
         {
             string nested = innerpath;
-            if (outerpath != null || outerpath.Length != 0)
+            if (!string.IsNullOrEmpty(outerpath))
             {
                 if (!Path.IsPathRooted(innerpath) && innerPathComputation == InnerPathComputation.ABSOLUTE)
                     innerpath = Path.GetFullPath(innerpath);

From 6411d1c7dd69c4f4671f32e770543ce2e7728465 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 7 Dec 2018 15:47:20 +0100
Subject: [PATCH 03/69] C#: Refactor operator call logic

Refactored to make it clear when `@operator.Symbol as IMethodSymbol` can be `null`.
---
 .../Semmle.Extraction.CSharp/Entities/Expression.cs  | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index c050d4d83e95..d88050b545bf 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -119,14 +119,15 @@ public void OperatorCall(ExpressionSyntax node)
             var @operator = cx.GetSymbolInfo(node);
             var method = @operator.Symbol as IMethodSymbol;
 
-            if (GetCallType(cx, node) == CallType.Dynamic)
+            var callType = GetCallType(cx, node);
+            if (callType == CallType.Dynamic)
             {
                 UserOperator.OperatorSymbol(method.Name, out string operatorName);
                 cx.Emit(Tuples.dynamic_member_name(this, operatorName));
                 return;
             }
 
-            if (method != null)
+            if (callType != CallType.None)
                 cx.Emit(Tuples.expr_call(this, Method.Create(cx, method)));
         }
 
@@ -148,12 +149,9 @@ public static CallType GetCallType(Context cx, ExpressionSyntax node)
         {
             var @operator = cx.GetSymbolInfo(node);
 
-            if (@operator.Symbol != null)
+            if (@operator.Symbol is IMethodSymbol method)
             {
-                var method = @operator.Symbol as IMethodSymbol;
-
-                var containingSymbol = method.ContainingSymbol as ITypeSymbol;
-                if (containingSymbol != null && containingSymbol.TypeKind == Microsoft.CodeAnalysis.TypeKind.Dynamic)
+                if (method.ContainingSymbol is ITypeSymbol containingSymbol && containingSymbol.TypeKind == Microsoft.CodeAnalysis.TypeKind.Dynamic)
                 {
                     return CallType.Dynamic;
                 }

From 8d072863dfa8194481309a813ddc100780480ca2 Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Mon, 10 Dec 2018 18:51:22 +0000
Subject: [PATCH 04/69] C#: Reorder for statements to ensure variables declared
 in the condition are declared before they are used.

---
 .../Entities/Statements/For.cs                        | 10 +++++-----
 csharp/ql/test/library-tests/csharp7/CSharp7.cs       | 11 +++++++++++
 csharp/ql/test/library-tests/csharp7/DefUse.expected  |  7 +++++++
 .../ql/test/library-tests/csharp7/IsPatterns.expected |  1 +
 .../library-tests/csharp7/LocalTaintFlow.expected     | 11 +++++++++++
 .../library-tests/csharp7/LocalVariables.expected     |  2 ++
 6 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
index 2c918af83ef6..c0860d21d127 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
@@ -28,7 +28,10 @@ protected override void Populate()
                 Expression.Create(cx, init, this, child--);
             }
 
-            Statement.Create(cx, Stmt.Statement, this, 1 + Stmt.Incrementors.Count);
+            if (Stmt.Condition != null)
+            {
+                Expression.Create(cx, Stmt.Condition, this, 0);
+            }
 
             child = 1;
             foreach (var inc in Stmt.Incrementors)
@@ -36,10 +39,7 @@ protected override void Populate()
                 Expression.Create(cx, inc, this, child++);
             }
 
-            if (Stmt.Condition != null)
-            {
-                Expression.Create(cx, Stmt.Condition, this, 0);
-            }
+            Statement.Create(cx, Stmt.Statement, this, 1 + Stmt.Incrementors.Count);
         }
     }
 }
diff --git a/csharp/ql/test/library-tests/csharp7/CSharp7.cs b/csharp/ql/test/library-tests/csharp7/CSharp7.cs
index 7a2898a97e46..0b0c543216f1 100644
--- a/csharp/ql/test/library-tests/csharp7/CSharp7.cs
+++ b/csharp/ql/test/library-tests/csharp7/CSharp7.cs
@@ -290,3 +290,14 @@ void Test()
         foreach (var (a, b) in list) { }
     }
 }
+
+class ForLoops
+{
+    void Test()
+    {
+        for(int x=0; x<10 && x is int y; ++x)
+        {
+            Console.WriteLine(y);
+        }
+    }
+}
diff --git a/csharp/ql/test/library-tests/csharp7/DefUse.expected b/csharp/ql/test/library-tests/csharp7/DefUse.expected
index e6f5a6c407b9..93bdff568c26 100644
--- a/csharp/ql/test/library-tests/csharp7/DefUse.expected
+++ b/csharp/ql/test/library-tests/csharp7/DefUse.expected
@@ -66,3 +66,10 @@
 | CSharp7.cs:284:13:284:62 | IEnumerable<(Int32,String)> list = ... | CSharp7.cs:290:32:290:35 | access to local variable list |
 | CSharp7.cs:284:32:284:35 | item | CSharp7.cs:284:41:284:44 | access to parameter item |
 | CSharp7.cs:284:32:284:35 | item | CSharp7.cs:284:51:284:54 | access to parameter item |
+| CSharp7.cs:298:17:298:19 | Int32 x = ... | CSharp7.cs:298:22:298:22 | access to local variable x |
+| CSharp7.cs:298:17:298:19 | Int32 x = ... | CSharp7.cs:298:30:298:30 | access to local variable x |
+| CSharp7.cs:298:17:298:19 | Int32 x = ... | CSharp7.cs:298:44:298:44 | access to local variable x |
+| CSharp7.cs:298:35:298:39 | Int32 y | CSharp7.cs:300:31:300:31 | access to local variable y |
+| CSharp7.cs:298:42:298:44 | ++... | CSharp7.cs:298:22:298:22 | access to local variable x |
+| CSharp7.cs:298:42:298:44 | ++... | CSharp7.cs:298:30:298:30 | access to local variable x |
+| CSharp7.cs:298:42:298:44 | ++... | CSharp7.cs:298:44:298:44 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/csharp7/IsPatterns.expected b/csharp/ql/test/library-tests/csharp7/IsPatterns.expected
index 054a9accab33..6259acf8790f 100644
--- a/csharp/ql/test/library-tests/csharp7/IsPatterns.expected
+++ b/csharp/ql/test/library-tests/csharp7/IsPatterns.expected
@@ -2,3 +2,4 @@
 | CSharp7.cs:238:18:238:31 | ... is ... | CSharp7.cs:238:23:238:28 | access to type String | String | CSharp7.cs:238:23:238:31 | String s1 | false |
 | CSharp7.cs:245:18:245:28 | ... is ... | CSharp7.cs:245:23:245:25 | access to type Object | Object | CSharp7.cs:245:23:245:28 | Object v1 | true |
 | CSharp7.cs:255:27:255:40 | ... is ... | CSharp7.cs:255:32:255:37 | access to type String | String | CSharp7.cs:255:32:255:40 | String s4 | false |
+| CSharp7.cs:298:30:298:39 | ... is ... | CSharp7.cs:298:35:298:37 | access to type Int32 | Int32 | CSharp7.cs:298:35:298:39 | Int32 y | false |
diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
index f07a6f7efc86..32766ee67a39 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
@@ -193,3 +193,14 @@
 | CSharp7.cs:288:36:288:39 | access to local variable list | CSharp7.cs:290:32:290:35 | access to local variable list |
 | CSharp7.cs:290:23:290:23 | Int32 a | CSharp7.cs:290:18:290:27 | (..., ...) |
 | CSharp7.cs:290:26:290:26 | String b | CSharp7.cs:290:18:290:27 | (..., ...) |
+| CSharp7.cs:298:17:298:19 | SSA def(x) | CSharp7.cs:298:22:298:39 | SSA phi(x) |
+| CSharp7.cs:298:19:298:19 | 0 | CSharp7.cs:298:17:298:19 | SSA def(x) |
+| CSharp7.cs:298:22:298:22 | access to local variable x | CSharp7.cs:298:22:298:25 | ... < ... |
+| CSharp7.cs:298:22:298:22 | access to local variable x | CSharp7.cs:298:30:298:30 | access to local variable x |
+| CSharp7.cs:298:22:298:25 | ... < ... | CSharp7.cs:298:22:298:39 | ... && ... |
+| CSharp7.cs:298:22:298:39 | SSA phi(x) | CSharp7.cs:298:22:298:22 | access to local variable x |
+| CSharp7.cs:298:30:298:30 | access to local variable x | CSharp7.cs:298:35:298:39 | SSA def(y) |
+| CSharp7.cs:298:30:298:30 | access to local variable x | CSharp7.cs:298:44:298:44 | access to local variable x |
+| CSharp7.cs:298:30:298:39 | ... is ... | CSharp7.cs:298:22:298:39 | ... && ... |
+| CSharp7.cs:298:35:298:39 | SSA def(y) | CSharp7.cs:300:31:300:31 | access to local variable y |
+| CSharp7.cs:298:42:298:44 | SSA def(x) | CSharp7.cs:298:22:298:39 | SSA phi(x) |
diff --git a/csharp/ql/test/library-tests/csharp7/LocalVariables.expected b/csharp/ql/test/library-tests/csharp7/LocalVariables.expected
index 95cfa37a6267..1e04aeafd004 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalVariables.expected
+++ b/csharp/ql/test/library-tests/csharp7/LocalVariables.expected
@@ -65,3 +65,5 @@
 | CSharp7.cs:288:30:288:30 | b | string |
 | CSharp7.cs:290:23:290:23 | a | int |
 | CSharp7.cs:290:26:290:26 | b | string |
+| CSharp7.cs:298:17:298:17 | x | int |
+| CSharp7.cs:298:39:298:39 | y | int |

From f0fb47cde0b099b29230c65ab3f7343cc6182296 Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Tue, 11 Dec 2018 10:31:39 +0000
Subject: [PATCH 05/69] C#: Update change notes.

---
 change-notes/1.20/analysis-csharp.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/change-notes/1.20/analysis-csharp.md b/change-notes/1.20/analysis-csharp.md
index 13ec3648eb2e..6c80a8be29a3 100644
--- a/change-notes/1.20/analysis-csharp.md
+++ b/change-notes/1.20/analysis-csharp.md
@@ -17,6 +17,8 @@
 
 ## Changes to code extraction
 
+* Fix extraction of `for` statements where the condition declares new variables using `is`.
+
 ## Changes to QL libraries
 
 ## Changes to the autobuilder

From e80837681fce130fe64f61091fc4ad22496ec90f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 7 Dec 2018 15:48:38 +0100
Subject: [PATCH 06/69] C#: Refactor LINQ logic

Factor `ClauseCall` out into three classes to make it clear when the fields
`operand` and `declaration` can be `null`.
---
 .../Entities/Expressions/Query.cs             | 189 ++++++++++--------
 1 file changed, 102 insertions(+), 87 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
index d5c8ead52fd1..18a016d07096 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
@@ -33,58 +33,37 @@ public QueryCall(Context cx, IMethodSymbol method, SyntaxNode clause, IExpressio
         /// <summary>
         /// Represents a chain of method calls (the operand being recursive).
         /// </summary>
-        class ClauseCall
+        abstract class Clause
         {
-            public ClauseCall operand;
-            public IMethodSymbol method;
-            public readonly List<ExpressionSyntax> arguments = new List<ExpressionSyntax>();
-            public SyntaxNode node;
-            public ISymbol declaration;
-            public SyntaxToken name;
-            public ISymbol intoDeclaration;
+            protected readonly IMethodSymbol method;
+            protected readonly List<ExpressionSyntax> arguments = new List<ExpressionSyntax>();
+            protected readonly SyntaxNode node;
 
-            public ExpressionSyntax Expr => arguments.First();
-
-            public ClauseCall WithClause(IMethodSymbol newMethod, SyntaxNode newNode, SyntaxToken newName = default(SyntaxToken), ISymbol newDeclaration = null)
+            protected Clause(IMethodSymbol method, SyntaxNode node)
             {
-                return new ClauseCall
-                {
-                    operand = this,
-                    method = newMethod,
-                    node = newNode,
-                    name = newName,
-                    declaration = newDeclaration
-                };
+                this.method = method;
+                this.node = node;
             }
 
-            public ClauseCall AddArgument(ExpressionSyntax arg)
-            {
-                if (arg != null)
-                    arguments.Add(arg);
-                return this;
-            }
+            public ExpressionSyntax Expr => arguments.First();
 
-            public ClauseCall WithInto(ISymbol into)
-            {
-                intoDeclaration = into;
-                return this;
-            }
+            public CallClause WithCallClause(IMethodSymbol newMethod, SyntaxNode newNode) =>
+                new CallClause(this, newMethod, newNode);
 
-            Expression DeclareRangeVariable(Context cx, IExpressionParentEntity parent, int child, bool getElement)
-            {
-                return DeclareRangeVariable(cx, parent, child, getElement, declaration);
-            }
+            public LetClause WithLetClause(IMethodSymbol newMethod, SyntaxNode newNode, ISymbol newDeclaration, SyntaxToken newName) =>
+                new LetClause(this, newMethod, newNode, newDeclaration, newName);
 
-            void DeclareIntoVariable(Context cx, IExpressionParentEntity parent, int intoChild, bool getElement)
+            public Clause AddArgument(ExpressionSyntax arg)
             {
-                if (intoDeclaration != null)
-                    DeclareRangeVariable(cx, parent, intoChild, getElement, intoDeclaration);
+                if (arg != null)
+                    arguments.Add(arg);
+                return this;
             }
 
-            Expression DeclareRangeVariable(Context cx, IExpressionParentEntity parent, int child, bool getElement, ISymbol variableSymbol)
+            protected Expression DeclareRangeVariable(Context cx, IExpressionParentEntity parent, int child, bool getElement, ISymbol variableSymbol, SyntaxToken name)
             {
                 var type = Type.Create(cx, cx.GetType(Expr));
-                Semmle.Extraction.Entities.Location nameLoc;
+                Extraction.Entities.Location nameLoc;
 
                 Type declType;
                 if (getElement)
@@ -115,7 +94,7 @@ Expression DeclareRangeVariable(Context cx, IExpressionParentEntity parent, int
                 return decl;
             }
 
-            void PopulateArguments(Context cx, QueryCall callExpr, int child)
+            protected void PopulateArguments(Context cx, QueryCall callExpr, int child)
             {
                 foreach (var e in arguments)
                 {
@@ -123,34 +102,79 @@ void PopulateArguments(Context cx, QueryCall callExpr, int child)
                 }
             }
 
-            public Expression Populate(Context cx, IExpressionParentEntity parent, int child)
+            public abstract Expression Populate(Context cx, IExpressionParentEntity parent, int child);
+        }
+
+        class RangeClause : Clause
+        {
+            readonly ISymbol declaration;
+            readonly SyntaxToken name;
+
+            public RangeClause(IMethodSymbol method, SyntaxNode node, ISymbol declaration, SyntaxToken name) : base(method, node)
             {
-                if (declaration != null)    // The first "from" clause, or a "let" clause
-                {
-                    if (operand == null)
-                    {
-                        return DeclareRangeVariable(cx, parent, child, true);
-                    }
-                    else
-                    {
-                        if (method == null)
-                            cx.ModelError(node, "Unable to determine target of query expression");
-
-                        var callExpr = new QueryCall(cx, method, node, parent, child);
-                        operand.Populate(cx, callExpr, 0);
-                        DeclareRangeVariable(cx, callExpr, 1, false);
-                        PopulateArguments(cx, callExpr, 2);
-                        DeclareIntoVariable(cx, callExpr, 2 + arguments.Count, false);
-                        return callExpr;
-                    }
-                }
-                else
-                {
-                    var callExpr = new QueryCall(cx, method, node, parent, child);
-                    operand.Populate(cx, callExpr, 0);
-                    PopulateArguments(cx, callExpr, 1);
-                    return callExpr;
-                }
+                this.declaration = declaration;
+                this.name = name;
+            }
+
+            public override Expression Populate(Context cx, IExpressionParentEntity parent, int child) =>
+                DeclareRangeVariable(cx, parent, child, true, declaration, name);
+        }
+
+        class LetClause : Clause
+        {
+            readonly Clause operand;
+            readonly ISymbol declaration;
+            readonly SyntaxToken name;
+            ISymbol intoDeclaration;
+
+            public LetClause(Clause operand, IMethodSymbol method, SyntaxNode node, ISymbol declaration, SyntaxToken name) : base(method, node)
+            {
+                this.operand = operand;
+                this.declaration = declaration;
+                this.name = name;
+            }
+
+            public Clause WithInto(ISymbol into)
+            {
+                intoDeclaration = into;
+                return this;
+            }
+
+            void DeclareIntoVariable(Context cx, IExpressionParentEntity parent, int intoChild, bool getElement)
+            {
+                if (intoDeclaration != null)
+                    DeclareRangeVariable(cx, parent, intoChild, getElement, intoDeclaration, name);
+            }
+
+            public override Expression Populate(Context cx, IExpressionParentEntity parent, int child)
+            {
+                if (method == null)
+                    cx.ModelError(node, "Unable to determine target of query expression");
+
+                var callExpr = new QueryCall(cx, method, node, parent, child);
+                operand.Populate(cx, callExpr, 0);
+                DeclareRangeVariable(cx, callExpr, 1, false, declaration, name);
+                PopulateArguments(cx, callExpr, 2);
+                DeclareIntoVariable(cx, callExpr, 2 + arguments.Count, false);
+                return callExpr;
+            }
+        }
+
+        class CallClause : Clause
+        {
+            readonly Clause operand;
+
+            public CallClause(Clause operand, IMethodSymbol method, SyntaxNode node) : base(method, node)
+            {
+                this.operand = operand;
+            }
+
+            public override Expression Populate(Context cx, IExpressionParentEntity parent, int child)
+            {
+                var callExpr = new QueryCall(cx, method, node, parent, child);
+                operand.Populate(cx, callExpr, 0);
+                PopulateArguments(cx, callExpr, 1);
+                return callExpr;
             }
         }
 
@@ -161,18 +185,12 @@ public Expression Populate(Context cx, IExpressionParentEntity parent, int child
         /// <param name="cx">The extraction context.</param>
         /// <param name="node">The query expression.</param>
         /// <returns>A "syntax tree" of the query.</returns>
-        static ClauseCall ConstructQueryExpression(Context cx, QueryExpressionSyntax node)
+        static Clause ConstructQueryExpression(Context cx, QueryExpressionSyntax node)
         {
             var info = cx.Model(node).GetQueryClauseInfo(node.FromClause);
             var method = info.OperationInfo.Symbol as IMethodSymbol;
 
-            ClauseCall clauseExpr = new ClauseCall
-            {
-                declaration = cx.Model(node).GetDeclaredSymbol(node.FromClause),
-                name = node.FromClause.Identifier,
-                method = method,
-                node = node.FromClause
-            }.AddArgument(node.FromClause.Expression);
+            Clause clauseExpr = new RangeClause(method, node.FromClause, cx.Model(node).GetDeclaredSymbol(node.FromClause), node.FromClause.Identifier).AddArgument(node.FromClause.Expression);
 
             foreach (var qc in node.Body.Clauses)
             {
@@ -188,7 +206,7 @@ static ClauseCall ConstructQueryExpression(Context cx, QueryExpressionSyntax nod
                         {
                             method = cx.Model(node).GetSymbolInfo(ordering).Symbol as IMethodSymbol;
 
-                            clauseExpr = clauseExpr.WithClause(method, orderByClause).AddArgument(ordering.Expression);
+                            clauseExpr = clauseExpr.WithCallClause(method, orderByClause).AddArgument(ordering.Expression);
 
                             if (method == null)
                                 cx.ModelError(ordering, "Could not determine method call for orderby clause");
@@ -196,23 +214,23 @@ static ClauseCall ConstructQueryExpression(Context cx, QueryExpressionSyntax nod
                         break;
                     case SyntaxKind.WhereClause:
                         var whereClause = (WhereClauseSyntax)qc;
-                        clauseExpr = clauseExpr.WithClause(method, whereClause).AddArgument(whereClause.Condition);
+                        clauseExpr = clauseExpr.WithCallClause(method, whereClause).AddArgument(whereClause.Condition);
                         break;
                     case SyntaxKind.FromClause:
                         var fromClause = (FromClauseSyntax)qc;
                         clauseExpr = clauseExpr.
-                            WithClause(method, fromClause, fromClause.Identifier, cx.Model(node).GetDeclaredSymbol(fromClause)).
+                            WithLetClause(method, fromClause, cx.Model(node).GetDeclaredSymbol(fromClause), fromClause.Identifier).
                             AddArgument(fromClause.Expression);
                         break;
                     case SyntaxKind.LetClause:
                         var letClause = (LetClauseSyntax)qc;
-                        clauseExpr = clauseExpr.WithClause(method, letClause, letClause.Identifier, cx.Model(node).GetDeclaredSymbol(letClause)).
+                        clauseExpr = clauseExpr.WithLetClause(method, letClause, cx.Model(node).GetDeclaredSymbol(letClause), letClause.Identifier).
                             AddArgument(letClause.Expression);
                         break;
                     case SyntaxKind.JoinClause:
                         var joinClause = (JoinClauseSyntax)qc;
 
-                        clauseExpr = clauseExpr.WithClause(method, joinClause, joinClause.Identifier, cx.Model(node).GetDeclaredSymbol(joinClause)).
+                        clauseExpr = clauseExpr.WithLetClause(method, joinClause, cx.Model(node).GetDeclaredSymbol(joinClause), joinClause.Identifier).
                             AddArgument(joinClause.InExpression).
                             AddArgument(joinClause.LeftExpression).
                             AddArgument(joinClause.RightExpression);
@@ -220,7 +238,7 @@ static ClauseCall ConstructQueryExpression(Context cx, QueryExpressionSyntax nod
                         if (joinClause.Into != null)
                         {
                             var into = cx.Model(node).GetDeclaredSymbol(joinClause.Into);
-                            clauseExpr.WithInto(into);
+                            ((LetClause)clauseExpr).WithInto(into);
                         }
 
                         break;
@@ -231,16 +249,13 @@ static ClauseCall ConstructQueryExpression(Context cx, QueryExpressionSyntax nod
 
             method = cx.Model(node).GetSymbolInfo(node.Body.SelectOrGroup).Symbol as IMethodSymbol;
 
-            var selectClause = node.Body.SelectOrGroup as SelectClauseSyntax;
-            var groupClause = node.Body.SelectOrGroup as GroupClauseSyntax;
-
-            clauseExpr = new ClauseCall { operand = clauseExpr, method = method, node = node.Body.SelectOrGroup };
+            clauseExpr = new CallClause(clauseExpr, method, node.Body.SelectOrGroup);
 
-            if (selectClause != null)
+            if (node.Body.SelectOrGroup is SelectClauseSyntax selectClause)
             {
                 clauseExpr.AddArgument(selectClause.Expression);
             }
-            else if (groupClause != null)
+            else if (node.Body.SelectOrGroup is GroupClauseSyntax groupClause)
             {
                 clauseExpr.
                     AddArgument(groupClause.GroupExpression).

From 1366638f061bbfe9a28a531a0b5d9c1f383a4dcc Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 12 Dec 2018 13:13:13 +0100
Subject: [PATCH 07/69] C#: Fix whitespaces

---
 .../Collections/ContainerLengthCmpOffByOne.ql |  6 ++---
 .../ql/src/Security Features/CWE-730/ReDoS.ql |  2 +-
 .../CWE-937/Vulnerabilities.qll               | 22 +++++++++----------
 .../semmle/code/csharp/controlflow/Guards.qll |  4 ++--
 .../library-tests/cil/regressions/Methods.cs  |  2 +-
 .../ContainerLengthCmpOffByOne.cs             |  6 ++---
 .../Security Features/CWE-937/csproj.config   |  4 ++--
 .../Security Features/CWE-937/packages.config |  2 +-
 8 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql b/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql
index 2cb7103ee0c5..e337aef3b1f7 100644
--- a/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql	
+++ b/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql	
@@ -20,10 +20,10 @@ import semmle.code.csharp.commons.ComparisonTest
 class IndexGuard extends ComparisonTest {
   VariableAccess indexAccess;
   Variable array;
-  
+
   IndexGuard() {
     this.getFirstArgument() = indexAccess and
-    this.getSecondArgument() = any(PropertyAccess lengthAccess | 
+    this.getSecondArgument() = any(PropertyAccess lengthAccess |
       lengthAccess.getQualifier() = array.getAnAccess() and
       lengthAccess.getTarget().hasName("Length")
     )
@@ -50,7 +50,7 @@ from IndexGuard incorrectGuard, Variable array, Variable index, ElementAccess ea
 where
   // Look for `index <= array.Length` or `array.Length >= index`
   incorrectGuard.controls(array, index) and
-  incorrectGuard.isIncorrect() and 
+  incorrectGuard.isIncorrect() and
   // Look for `array[index]`
   ea.getQualifier() = array.getAnAccess() and
   ea.getIndex(0) = indexAccess and
diff --git a/csharp/ql/src/Security Features/CWE-730/ReDoS.ql b/csharp/ql/src/Security Features/CWE-730/ReDoS.ql
index f1dbe5a068ec..83aab48820ef 100644
--- a/csharp/ql/src/Security Features/CWE-730/ReDoS.ql	
+++ b/csharp/ql/src/Security Features/CWE-730/ReDoS.ql	
@@ -19,7 +19,7 @@ from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode
 where
   c.hasFlowPath(source, sink) and
   // No global timeout set
-  not exists(RegexGlobalTimeout r) and 
+  not exists(RegexGlobalTimeout r) and
   (
     sink.getNode() instanceof Sink
     or
diff --git a/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll b/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll
index 13e2ea301bbc..b7277850fdf4 100644
--- a/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll	
+++ b/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll	
@@ -1,6 +1,6 @@
 /**
  * Provides a list of NuGet packages with known vulnerabilities.
- * 
+ *
  * To add a new vulnerability follow the existing pattern.
  * Create a new class that extends the abstract class `Vulnerability`,
  * supplying the name and the URL, and override one (or both) of
@@ -73,9 +73,9 @@ class MicrosoftAdvisory4021279 extends Vulnerability {
 
 class CVE_2017_8700 extends Vulnerability {
   CVE_2017_8700() { this = "CVE-2017-8700" }
-  
+
   override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/279" }
-  
+
   override predicate matchesRange(string name, Version affected, Version fixed) {
     (
       name = "Microsoft.AspNetCore.Mvc.Core"
@@ -91,9 +91,9 @@ class CVE_2017_8700 extends Vulnerability {
 
 class CVE_2018_0765 extends Vulnerability {
   CVE_2018_0765() { this = "CVE-2018-0765" }
-  
+
   override string getUrl() { result = "https://github.com/dotnet/announcements/issues/67" }
-  
+
   override predicate matchesRange(string name, Version affected, Version fixed) {
     name = "System.Security.Cryptography.Xml" and
     affected = "0.0.0" and
@@ -103,7 +103,7 @@ class CVE_2018_0765 extends Vulnerability {
 
 class AspNetCore_Mar18 extends Vulnerability {
   AspNetCore_Mar18() { this = "ASPNETCore-Mar18" }
-  
+
   override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/300" }
 
   override predicate matchesRange(string name, Version affected, Version fixed) {
@@ -125,9 +125,9 @@ class AspNetCore_Mar18 extends Vulnerability {
 
 class CVE_2018_8409 extends Vulnerability {
   CVE_2018_8409() { this = "CVE-2018-8409" }
-  
+
   override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/316" }
-  
+
   override predicate matchesRange(string name, Version affected, Version fixed) {
     name = "System.IO.Pipelines" and affected = "4.5.0" and fixed = "4.5.1"
     or
@@ -138,9 +138,9 @@ class CVE_2018_8409 extends Vulnerability {
 
 class CVE_2018_8171 extends Vulnerability {
   CVE_2018_8171() { this = "CVE-2018-8171" }
-  
+
   override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/310" }
-  
+
   override predicate matchesRange(string name, Version affected, Version fixed) {
     name = "Microsoft.AspNetCore.Identity" and (
       affected = "1.0.0" and fixed = "1.0.6"
@@ -204,7 +204,7 @@ class CVE_2018_8356 extends Vulnerability {
 
 class ASPNETCore_Jul18 extends Vulnerability {
   ASPNETCore_Jul18() { this = "ASPNETCore-July18" }
-  
+
   override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/311" }
 
   override predicate matchesRange(string name, Version affected, Version fixed) {
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index 1a8a097f6cb3..5cf2582f0952 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -286,7 +286,7 @@ class DereferenceableExpr extends Expr {
           ie = any(IsTypeExpr ite | ite.getCheckedType() = ite.getExpr().getType()) and
           branch = false and
           isNull = true
-        ) 
+        )
       )
       or
       this.hasNullableType() and
@@ -1189,7 +1189,7 @@ module Internal {
         g1 = cond and
         v1 = v.getDualValue() and
         (
-          // g1 === g2 ? e : ...; 
+          // g1 === g2 ? e : ...;
           g2 = cond.getCondition() and
           v2 = TBooleanValue(branch.booleanNot())
           or
diff --git a/csharp/ql/test/library-tests/cil/regressions/Methods.cs b/csharp/ql/test/library-tests/cil/regressions/Methods.cs
index 2d4f07b9855e..b81a5c9a44fa 100644
--- a/csharp/ql/test/library-tests/cil/regressions/Methods.cs
+++ b/csharp/ql/test/library-tests/cil/regressions/Methods.cs
@@ -3,7 +3,7 @@
  * This tests the correct extraction of F<T>, and we should end up with
  * 2 constructed methods of F<T>.
  */
- 
+
 // semmle-extractor-options: --cil
 
 namespace Methods
diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs
index b25145a8cbd8..d68bbfc274ec 100644
--- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs	
+++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs	
@@ -48,7 +48,7 @@ void Test2(string[] args)
     }
 
     void Test3(string[] args)
-    {    
+    {
         // GOOD: Guarded by ternary operator.
         for (int i = 0; i <= args.Length; i++)
         {
@@ -68,7 +68,7 @@ void Test4(string[] args)
     }
 
     void Test5(string[] args)
-    {  
+    {
         // GOOD: A valid test of Length.
         for (int i = 0; i != args.Length; i++)
         {
@@ -94,6 +94,6 @@ void Test7(string[] args)
         for (int i = 0; i <= args.Length; i++)
         {
             bool b = i == args.Length || args[i] == "x";
-        }        
+        }
     }
 }
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config b/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config
index 721d21559407..690612892147 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config	
@@ -5,12 +5,12 @@
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="System.Text.Encodings.Web" Version="4.2.9" />
     <PackageReference Include="System.Text.Encodings.Web" Version="4.3.1" />
-    
+
     <!-- These are BAD -->
     <PackageReference Include="System.Text.Encodings.Web" Version="4.3.0" />
     <PackageReference Include="system.text.encodings.web" Version="4.3" />
     <PackageReference Include="System.Net.Http" Version="4.1.1" />
     <PackageReference Include="System.Net.Http" Version="4.1.2" />
-    
+
   </ItemGroup>
 </Project>
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config b/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config
index 40e82a77df33..12f63f710432 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config	
@@ -4,7 +4,7 @@
   <package id="System.IO.Pipelines" version="4.5.1" targetFramework="net45" />
   <package id="System.IO.Pipelines" version="4.5.1.0" targetFramework="net45" />
   <package id="Microsoft.AspNetCore.All" version="2.0.9" targetFramework="net45" />
-  
+
   <!-- These are BAD -->
   <package id="System.IO.Pipelines" version="4.5.0" targetFramework="net45" />
   <package id="System.IO.Pipelines" version="4.5.0.0" targetFramework="net45" />

From 6918dad1dbd53aeb958a227f09160d4e0e430e6f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 12 Dec 2018 13:14:22 +0100
Subject: [PATCH 08/69] C#: Refactor `localFlowStep()`

Using the `forceCachingInSameStage()` trick, we can get rid of the non-cached version
of local flow, while still computing it in the same stage.
---
 .../semmle/code/csharp/dataflow/DataFlow.qll   | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
index dfd7885899c5..1e5e6b0353ed 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
@@ -90,7 +90,7 @@ module DataFlow {
     localFlowStep*(source, sink)
   }
 
-  predicate localFlowStep = localFlowStepCached/2;
+  predicate localFlowStep = Internal::LocalFlow::step/2;
 
   /**
    * A data flow node augmented with a call context and a configuration. Only
@@ -690,12 +690,14 @@ module DataFlow {
     /**
      * Provides predicates related to local data flow.
      */
-    private module LocalFlow {
+    module LocalFlow {
       /**
        * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
        * (intra-procedural) step.
        */
-      predicate localFlowStepNonCached(Node nodeFrom, Node nodeTo) {
+      cached
+      predicate step(Node nodeFrom, Node nodeTo) {
+        forceCachingInSameStage() and
         localFlowStepExpr(nodeFrom.asExpr(), nodeTo.asExpr())
         or
         // Flow from source to SSA definition
@@ -1119,6 +1121,8 @@ module DataFlow {
      * same stage.
      */
     cached module Cached {
+      cached predicate forceCachingInSameStage() { any() }
+
       cached newtype TNode =
         TExprNode(DotNet::Expr e)
         or
@@ -1137,14 +1141,6 @@ module DataFlow {
           )
         }
 
-      /**
-       * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
-       * (intra-procedural) step.
-       */
-      cached predicate localFlowStepCached(Node nodeFrom, Node nodeTo) {
-        LocalFlow::localFlowStepNonCached(nodeFrom, nodeTo)
-      }
-
       /**
        * Holds if `pred` can flow to `succ`, by jumping from one callable to
        * another.

From 74167e478a639d209deab026422d791d4b44799c Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 12 Dec 2018 13:16:28 +0100
Subject: [PATCH 09/69] C#: Cache `NamedElement::getLabel()`

---
 csharp/ql/src/semmle/code/dotnet/Element.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/csharp/ql/src/semmle/code/dotnet/Element.qll b/csharp/ql/src/semmle/code/dotnet/Element.qll
index c6d6e7e410c1..739a31ec16bf 100644
--- a/csharp/ql/src/semmle/code/dotnet/Element.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Element.qll
@@ -80,6 +80,7 @@ class NamedElement extends Element, @dotnet_named_element {
   }
 
   /** Gets a unique string label for this element. */
+  cached
   string getLabel() { none() }
 
   /**

From 344466a8c16a215a9463823ee3e1827d4a422ae9 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 12 Dec 2018 21:49:21 +0100
Subject: [PATCH 10/69] C#: Cache `DataFlow::Node::getEnclosingCallable()`

---
 csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
index dfd7885899c5..6f8acfba723d 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
@@ -28,6 +28,7 @@ module DataFlow {
     DotNet::Type getType() { none() }
 
     /** Gets the enclosing callable of this node. */
+    cached
     DotNet::Callable getEnclosingCallable() { none() }
 
     /** Gets a textual representation of this node. */

From b155a0f5fb7a50b21c3397d5809f5fb116946ade Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 12 Dec 2018 21:50:34 +0100
Subject: [PATCH 11/69] C#: Avoid computing CIL strings and non-PDB locations
 in data flow library

Computing strings and locations for CIL instructions can be quite time consuming.
The CIL `toString()`s are not very helpful in path explanations, and their locations
are only useful when a PDB source file exists. Therefore, produce a simple constant
`toString()`, and restrict locations to those in PDB files.
---
 .../src/semmle/code/csharp/dataflow/DataFlow.qll   | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
index 6f8acfba723d..96c3ec664ef2 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll
@@ -53,9 +53,19 @@ module DataFlow {
 
     override DotNet::Callable getEnclosingCallable() { result = expr.getEnclosingCallable() }
 
-    override string toString() { result = expr.toString() }
+    override string toString() {
+      result = expr.(Expr).toString()
+      or
+      expr instanceof CIL::Expr and
+      result = "CIL expression"
+    }
 
-    override Location getLocation() { result = expr.getLocation() }
+    override Location getLocation() {
+      result = expr.(Expr).getLocation()
+      or
+      result.getFile().isPdbSourceFile() and
+      result = expr.(CIL::Expr).getALocation()
+    }
   }
 
   /**

From 7656936cadd1169f33636827d2df9ac6abd2e04d Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <schack@semmle.com>
Date: Thu, 13 Dec 2018 17:43:26 +0000
Subject: [PATCH 12/69] Java: Remove Metrics/queries.xml

---
 java/ql/src/Metrics/queries.xml | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 java/ql/src/Metrics/queries.xml

diff --git a/java/ql/src/Metrics/queries.xml b/java/ql/src/Metrics/queries.xml
deleted file mode 100644
index 0d33187fe86a..000000000000
--- a/java/ql/src/Metrics/queries.xml
+++ /dev/null
@@ -1 +0,0 @@
-<queries language="java"/>

From 56b80ae13ae53d7bd29bb6bdf819f37bfe7e5e0e Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 14 Dec 2018 10:13:39 +0000
Subject: [PATCH 13/69] C#: Add `getALocation()` for namespaces and namespace
 declarations

---
 csharp/ql/src/semmle/code/csharp/Namespace.qll | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Namespace.qll b/csharp/ql/src/semmle/code/csharp/Namespace.qll
index 94723bf65d07..e8d7a96e6b96 100644
--- a/csharp/ql/src/semmle/code/csharp/Namespace.qll
+++ b/csharp/ql/src/semmle/code/csharp/Namespace.qll
@@ -112,8 +112,12 @@ class Namespace extends DotNet::Namespace, TypeContainer, @namespace {
 
   override predicate fromLibrary() { not this.fromSource() }
 
-  /** Gets the URL of this namespace (which is empty in this case). */
-  string getURL() { result = "" }
+  /** Gets a declaration of this namespace, if any. */
+  NamespaceDeclaration getADeclaration() { result.getNamespace() = this }
+
+  override Location getALocation() {
+    result = this.getADeclaration().getALocation()
+  }
 }
 
 /**
@@ -193,7 +197,7 @@ class NamespaceDeclaration extends Element, @namespace_declaration {
    */
   ValueOrRefType getATypeDeclaration() { parent_namespace_declaration(result, this) }
 
-  override Location getALocation() { none() }
+  override Location getALocation() { namespace_declaration_location(this, result) }
 
   override string toString() { result = "namespace ... { ... }" }
 }

From 654f2ae290634f859af214a68e8646a5f3f1dbee Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 14 Dec 2018 10:38:34 +0000
Subject: [PATCH 14/69] C#: Address review comment

---
 .../Entities/Expression.cs                    | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index d88050b545bf..d51f438fbcdb 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -117,18 +117,19 @@ public static ExprKind UnaryOperatorKind(Context cx, ExprKind originalKind, Expr
         public void OperatorCall(ExpressionSyntax node)
         {
             var @operator = cx.GetSymbolInfo(node);
-            var method = @operator.Symbol as IMethodSymbol;
-
-            var callType = GetCallType(cx, node);
-            if (callType == CallType.Dynamic)
+            if (@operator.Symbol is IMethodSymbol method)
             {
-                UserOperator.OperatorSymbol(method.Name, out string operatorName);
-                cx.Emit(Tuples.dynamic_member_name(this, operatorName));
-                return;
-            }
 
-            if (callType != CallType.None)
+                var callType = GetCallType(cx, node);
+                if (callType == CallType.Dynamic)
+                {
+                    UserOperator.OperatorSymbol(method.Name, out string operatorName);
+                    cx.Emit(Tuples.dynamic_member_name(this, operatorName));
+                    return;
+                }
+
                 cx.Emit(Tuples.expr_call(this, Method.Create(cx, method)));
+            }
         }
 
         public enum CallType

From 5ccad6ffc206985626cd94669c2804634c805ab1 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Fri, 14 Dec 2018 11:56:59 +0000
Subject: [PATCH 15/69] JavaScript: Minor improvements.

---
 .../ql/src/semmle/javascript/frameworks/Express.qll      | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index 09ac3cdce2ef..4940dddd2ab9 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -851,12 +851,11 @@ module Express {
   }
 
   /** A call to `response.sendFile`, considered as a file system access. */
-  private class ResponseSendFileAsFileSystemAccess extends FileSystemReadAccess, DataFlow::ValueNode {
-    override MethodCallExpr astNode;
-
+  private class ResponseSendFileAsFileSystemAccess extends FileSystemReadAccess, DataFlow::MethodCallNode {
     ResponseSendFileAsFileSystemAccess() {
       exists (string name | name = "sendFile" or name = "sendfile" |
-        asExpr().(MethodCallExpr).calls(any(ResponseExpr res), name))
+        calls(any(ResponseExpr res).flow(), name)
+      )
     }
 
     override DataFlow::Node getADataNode() {
@@ -864,7 +863,7 @@ module Express {
     }
 
     override DataFlow::Node getAPathArgument() {
-      result = DataFlow::valueNode(astNode.getArgument(0))
+      result = getArgument(0)
     }
   }
 

From 287ce4e683e6b9615ccc93a05fd3d75c9c9b4c62 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Tue, 11 Dec 2018 10:00:12 +0100
Subject: [PATCH 16/69] C#: Add more nullness tests

---
 csharp/ql/test/query-tests/Nullness/E.cs      | 38 +++++++++++++++++++
 .../Nullness/EqualityCheck.expected           |  4 ++
 .../Nullness/Implications.expected            | 33 ++++++++++++++++
 .../query-tests/Nullness/NullCheck.expected   |  6 +++
 .../query-tests/Nullness/NullMaybe.expected   |  3 ++
 5 files changed, 84 insertions(+)

diff --git a/csharp/ql/test/query-tests/Nullness/E.cs b/csharp/ql/test/query-tests/Nullness/E.cs
index aebc5138f404..a96029622dad 100644
--- a/csharp/ql/test/query-tests/Nullness/E.cs
+++ b/csharp/ql/test/query-tests/Nullness/E.cs
@@ -260,6 +260,44 @@ public int Ex21(int? i)
             i = 0;
         return i.Value; // GOOD
     }
+
+    public void Ex22()
+    {
+        object o = null;
+        try
+        {
+            o = Make();
+            o.ToString(); // GOOD (false positive)
+        }
+        finally
+        {
+            if (o != null)
+                o.ToString(); // GOOD
+        }
+    }
+
+    public void Ex23(bool b)
+    {
+        if (b)
+            b.ToString();
+        var o = Make();
+        o?.ToString();
+        o.ToString(); // BAD (maybe)
+        if (b)
+            b.ToString();
+    }
+
+    public void Ex24(bool b)
+    {
+        string s = b ? null : "";
+        if (s?.M2() == 0)
+        {
+            s.ToString(); // GOOD (false positive)
+        }
+    }
+
+    public bool Field;
+    string Make() => Field ? null : "";
 }
 
 public static class Extensions
diff --git a/csharp/ql/test/query-tests/Nullness/EqualityCheck.expected b/csharp/ql/test/query-tests/Nullness/EqualityCheck.expected
index d14a8ce95542..61b5f7a61bf5 100644
--- a/csharp/ql/test/query-tests/Nullness/EqualityCheck.expected
+++ b/csharp/ql/test/query-tests/Nullness/EqualityCheck.expected
@@ -211,6 +211,10 @@
 | E.cs:252:13:252:21 | ... != ... | false | E.cs:252:18:252:21 | null | E.cs:252:13:252:13 | access to parameter i |
 | E.cs:259:13:259:21 | ... == ... | true | E.cs:259:13:259:13 | access to parameter i | E.cs:259:18:259:21 | null |
 | E.cs:259:13:259:21 | ... == ... | true | E.cs:259:18:259:21 | null | E.cs:259:13:259:13 | access to parameter i |
+| E.cs:274:17:274:25 | ... != ... | false | E.cs:274:17:274:17 | access to local variable o | E.cs:274:22:274:25 | null |
+| E.cs:274:17:274:25 | ... != ... | false | E.cs:274:22:274:25 | null | E.cs:274:17:274:17 | access to local variable o |
+| E.cs:293:13:293:24 | ... == ... | true | E.cs:293:15:293:19 | call to method M2 | E.cs:293:24:293:24 | (...) ... |
+| E.cs:293:13:293:24 | ... == ... | true | E.cs:293:24:293:24 | (...) ... | E.cs:293:15:293:19 | call to method M2 |
 | Forwarding.cs:59:13:59:21 | ... == ... | true | Forwarding.cs:59:13:59:13 | access to parameter o | Forwarding.cs:59:18:59:21 | null |
 | Forwarding.cs:59:13:59:21 | ... == ... | true | Forwarding.cs:59:18:59:21 | null | Forwarding.cs:59:13:59:13 | access to parameter o |
 | Forwarding.cs:78:16:78:39 | call to method ReferenceEquals | true | Forwarding.cs:78:32:78:32 | access to parameter o | Forwarding.cs:78:35:78:38 | null |
diff --git a/csharp/ql/test/query-tests/Nullness/Implications.expected b/csharp/ql/test/query-tests/Nullness/Implications.expected
index 0ceb07b87bf4..6767c7453fcc 100644
--- a/csharp/ql/test/query-tests/Nullness/Implications.expected
+++ b/csharp/ql/test/query-tests/Nullness/Implications.expected
@@ -1426,6 +1426,39 @@
 | E.cs:260:13:260:17 | ... = ... | non-null | E.cs:260:17:260:17 | (...) ... | non-null |
 | E.cs:260:13:260:17 | ... = ... | null | E.cs:260:13:260:13 | access to parameter i | null |
 | E.cs:260:13:260:17 | ... = ... | null | E.cs:260:17:260:17 | (...) ... | null |
+| E.cs:266:16:266:23 | Object o = ... | non-null | E.cs:266:16:266:16 | access to local variable o | non-null |
+| E.cs:266:16:266:23 | Object o = ... | null | E.cs:266:16:266:16 | access to local variable o | null |
+| E.cs:269:13:269:22 | ... = ... | non-null | E.cs:269:13:269:13 | access to local variable o | non-null |
+| E.cs:269:13:269:22 | ... = ... | non-null | E.cs:269:17:269:22 | call to method Make | non-null |
+| E.cs:269:13:269:22 | ... = ... | null | E.cs:269:13:269:13 | access to local variable o | null |
+| E.cs:269:13:269:22 | ... = ... | null | E.cs:269:17:269:22 | call to method Make | null |
+| E.cs:270:13:270:13 | access to local variable o | non-null | E.cs:269:17:269:22 | call to method Make | non-null |
+| E.cs:270:13:270:13 | access to local variable o | null | E.cs:269:17:269:22 | call to method Make | null |
+| E.cs:274:17:274:25 | ... != ... | false | E.cs:274:17:274:17 | access to local variable o | null |
+| E.cs:274:17:274:25 | ... != ... | true | E.cs:274:17:274:17 | access to local variable o | non-null |
+| E.cs:283:13:283:22 | String o = ... | non-null | E.cs:283:13:283:13 | access to local variable o | non-null |
+| E.cs:283:13:283:22 | String o = ... | null | E.cs:283:13:283:13 | access to local variable o | null |
+| E.cs:284:9:284:9 | access to local variable o | non-null | E.cs:283:17:283:22 | call to method Make | non-null |
+| E.cs:284:9:284:9 | access to local variable o | null | E.cs:283:17:283:22 | call to method Make | null |
+| E.cs:284:11:284:21 | call to method ToString | non-null | E.cs:284:9:284:9 | access to local variable o | non-null |
+| E.cs:285:9:285:9 | access to local variable o | non-null | E.cs:283:17:283:22 | call to method Make | non-null |
+| E.cs:285:9:285:9 | access to local variable o | null | E.cs:283:17:283:22 | call to method Make | null |
+| E.cs:292:16:292:32 | String s = ... | non-null | E.cs:292:16:292:16 | access to local variable s | non-null |
+| E.cs:292:16:292:32 | String s = ... | null | E.cs:292:16:292:16 | access to local variable s | null |
+| E.cs:292:20:292:32 | ... ? ... : ... | non-null | E.cs:292:20:292:20 | access to parameter b | false |
+| E.cs:292:20:292:32 | ... ? ... : ... | non-null | E.cs:292:31:292:32 | "" | non-null |
+| E.cs:292:20:292:32 | ... ? ... : ... | null | E.cs:292:20:292:20 | access to parameter b | true |
+| E.cs:292:20:292:32 | ... ? ... : ... | null | E.cs:292:24:292:27 | null | null |
+| E.cs:293:13:293:13 | access to local variable s | non-null | E.cs:292:20:292:20 | access to parameter b | false |
+| E.cs:293:13:293:13 | access to local variable s | non-null | E.cs:292:20:292:32 | ... ? ... : ... | non-null |
+| E.cs:293:13:293:13 | access to local variable s | null | E.cs:292:20:292:20 | access to parameter b | true |
+| E.cs:293:13:293:13 | access to local variable s | null | E.cs:292:20:292:32 | ... ? ... : ... | null |
+| E.cs:295:13:295:13 | access to local variable s | non-null | E.cs:292:20:292:32 | ... ? ... : ... | non-null |
+| E.cs:295:13:295:13 | access to local variable s | null | E.cs:292:20:292:32 | ... ? ... : ... | null |
+| E.cs:300:22:300:38 | ... ? ... : ... | non-null | E.cs:300:22:300:26 | access to field Field | false |
+| E.cs:300:22:300:38 | ... ? ... : ... | non-null | E.cs:300:37:300:38 | "" | non-null |
+| E.cs:300:22:300:38 | ... ? ... : ... | null | E.cs:300:22:300:26 | access to field Field | true |
+| E.cs:300:22:300:38 | ... ? ... : ... | null | E.cs:300:30:300:33 | null | null |
 | Forwarding.cs:7:16:7:23 | String s = ... | non-null | Forwarding.cs:7:16:7:16 | access to local variable s | non-null |
 | Forwarding.cs:7:16:7:23 | String s = ... | null | Forwarding.cs:7:16:7:16 | access to local variable s | null |
 | Forwarding.cs:9:13:9:30 | !... | false | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | true |
diff --git a/csharp/ql/test/query-tests/Nullness/NullCheck.expected b/csharp/ql/test/query-tests/Nullness/NullCheck.expected
index 9b93a84e2282..6047334692a7 100644
--- a/csharp/ql/test/query-tests/Nullness/NullCheck.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullCheck.expected
@@ -193,6 +193,12 @@
 | E.cs:252:13:252:21 | ... != ... | E.cs:252:13:252:13 | access to parameter i | true | false |
 | E.cs:259:13:259:21 | ... == ... | E.cs:259:13:259:13 | access to parameter i | false | false |
 | E.cs:259:13:259:21 | ... == ... | E.cs:259:13:259:13 | access to parameter i | true | true |
+| E.cs:274:17:274:25 | ... != ... | E.cs:274:17:274:17 | access to local variable o | false | true |
+| E.cs:274:17:274:25 | ... != ... | E.cs:274:17:274:17 | access to local variable o | true | false |
+| E.cs:284:9:284:9 | access to local variable o | E.cs:284:9:284:9 | access to local variable o | non-null | false |
+| E.cs:284:9:284:9 | access to local variable o | E.cs:284:9:284:9 | access to local variable o | null | true |
+| E.cs:293:13:293:13 | access to local variable s | E.cs:293:13:293:13 | access to local variable s | non-null | false |
+| E.cs:293:13:293:13 | access to local variable s | E.cs:293:13:293:13 | access to local variable s | null | true |
 | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | Forwarding.cs:9:14:9:14 | access to local variable s | false | false |
 | Forwarding.cs:14:13:14:32 | call to method IsNotNullOrEmpty | Forwarding.cs:14:13:14:13 | access to local variable s | true | false |
 | Forwarding.cs:19:14:19:23 | call to method IsNull | Forwarding.cs:19:14:19:14 | access to local variable s | false | false |
diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
index b0b000287cb4..4edb9f3ded5c 100644
--- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -68,6 +68,9 @@
 | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
 | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
 | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
+| E.cs:270:13:270:13 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:266:16:266:16 | o | o | E.cs:274:17:274:25 | ... != ... | this |
+| E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| E.cs:295:13:295:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | E.cs:292:16:292:16 | s | s | E.cs:292:16:292:32 | String s = ... | this |
 | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null here because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
 | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null here because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
 | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

From 078dc7b6c06c27fc63ead0965b91b317c0bba2ff Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Tue, 11 Dec 2018 10:00:42 +0100
Subject: [PATCH 17/69] C#: Fix false positives in
 `cs/dereferenced-value-may-be-null`

---
 csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll   | 6 +++++-
 csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll    | 3 +++
 csharp/ql/test/query-tests/Nullness/E.cs                  | 4 ++--
 csharp/ql/test/query-tests/Nullness/Implications.expected | 3 +++
 csharp/ql/test/query-tests/Nullness/NullCheck.expected    | 1 +
 csharp/ql/test/query-tests/Nullness/NullMaybe.expected    | 2 --
 6 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index 1a8a097f6cb3..7e8e83c1be9c 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -578,8 +578,12 @@ module Internal {
    */
   Expr getNullEquivParent(Expr e) {
     result = any(QualifiableExpr qe |
-      qe.getQualifier() = e and
       qe.isConditional() and
+      (
+        e = qe.getQualifier()
+        or
+        e = qe.(ExtensionMethodCall).getArgument(0)
+      ) and
       (
         // The accessed declaration must have a value type in order
         // for `only if` to hold
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index 5f0f7932b90a..b1cdeae03bec 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -155,6 +155,9 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
     reason = de.getANullCheck(_, true) and
     msg = "as suggested by $@ null check" and
     not def instanceof Ssa::PseudoDefinition and
+    strictcount(Location l |
+      l = any(Ssa::Definition def0 | de = def0.getARead()).getLocation()
+    ) = 1 and
     not nonNullDef(def) and
     // Don't use a check as reason if there is a `null` assignment
     not def.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof MaybeNullExpr
diff --git a/csharp/ql/test/query-tests/Nullness/E.cs b/csharp/ql/test/query-tests/Nullness/E.cs
index a96029622dad..6be4074be02f 100644
--- a/csharp/ql/test/query-tests/Nullness/E.cs
+++ b/csharp/ql/test/query-tests/Nullness/E.cs
@@ -267,7 +267,7 @@ public void Ex22()
         try
         {
             o = Make();
-            o.ToString(); // GOOD (false positive)
+            o.ToString(); // GOOD
         }
         finally
         {
@@ -292,7 +292,7 @@ public void Ex24(bool b)
         string s = b ? null : "";
         if (s?.M2() == 0)
         {
-            s.ToString(); // GOOD (false positive)
+            s.ToString(); // GOOD
         }
     }
 
diff --git a/csharp/ql/test/query-tests/Nullness/Implications.expected b/csharp/ql/test/query-tests/Nullness/Implications.expected
index 6767c7453fcc..49c854bc4216 100644
--- a/csharp/ql/test/query-tests/Nullness/Implications.expected
+++ b/csharp/ql/test/query-tests/Nullness/Implications.expected
@@ -1453,6 +1453,9 @@
 | E.cs:293:13:293:13 | access to local variable s | non-null | E.cs:292:20:292:32 | ... ? ... : ... | non-null |
 | E.cs:293:13:293:13 | access to local variable s | null | E.cs:292:20:292:20 | access to parameter b | true |
 | E.cs:293:13:293:13 | access to local variable s | null | E.cs:292:20:292:32 | ... ? ... : ... | null |
+| E.cs:293:13:293:24 | ... == ... | true | E.cs:293:15:293:19 | call to method M2 | non-null |
+| E.cs:293:15:293:19 | call to method M2 | non-null | E.cs:293:13:293:13 | access to local variable s | non-null |
+| E.cs:293:15:293:19 | call to method M2 | null | E.cs:293:13:293:13 | access to local variable s | null |
 | E.cs:295:13:295:13 | access to local variable s | non-null | E.cs:292:20:292:32 | ... ? ... : ... | non-null |
 | E.cs:295:13:295:13 | access to local variable s | null | E.cs:292:20:292:32 | ... ? ... : ... | null |
 | E.cs:300:22:300:38 | ... ? ... : ... | non-null | E.cs:300:22:300:26 | access to field Field | false |
diff --git a/csharp/ql/test/query-tests/Nullness/NullCheck.expected b/csharp/ql/test/query-tests/Nullness/NullCheck.expected
index 6047334692a7..966c9fa5464e 100644
--- a/csharp/ql/test/query-tests/Nullness/NullCheck.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullCheck.expected
@@ -199,6 +199,7 @@
 | E.cs:284:9:284:9 | access to local variable o | E.cs:284:9:284:9 | access to local variable o | null | true |
 | E.cs:293:13:293:13 | access to local variable s | E.cs:293:13:293:13 | access to local variable s | non-null | false |
 | E.cs:293:13:293:13 | access to local variable s | E.cs:293:13:293:13 | access to local variable s | null | true |
+| E.cs:293:13:293:24 | ... == ... | E.cs:293:15:293:19 | call to method M2 | true | false |
 | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | Forwarding.cs:9:14:9:14 | access to local variable s | false | false |
 | Forwarding.cs:14:13:14:32 | call to method IsNotNullOrEmpty | Forwarding.cs:14:13:14:13 | access to local variable s | true | false |
 | Forwarding.cs:19:14:19:23 | call to method IsNull | Forwarding.cs:19:14:19:14 | access to local variable s | false | false |
diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
index 4edb9f3ded5c..3c28cc8a951b 100644
--- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -68,9 +68,7 @@
 | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
 | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
 | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
-| E.cs:270:13:270:13 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:266:16:266:16 | o | o | E.cs:274:17:274:25 | ... != ... | this |
 | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
-| E.cs:295:13:295:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | E.cs:292:16:292:16 | s | s | E.cs:292:16:292:32 | String s = ... | this |
 | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null here because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
 | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null here because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
 | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

From e2f271bddbb2df22d0480550b827219f85d9e713 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 5 Dec 2018 15:14:36 +0100
Subject: [PATCH 18/69] C#: Add more guard implication steps

---
 .../semmle/code/csharp/controlflow/Guards.qll | 50 +++++++++++++++++--
 .../controlflow/guards/Implications.expected  |  8 +++
 .../Nullness/Implications.expected            | 10 ++++
 3 files changed, 65 insertions(+), 3 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index 7e8e83c1be9c..e1d8e8e02a5f 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -694,7 +694,7 @@ module Internal {
     predicate preControls(PreBasicBlocks::PreBasicBlock bb, AbstractValue v) {
       exists(AbstractValue v0, Guard g |
         g.preControlsDirect(bb, v0) |
-        impliesSteps(g, v0, this, v)
+        preImpliesSteps(g, v0, this, v)
       )
     }
 
@@ -781,7 +781,7 @@ module Internal {
       def.nullGuardedReturn(ret, isNull)
       or
       exists(NullValue nv |
-        impliesSteps(ret, retVal, def.getARead(), nv) |
+        preImpliesSteps(ret, retVal, def.getARead(), nv) |
         if nv.isNull() then isNull = true else isNull = false
       )
     )
@@ -1123,6 +1123,28 @@ module Internal {
         def = guarded.getAnSsaQualifier()
       )
     }
+
+    /**
+     * Holds if the assumption that `g1` has abstract value `v1` implies that
+     * `g2` has abstract value `v2`, using one step of reasoning. That is, the
+     * evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
+     *
+     * This predicate relies on the control flow graph.
+     */
+    cached
+    predicate impliesStep(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
+      preImpliesStep(g1, v1, g2, v2)
+      or
+      forex(ControlFlow::Node cfn |
+        cfn = g1.getAControlFlowNode() |
+        exists(Ssa::ExplicitDefinition def |
+          def.getADefinition().getSource() = g2 |
+          g1 = def.getAReadAtNode(cfn) and
+          v1 = g1.getAValue() and
+          v2 = v1
+        )
+      )
+    }
   }
   import Cached
 
@@ -1143,9 +1165,11 @@ module Internal {
      * Holds if the assumption that `g1` has abstract value `v1` implies that
      * `g2` has abstract value `v2`, using one step of reasoning. That is, the
      * evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
+     *
+     * This predicate does not rely on the control flow graph.
      */
     cached
-    predicate impliesStep(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
+    predicate preImpliesStep(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
       g1 = any(BinaryOperation bo |
         (
           bo instanceof BitwiseAndExpr or
@@ -1279,6 +1303,26 @@ module Internal {
    * Holds if the assumption that `g1` has abstract value `v1` implies that
    * `g2` has abstract value `v2`, using zero or more steps of reasoning. That is,
    * the evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
+   *
+   * This predicate does not rely on the control flow graph.
+   */
+  predicate preImpliesSteps(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
+    g1 = g2 and
+    v1 = v2 and
+    v1 = g1.getAValue()
+    or
+    exists(Expr mid, AbstractValue vMid |
+      preImpliesSteps(g1, v1, mid, vMid) |
+      preImpliesStep(mid, vMid, g2, v2)
+    )
+  }
+
+  /**
+   * Holds if the assumption that `g1` has abstract value `v1` implies that
+   * `g2` has abstract value `v2`, using zero or more steps of reasoning. That is,
+   * the evaluation of `g2` to `v2` dominates the evaluation of `g1` to `v1`.
+   *
+   * This predicate relies on the control flow graph.
    */
   predicate impliesSteps(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
     g1 = g2 and
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Implications.expected b/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
index 7e78c7d7198c..67de6b196c59 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
@@ -251,6 +251,10 @@
 | Guards.cs:106:9:106:25 | ... = ... | non-null | Guards.cs:106:22:106:25 | null | non-null |
 | Guards.cs:106:9:106:25 | ... = ... | null | Guards.cs:106:9:106:18 | access to property Property | null |
 | Guards.cs:106:9:106:25 | ... = ... | null | Guards.cs:106:22:106:25 | null | null |
+| Guards.cs:107:27:107:36 | access to property Property | non-null | Guards.cs:106:22:106:25 | null | non-null |
+| Guards.cs:107:27:107:36 | access to property Property | null | Guards.cs:106:22:106:25 | null | null |
+| Guards.cs:108:27:108:36 | access to property Property | non-null | Guards.cs:106:22:106:25 | null | non-null |
+| Guards.cs:108:27:108:36 | access to property Property | null | Guards.cs:106:22:106:25 | null | null |
 | Guards.cs:113:13:114:38 | String dummy = ... | non-null | Guards.cs:113:13:113:17 | access to local variable dummy | non-null |
 | Guards.cs:113:13:114:38 | String dummy = ... | null | Guards.cs:113:13:113:17 | access to local variable dummy | null |
 | Guards.cs:115:9:115:55 | ... = ... | non-null | Guards.cs:115:9:115:13 | access to local variable dummy | non-null |
@@ -261,6 +265,10 @@
 | Guards.cs:117:9:117:25 | ... = ... | non-null | Guards.cs:117:22:117:25 | null | non-null |
 | Guards.cs:117:9:117:25 | ... = ... | null | Guards.cs:117:9:117:18 | access to property Property | null |
 | Guards.cs:117:9:117:25 | ... = ... | null | Guards.cs:117:22:117:25 | null | null |
+| Guards.cs:118:27:118:36 | access to property Property | non-null | Guards.cs:117:22:117:25 | null | non-null |
+| Guards.cs:118:27:118:36 | access to property Property | null | Guards.cs:117:22:117:25 | null | null |
+| Guards.cs:119:27:119:36 | access to property Property | non-null | Guards.cs:117:22:117:25 | null | non-null |
+| Guards.cs:119:27:119:36 | access to property Property | null | Guards.cs:117:22:117:25 | null | null |
 | Guards.cs:124:13:124:30 | Boolean b1 = ... | false | Guards.cs:124:13:124:14 | access to local variable b1 | false |
 | Guards.cs:124:13:124:30 | Boolean b1 = ... | true | Guards.cs:124:13:124:14 | access to local variable b1 | true |
 | Guards.cs:125:13:125:31 | Nullable<Boolean> b2 = ... | non-null | Guards.cs:125:13:125:14 | access to local variable b2 | non-null |
diff --git a/csharp/ql/test/query-tests/Nullness/Implications.expected b/csharp/ql/test/query-tests/Nullness/Implications.expected
index 49c854bc4216..aef55ff476c6 100644
--- a/csharp/ql/test/query-tests/Nullness/Implications.expected
+++ b/csharp/ql/test/query-tests/Nullness/Implications.expected
@@ -930,6 +930,8 @@
 | D.cs:187:13:187:28 | ... = ... | non-null | D.cs:187:20:187:28 | call to method MkMaybe | non-null |
 | D.cs:187:13:187:28 | ... = ... | null | D.cs:187:13:187:16 | access to local variable obj3 | null |
 | D.cs:187:13:187:28 | ... = ... | null | D.cs:187:20:187:28 | call to method MkMaybe | null |
+| D.cs:190:9:190:12 | access to local variable obj3 | non-null | D.cs:187:20:187:28 | call to method MkMaybe | non-null |
+| D.cs:190:9:190:12 | access to local variable obj3 | null | D.cs:187:20:187:28 | call to method MkMaybe | null |
 | D.cs:195:13:195:28 | Object o = ... | non-null | D.cs:195:13:195:13 | access to local variable o | non-null |
 | D.cs:195:13:195:28 | Object o = ... | null | D.cs:195:13:195:13 | access to local variable o | null |
 | D.cs:196:13:196:13 | access to local variable o | non-null | D.cs:195:17:195:28 | object creation of type Object | non-null |
@@ -985,6 +987,8 @@
 | D.cs:230:13:230:28 | ... = ... | non-null | D.cs:230:17:230:28 | object creation of type Object | non-null |
 | D.cs:230:13:230:28 | ... = ... | null | D.cs:230:13:230:13 | access to local variable o | null |
 | D.cs:230:13:230:28 | ... = ... | null | D.cs:230:17:230:28 | object creation of type Object | null |
+| D.cs:232:13:232:13 | access to local variable o | non-null | D.cs:230:17:230:28 | object creation of type Object | non-null |
+| D.cs:232:13:232:13 | access to local variable o | null | D.cs:230:17:230:28 | object creation of type Object | null |
 | D.cs:234:9:234:16 | ... = ... | non-null | D.cs:234:9:234:9 | access to local variable o | non-null |
 | D.cs:234:9:234:16 | ... = ... | non-null | D.cs:234:13:234:16 | null | non-null |
 | D.cs:234:9:234:16 | ... = ... | null | D.cs:234:9:234:9 | access to local variable o | null |
@@ -993,6 +997,8 @@
 | D.cs:236:13:236:18 | ... = ... | non-null | D.cs:236:17:236:18 | "" | non-null |
 | D.cs:236:13:236:18 | ... = ... | null | D.cs:236:13:236:13 | access to local variable o | null |
 | D.cs:236:13:236:18 | ... = ... | null | D.cs:236:17:236:18 | "" | null |
+| D.cs:238:13:238:13 | access to local variable o | non-null | D.cs:236:17:236:18 | "" | non-null |
+| D.cs:238:13:238:13 | access to local variable o | null | D.cs:236:17:236:18 | "" | null |
 | D.cs:240:9:240:16 | ... = ... | non-null | D.cs:240:9:240:9 | access to local variable o | non-null |
 | D.cs:240:9:240:16 | ... = ... | non-null | D.cs:240:13:240:16 | null | non-null |
 | D.cs:240:9:240:16 | ... = ... | null | D.cs:240:9:240:9 | access to local variable o | null |
@@ -1410,12 +1416,16 @@
 | E.cs:217:13:217:20 | ... = ... | non-null | E.cs:217:17:217:20 | null | non-null |
 | E.cs:217:13:217:20 | ... = ... | null | E.cs:217:13:217:13 | access to local variable x | null |
 | E.cs:217:13:217:20 | ... = ... | null | E.cs:217:17:217:20 | null | null |
+| E.cs:220:13:220:13 | access to local variable x | non-null | E.cs:217:17:217:20 | null | non-null |
+| E.cs:220:13:220:13 | access to local variable x | null | E.cs:217:17:217:20 | null | null |
 | E.cs:225:13:225:18 | String x = ... | non-null | E.cs:225:13:225:13 | access to local variable x | non-null |
 | E.cs:225:13:225:18 | String x = ... | null | E.cs:225:13:225:13 | access to local variable x | null |
 | E.cs:227:13:227:20 | ... = ... | non-null | E.cs:227:13:227:13 | access to local variable x | non-null |
 | E.cs:227:13:227:20 | ... = ... | non-null | E.cs:227:17:227:20 | null | non-null |
 | E.cs:227:13:227:20 | ... = ... | null | E.cs:227:13:227:13 | access to local variable x | null |
 | E.cs:227:13:227:20 | ... = ... | null | E.cs:227:17:227:20 | null | null |
+| E.cs:229:13:229:13 | access to local variable x | non-null | E.cs:227:17:227:20 | null | non-null |
+| E.cs:229:13:229:13 | access to local variable x | null | E.cs:227:17:227:20 | null | null |
 | E.cs:245:13:245:22 | access to property HasValue | false | E.cs:245:13:245:13 | access to parameter i | null |
 | E.cs:245:13:245:22 | access to property HasValue | true | E.cs:245:13:245:13 | access to parameter i | non-null |
 | E.cs:252:13:252:21 | ... != ... | false | E.cs:252:13:252:13 | access to parameter i | null |

From 91e4f7ad83b3d7d8a7bb225a1b316829cfe19731 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 5 Dec 2018 16:26:24 +0100
Subject: [PATCH 19/69] C#: Make `cs/dereferenced-value-may-be-null` a path
 query

---
 csharp/ql/src/CSI/NullMaybe.ql                |   9 +-
 .../semmle/code/csharp/dataflow/Nullness.qll  | 227 ++++-
 .../src/semmle/code/csharp/dataflow/SSA.qll   |   3 +
 .../query-tests/Nullness/NullMaybe.expected   | 853 ++++++++++++++++--
 4 files changed, 972 insertions(+), 120 deletions(-)

diff --git a/csharp/ql/src/CSI/NullMaybe.ql b/csharp/ql/src/CSI/NullMaybe.ql
index eaacd7fa3dab..7bd099e78e92 100644
--- a/csharp/ql/src/CSI/NullMaybe.ql
+++ b/csharp/ql/src/CSI/NullMaybe.ql
@@ -2,7 +2,7 @@
  * @name Dereferenced variable may be null
  * @description Dereferencing a variable whose value may be 'null' may cause a
  *              'NullReferenceException'.
- * @kind problem
+ * @kind path-problem
  * @problem.severity warning
  * @precision high
  * @id cs/dereferenced-value-may-be-null
@@ -14,7 +14,8 @@
 
 import csharp
 import semmle.code.csharp.dataflow.Nullness
+import PathGraph
 
-from Dereference d, Ssa::SourceVariable v, string msg, Element reason
-where d.isFirstMaybeNull(v.getAnSsaDefinition(), msg, reason)
-select d, "Variable $@ may be null here " + msg + ".", v, v.toString(), reason, "this"
+from Dereference d, PathNode source, PathNode sink, Ssa::SourceVariable v, string msg, Element reason
+where d.isFirstMaybeNull(v.getAnSsaDefinition(), source, sink, msg, reason)
+select d, source, sink, "Variable $@ may be null here " + msg + ".", v, v.toString(), reason, "this"
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index b1cdeae03bec..c5a662ccb56f 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -147,6 +147,15 @@ private ControlFlowElement getANullCheck(Ssa::Definition def, SuccessorTypes::Co
   )
 }
 
+private predicate isMaybeNullArgument(Ssa::ExplicitDefinition def, MaybeNullExpr arg) {
+  exists(AssignableDefinitions::ImplicitParameterDefinition pdef, Parameter p |
+    pdef = def.getADefinition() |
+    p = pdef.getParameter().getSourceDeclaration() and
+    p.getAnAssignedArgument() = arg and
+    not arg.getEnclosingCallable().getEnclosingCallable*() instanceof TestMethod
+  )
+}
+
 /** Holds if `def` is an SSA definition that may be `null`. */
 private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason) {
   // A variable compared to `null` might be `null`
@@ -160,18 +169,14 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
     ) = 1 and
     not nonNullDef(def) and
     // Don't use a check as reason if there is a `null` assignment
-    not def.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof MaybeNullExpr
+    // or argument
+    not def.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof MaybeNullExpr and
+    not isMaybeNullArgument(def, _)
   )
   or
   // A parameter might be `null` if there is a `null` argument somewhere
-  exists(AssignableDefinitions::ImplicitParameterDefinition pdef, Parameter p, MaybeNullExpr arg |
-    pdef = def.(Ssa::ExplicitDefinition).getADefinition() |
-    p = pdef.getParameter().getSourceDeclaration() and
-    p.getAnAssignedArgument() = arg and
-    reason = arg and
-    msg = "because of $@ null argument" and
-    not arg.getEnclosingCallable().getEnclosingCallable*() instanceof TestMethod
-  )
+  isMaybeNullArgument(def, reason) and
+  msg = "because of $@ null argument"
   or
   // If the source of a variable is `null` then the variable may be `null`
   exists(AssignableDefinition adef |
@@ -202,12 +207,12 @@ private predicate defNullImpliesStep(Ssa::Definition def1, BasicBlock bb1, Ssa::
     def1.getSourceVariable() = v
   |
     def2.(Ssa::PseudoDefinition).getAnInput() = def1 and
-    def2.definesAt(bb2, _)
+    bb2 = def2.getBasicBlock()
     or
     def2 = def1 and
     not exists(Ssa::PseudoDefinition def |
       def.getSourceVariable() = v and
-      def.definesAt(bb2, _)
+      bb2 = def.getBasicBlock()
     )
   ) and
   def1.isLiveAtEndOfBlock(bb1) and
@@ -224,13 +229,12 @@ private predicate defNullImpliesStep(Ssa::Definition def1, BasicBlock bb1, Ssa::
  * The transitive closure of `defNullImpliesStep()` originating from `defMaybeNull()`.
  * That is, those basic blocks for which the SSA definition is suspected of being `null`.
  */
-private predicate defMaybeNullInBlock(Ssa::Definition def, Ssa::SourceVariable v, BasicBlock bb) {
+private predicate defMaybeNullInBlock(Ssa::Definition def, BasicBlock bb) {
   defMaybeNull(def, _, _) and
-  def.definesAt(bb, _) and
-  v = def.getSourceVariable()
+  bb = def.getBasicBlock()
   or
   exists(BasicBlock mid, Ssa::Definition midDef |
-    defMaybeNullInBlock(midDef, v, mid) |
+    defMaybeNullInBlock(midDef, mid) |
     defNullImpliesStep(midDef, mid, def, bb)
   )
 }
@@ -242,20 +246,167 @@ private predicate defMaybeNullInBlock(Ssa::Definition def, Ssa::SourceVariable v
 private predicate nullDerefCandidateVariable(Ssa::SourceVariable v) {
   exists(Ssa::Definition def, BasicBlock bb |
     potentialNullDereferenceAt(bb, _, def, _) |
-    defMaybeNullInBlock(def, v, bb)
+    defMaybeNullInBlock(def, bb) and
+    v = def.getSourceVariable()
   )
 }
 
-private predicate defMaybeNullInBlockOrigin(Ssa::Definition origin, Ssa::Definition def, BasicBlock bb) {
-  nullDerefCandidateVariable(def.getSourceVariable()) and
-  defMaybeNull(def, _, _) and
-  def.definesAt(bb, _) and
-  origin = def
+private predicate succStep(PathNode pred, Ssa::Definition def, BasicBlock bb) {
+  defNullImpliesStep(pred.getSsaDefinition(), pred.getBasicBlock(), def, bb)
+}
+
+private predicate succNullArgument(SourcePathNode pred, Ssa::Definition def, BasicBlock bb) {
+  pred = TSourcePathNode(def, _, _, true) and
+  bb = def.getBasicBlock()
+}
+
+private predicate succSourceSink(SourcePathNode source, Ssa::Definition def, BasicBlock bb) {
+  source = TSourcePathNode(def, _, _, false) and
+  bb = def.getBasicBlock()
+}
+
+private newtype TPathNode =
+  TSourcePathNode(Ssa::Definition def, string msg, Element reason, boolean isNullArgument) {
+    nullDerefCandidateVariable(def.getSourceVariable()) and
+    defMaybeNull(def, msg, reason) and
+    if isMaybeNullArgument(def, reason) then isNullArgument = true else isNullArgument = false
+  }
   or
-  exists(BasicBlock mid, Ssa::Definition midDef |
-    defMaybeNullInBlockOrigin(origin, midDef, mid) and
-    defNullImpliesStep(midDef, mid, def, bb)
-  )
+  TInternalPathNode(Ssa::Definition def, BasicBlock bb) {
+    succStep(_, def, bb)
+    or
+    succNullArgument(_, def, bb)
+  }
+  or
+  TSinkPathNode(Ssa::Definition def, BasicBlock bb, int i, Dereference d) {
+    potentialNullDereferenceAt(bb, i, def, d) and
+    (
+      succStep(_, def, bb)
+      or
+      succNullArgument(_, def, bb)
+      or
+      succSourceSink(_, def, bb)
+    )
+  }
+
+/**
+ * An SSA definition, which may be `null`, augmented with at basic block which can
+ * be reached without passing through a `null` check.
+ */
+abstract class PathNode extends TPathNode {
+  /** Gets the SSA definition. */
+  abstract Ssa::Definition getSsaDefinition();
+
+  /** Gets the basic block that can be reached without passing through a `null` check. */
+  abstract BasicBlock getBasicBlock();
+
+  /** Gets another node that can be reached from this node. */
+  abstract PathNode getASuccessor();
+
+  /** Gets a textual representation of this node. */
+  abstract string toString();
+
+  /** Gets the location of this node. */
+  abstract Location getLocation();
+}
+
+private class SourcePathNode extends PathNode, TSourcePathNode {
+  private Ssa::Definition def;
+  private string msg;
+  private Element reason;
+  private boolean isNullArgument;
+
+  SourcePathNode() { this = TSourcePathNode(def, msg, reason, isNullArgument) }
+
+  override Ssa::Definition getSsaDefinition() { result = def }
+
+  override BasicBlock getBasicBlock() {
+    isNullArgument = false and
+    result = def.getBasicBlock()
+  }
+
+  string getMessage() { result = msg }
+
+  Element getReason() { result = reason }
+
+  override PathNode getASuccessor() {
+    succStep(this, result.getSsaDefinition(), result.getBasicBlock())
+    or
+    succNullArgument(this, result.getSsaDefinition(), result.getBasicBlock())
+    or
+    result instanceof SinkPathNode and
+    succSourceSink(this, result.getSsaDefinition(), result.getBasicBlock())
+  }
+
+  override string toString() {
+    if isNullArgument = true then
+      result = reason.toString()
+    else
+      result = def.toString()
+  }
+
+  override Location getLocation() {
+    if isNullArgument = true then
+      result = reason.getLocation()
+    else
+      result = def.getLocation()
+  }
+}
+
+private class InternalPathNode extends PathNode, TInternalPathNode {
+  private Ssa::Definition def;
+  private BasicBlock bb;
+
+  InternalPathNode() { this = TInternalPathNode(def, bb) }
+
+  override Ssa::Definition getSsaDefinition() { result = def }
+
+  override BasicBlock getBasicBlock() { result = bb }
+
+  override PathNode getASuccessor() {
+    succStep(this, result.getSsaDefinition(), result.getBasicBlock())
+  }
+
+  override string toString() { result = bb.getFirstNode().toString() }
+
+  override Location getLocation() { result = bb.getFirstNode().getLocation() }
+}
+
+private class SinkPathNode extends PathNode, TSinkPathNode {
+  private Ssa::Definition def;
+  private BasicBlock bb;
+  private int i;
+  private Dereference d;
+
+  SinkPathNode() { this = TSinkPathNode(def, bb, i, d) }
+
+  override Ssa::Definition getSsaDefinition() { result = def }
+
+  override BasicBlock getBasicBlock() { result = bb }
+
+  override PathNode getASuccessor() { none() }
+
+  Dereference getDereference() { result = d }
+
+  override string toString() { result = d.toString() }
+
+  override Location getLocation() { result = d.getLocation() }
+}
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query
+ * for `Dereference::is[First]MaybeNull()`.
+ */
+module PathGraph {
+  query predicate nodes(PathNode n) {
+    n.getASuccessor*() instanceof SinkPathNode
+  }
+  
+  query predicate edges(PathNode pred, PathNode succ) {
+    nodes(pred) and
+    nodes(succ) and
+    succ = pred.getASuccessor()
+  }
 }
 
 private Ssa::Definition getAPseudoInput(Ssa::Definition def) {
@@ -282,7 +433,7 @@ private predicate defReaches(Ssa::Definition def, AssignableRead ar, boolean alw
     defReaches(def, mid, always) |
     ar = mid.getANextRead() and
     not mid = any(Dereference d |
-      if always = true then d.isAlwaysNull(def.getSourceVariable()) else d.isMaybeNull(def, _, _)
+      if always = true then d.isAlwaysNull(def.getSourceVariable()) else d.isMaybeNull(def, _, _, _, _)
     )
   )
 }
@@ -378,24 +529,16 @@ class Dereference extends G::DereferenceableExpr {
     defReaches(v.getAnSsaDefinition(), this, true)
   }
 
-  pragma[noinline]
-  private predicate nullDerefCandidate(Ssa::Definition origin) {
-    exists(Ssa::Definition ssa, BasicBlock bb |
-      potentialNullDereferenceAt(bb, _, ssa, this) |
-      defMaybeNullInBlockOrigin(origin, ssa, bb)
-    )
-  }
-
   /**
    * Holds if this expression dereferences SSA definition `def`, which may
    * be `null`.
    */
-  predicate isMaybeNull(Ssa::Definition def, string msg, Element reason) {
-    exists(Ssa::Definition origin, BasicBlock bb |
-      this.nullDerefCandidate(origin) and
-      defMaybeNull(origin, msg, reason) and
-      potentialNullDereferenceAt(bb, _, def, this)
-    ) and
+  predicate isMaybeNull(Ssa::Definition def, SourcePathNode source, SinkPathNode sink, string msg, Element reason) {
+    source.getASuccessor*() = sink and
+    msg = source.getMessage() and
+    reason = source.getReason() and
+    def = sink.getSsaDefinition() and
+    this = sink.getDereference() and
     not this.isAlwaysNull(def.getSourceVariable())
   }
 
@@ -404,8 +547,8 @@ class Dereference extends G::DereferenceableExpr {
    * be `null`, and this expression can be reached from `def` without passing
    * through another such dereference.
    */
-  predicate isFirstMaybeNull(Ssa::Definition def, string msg, Element reason) {
-    this.isMaybeNull(def, msg, reason) and
+  predicate isFirstMaybeNull(Ssa::Definition def, SourcePathNode source, SinkPathNode sink, string msg, Element reason) {
+    this.isMaybeNull(def, source, sink, msg, reason) and
     defReaches(def, this, false)
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index e8fa362ebf89..7cb75b63dcb9 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -2249,6 +2249,9 @@ module Ssa {
       definesAt(this, bb, i, _)
     }
 
+    /** Gets the basic block to which this SSA definition belongs. */
+    BasicBlock getBasicBlock() { this.definesAt(result, _) }
+
     /**
      * Holds if this SSA definition assigns to `out`/`ref` parameter `p`, and the
      * parameter may remain unchanged throughout the rest of the enclosing callable.
diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
index 3c28cc8a951b..b6b6f22c2c37 100644
--- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -1,74 +1,779 @@
-| C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null here because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
-| C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null here because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
-| C.cs:96:15:96:15 | access to local variable o | Variable $@ may be null here because of $@ assignment. | C.cs:95:13:95:13 | o | o | C.cs:95:13:95:45 | Object o = ... | this |
-| C.cs:104:27:104:30 | access to parameter list | Variable $@ may be null here because of $@ assignment. | C.cs:100:42:100:45 | list | list | C.cs:103:13:103:23 | ... = ... | this |
-| C.cs:178:13:178:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:152:13:152:13 | s | s | C.cs:179:13:179:20 | ... = ... | this |
-| C.cs:204:13:204:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:186:13:186:13 | s | s | C.cs:205:13:205:20 | ... = ... | this |
-| C.cs:224:9:224:9 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:211:13:211:13 | s | s | C.cs:223:13:223:20 | ... = ... | this |
-| C.cs:243:13:243:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:229:16:229:16 | s | s | C.cs:241:24:241:31 | ... = ... | this |
-| D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null here because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
-| D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null here as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
-| D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null here because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
-| D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null here because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
-| D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null here because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
-| D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null here because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
-| D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
-| D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
-| D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
-| D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
-| D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
-| D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
-| D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null here because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
-| D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
-| D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
-| D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null here because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
-| D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
-| D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
-| D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
-| D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
-| D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
-| D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null here because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
-| D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
-| D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null here because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
-| D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null here because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
-| D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null here because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
-| D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null here because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
-| D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
-| D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null here as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
-| D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
-| D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
-| D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
-| D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
-| D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
-| D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
-| E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null here because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
-| E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null here because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
-| E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null here because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
-| E.cs:35:9:35:12 | access to local variable last | Variable $@ may be null here because of $@ assignment. | E.cs:32:16:32:19 | last | last | E.cs:32:16:32:26 | String last = ... | this |
-| E.cs:43:13:43:16 | access to local variable last | Variable $@ may be null here because of $@ assignment. | E.cs:32:16:32:19 | last | last | E.cs:37:9:37:19 | ... = ... | this |
-| E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null here because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
-| E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null here as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
-| E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null here because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
-| E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null here because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
-| E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null here as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
-| E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
-| E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
-| E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
-| E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
-| E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
-| E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null here as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
-| E.cs:201:11:201:11 | access to local variable o | Variable $@ may be null here because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
-| E.cs:203:11:203:11 | access to local variable o | Variable $@ may be null here because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
-| E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
-| E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
-| E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
-| E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
-| E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
-| GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null here because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
-| NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null here because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
-| StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |
+nodes
+| A.cs:7:16:7:40 | SSA def(synchronizedAlways) |
+| A.cs:8:15:8:32 | access to local variable synchronizedAlways |
+| A.cs:10:13:10:30 | access to local variable synchronizedAlways |
+| A.cs:16:15:16:30 | SSA def(arrayNull) |
+| A.cs:17:9:17:17 | access to local variable arrayNull |
+| A.cs:26:15:26:32 | SSA def(arrayAccess) |
+| A.cs:27:18:27:35 | SSA def(fieldAccess) |
+| A.cs:28:16:28:34 | SSA def(methodAccess) |
+| A.cs:29:16:29:32 | SSA def(methodCall) |
+| A.cs:31:27:31:37 | access to local variable arrayAccess |
+| A.cs:32:27:32:37 | access to local variable fieldAccess |
+| A.cs:33:28:33:39 | access to local variable methodAccess |
+| A.cs:34:27:34:36 | access to local variable methodCall |
+| A.cs:36:27:36:37 | access to local variable arrayAccess |
+| A.cs:37:27:37:37 | access to local variable fieldAccess |
+| A.cs:38:15:38:26 | access to local variable methodAccess |
+| A.cs:39:27:39:36 | access to local variable methodCall |
+| A.cs:48:16:48:28 | SSA def(varRef) |
+| A.cs:50:9:50:14 | access to local variable varRef |
+| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) |
+| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) |
+| Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) |
+| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) |
+| Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) |
+| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) |
+| Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:45:9:45:25 | [b (line 7): false] SSA def(s) |
+| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) |
+| Assert.cs:46:36:46:36 | [b (line 7): false] access to parameter b |
+| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
+| Assert.cs:47:27:47:27 | access to local variable s |
+| Assert.cs:47:27:47:27 | access to local variable s |
+| Assert.cs:49:9:49:25 | SSA def(s) |
+| Assert.cs:50:37:50:37 | access to parameter b |
+| Assert.cs:51:27:51:27 | access to local variable s |
+| B.cs:7:11:7:29 | SSA def(eqCallAlways) |
+| B.cs:10:11:10:30 | SSA def(neqCallAlways) |
+| B.cs:13:13:13:24 | access to local variable eqCallAlways |
+| B.cs:13:13:13:36 | ...; |
+| B.cs:15:9:16:26 | if (...) ... |
+| B.cs:16:13:16:26 | ...; |
+| B.cs:18:9:20:26 | if (...) ... |
+| B.cs:18:25:18:27 | {...} |
+| B.cs:20:13:20:26 | ...; |
+| B.cs:22:9:24:37 | if (...) ... |
+| B.cs:24:13:24:25 | access to local variable neqCallAlways |
+| C.cs:10:16:10:23 | SSA def(o) |
+| C.cs:16:9:19:9 | if (...) ... |
+| C.cs:18:13:18:13 | access to local variable o |
+| C.cs:40:13:40:35 | SSA def(s) |
+| C.cs:42:9:42:9 | access to local variable s |
+| C.cs:55:13:55:36 | SSA def(o2) |
+| C.cs:57:9:57:10 | access to local variable o2 |
+| C.cs:62:13:62:46 | SSA def(o1) |
+| C.cs:64:9:64:10 | access to local variable o1 |
+| C.cs:66:13:66:46 | SSA def(o2) |
+| C.cs:68:9:68:10 | access to local variable o2 |
+| C.cs:95:13:95:45 | SSA def(o) |
+| C.cs:96:15:96:15 | access to local variable o |
+| C.cs:97:13:97:13 | access to local variable o |
+| C.cs:103:13:103:23 | SSA def(list) |
+| C.cs:104:9:108:9 | foreach (... ... in ...) ... |
+| C.cs:104:22:104:22 | Int32 x |
+| C.cs:104:27:104:30 | access to parameter list |
+| C.cs:104:27:104:30 | access to parameter list |
+| C.cs:107:13:107:16 | access to parameter list |
+| C.cs:160:9:160:16 | SSA def(s) |
+| C.cs:163:13:163:13 | access to local variable s |
+| C.cs:168:9:168:16 | SSA def(s) |
+| C.cs:171:13:171:13 | access to local variable s |
+| C.cs:178:13:178:13 | access to local variable s |
+| C.cs:179:13:179:20 | SSA def(s) |
+| C.cs:194:9:194:16 | SSA def(s) |
+| C.cs:197:13:197:13 | access to local variable s |
+| C.cs:198:13:198:20 | [b (line 193): true] SSA def(s) |
+| C.cs:204:13:204:13 | access to local variable s |
+| C.cs:205:13:205:20 | SSA def(s) |
+| C.cs:211:13:211:35 | SSA def(s) |
+| C.cs:215:13:215:20 | SSA def(s) |
+| C.cs:218:9:219:25 | if (...) ... |
+| C.cs:219:13:219:13 | access to local variable s |
+| C.cs:223:13:223:20 | SSA def(s) |
+| C.cs:224:9:224:9 | access to local variable s |
+| C.cs:230:22:230:22 | access to local variable s |
+| C.cs:230:33:230:40 | SSA def(s) |
+| C.cs:234:9:234:9 | access to local variable s |
+| C.cs:236:14:236:21 | SSA def(s) |
+| C.cs:236:24:236:24 | access to local variable s |
+| C.cs:236:35:236:42 | SSA def(s) |
+| C.cs:238:13:238:13 | access to local variable s |
+| C.cs:241:24:241:31 | SSA def(s) |
+| C.cs:243:13:243:13 | access to local variable s |
+| C.cs:249:15:249:22 | SSA def(a) |
+| C.cs:250:9:250:9 | access to local variable a |
+| C.cs:258:15:258:23 | SSA def(ia) |
+| C.cs:259:18:259:26 | SSA def(sa) |
+| C.cs:261:9:261:10 | access to local variable ia |
+| C.cs:262:20:262:21 | access to local variable sa |
+| C.cs:264:9:264:10 | access to local variable ia |
+| C.cs:265:16:265:17 | access to local variable sa |
+| D.cs:17:17:17:20 | null |
+| D.cs:23:9:23:13 | access to parameter param |
+| D.cs:26:32:26:36 | SSA param(param) |
+| D.cs:32:9:32:13 | access to parameter param |
+| D.cs:58:13:58:41 | SSA def(o5) |
+| D.cs:61:9:62:26 | if (...) ... |
+| D.cs:62:13:62:14 | access to local variable o5 |
+| D.cs:68:13:68:34 | SSA def(o7) |
+| D.cs:69:13:69:36 | Boolean ok = ... |
+| D.cs:73:13:73:14 | access to local variable o7 |
+| D.cs:75:13:75:34 | SSA def(o8) |
+| D.cs:76:13:76:43 | Int32 track = ... |
+| D.cs:76:34:76:35 | 42 |
+| D.cs:79:9:80:26 | if (...) ... |
+| D.cs:81:9:82:26 | if (...) ... |
+| D.cs:82:13:82:14 | access to local variable o8 |
+| D.cs:82:13:82:26 | ...; |
+| D.cs:83:9:84:26 | if (...) ... |
+| D.cs:84:13:84:14 | access to local variable o8 |
+| D.cs:89:15:89:44 | SSA def(xs) |
+| D.cs:91:13:91:14 | access to local variable xs |
+| D.cs:91:13:91:22 | ...; |
+| D.cs:93:9:94:30 | if (...) ... |
+| D.cs:94:13:94:30 | ...; |
+| D.cs:94:21:94:22 | access to local variable xs |
+| D.cs:96:9:99:9 | if (...) ... |
+| D.cs:97:9:99:9 | {...} |
+| D.cs:98:21:98:22 | access to local variable xs |
+| D.cs:101:9:102:35 | if (...) ... |
+| D.cs:102:13:102:35 | foreach (... ... in ...) ... |
+| D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:102:35:102:35 | ; |
+| D.cs:104:9:106:30 | if (...) ... |
+| D.cs:105:19:105:20 | access to local variable xs |
+| D.cs:106:17:106:18 | access to local variable xs |
+| D.cs:118:9:118:30 | SSA def(x) |
+| D.cs:120:13:120:13 | access to local variable x |
+| D.cs:125:35:125:35 | SSA param(a) |
+| D.cs:125:35:125:35 | SSA param(a) |
+| D.cs:125:44:125:44 | SSA param(b) |
+| D.cs:127:13:127:43 | Int32 alen = ... |
+| D.cs:127:13:127:43 | Int32 alen = ... |
+| D.cs:127:32:127:32 | 0 |
+| D.cs:127:32:127:32 | 0 |
+| D.cs:127:36:127:36 | access to parameter a |
+| D.cs:128:13:128:43 | Int32 blen = ... |
+| D.cs:128:13:128:43 | Int32 blen = ... |
+| D.cs:128:32:128:32 | 0 |
+| D.cs:128:32:128:32 | 0 |
+| D.cs:128:36:128:36 | access to parameter b |
+| D.cs:131:9:137:9 | {...} |
+| D.cs:131:9:137:9 | {...} |
+| D.cs:132:29:132:29 | access to local variable i |
+| D.cs:132:29:132:29 | access to local variable i |
+| D.cs:133:13:136:13 | {...} |
+| D.cs:133:13:136:13 | {...} |
+| D.cs:134:24:134:24 | access to parameter a |
+| D.cs:135:24:135:24 | access to parameter b |
+| D.cs:138:9:138:18 | ... ...; |
+| D.cs:142:13:142:22 | ...; |
+| D.cs:143:9:146:9 | for (...;...;...) ... |
+| D.cs:143:25:143:25 | access to local variable i |
+| D.cs:144:9:146:9 | {...} |
+| D.cs:145:20:145:20 | access to parameter a |
+| D.cs:149:36:149:38 | SSA param(obj) |
+| D.cs:151:9:151:11 | access to parameter obj |
+| D.cs:163:16:163:25 | SSA def(obj) |
+| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
+| D.cs:171:9:171:11 | access to local variable obj |
+| D.cs:240:9:240:16 | SSA def(o) |
+| D.cs:241:13:241:37 | String other = ... |
+| D.cs:241:29:241:32 | null |
+| D.cs:241:36:241:37 | "" |
+| D.cs:244:9:247:25 | if (...) ... |
+| D.cs:245:13:245:13 | access to local variable o |
+| D.cs:247:13:247:13 | access to local variable o |
+| D.cs:249:13:249:38 | SSA def(o2) |
+| D.cs:253:13:253:14 | access to local variable o2 |
+| D.cs:258:16:258:23 | SSA def(o) |
+| D.cs:266:9:267:25 | if (...) ... |
+| D.cs:267:13:267:13 | access to local variable o |
+| D.cs:269:9:269:16 | SSA def(o) |
+| D.cs:272:25:272:25 | access to local variable i |
+| D.cs:272:39:272:39 | access to local variable i |
+| D.cs:273:9:288:9 | {...} |
+| D.cs:281:13:287:13 | if (...) ... |
+| D.cs:283:17:283:24 | SSA def(o) |
+| D.cs:285:28:285:30 | {...} |
+| D.cs:286:17:286:30 | ...; |
+| D.cs:290:9:291:25 | if (...) ... |
+| D.cs:291:13:291:13 | access to local variable o |
+| D.cs:291:13:291:25 | ...; |
+| D.cs:293:9:294:25 | if (...) ... |
+| D.cs:294:13:294:13 | access to local variable o |
+| D.cs:296:16:296:26 | SSA def(prev) |
+| D.cs:297:25:297:25 | access to local variable i |
+| D.cs:298:9:302:9 | {...} |
+| D.cs:300:17:300:20 | access to local variable prev |
+| D.cs:304:16:304:23 | SSA def(s) |
+| D.cs:307:13:311:13 | foreach (... ... in ...) ... |
+| D.cs:312:13:313:29 | if (...) ... |
+| D.cs:313:17:313:17 | access to local variable s |
+| D.cs:316:16:316:23 | SSA def(r) |
+| D.cs:318:16:318:62 | ... && ... |
+| D.cs:318:41:318:44 | access to local variable stat |
+| D.cs:324:9:324:9 | access to local variable r |
+| D.cs:351:15:351:22 | SSA def(a) |
+| D.cs:355:9:356:21 | for (...;...;...) ... |
+| D.cs:355:25:355:25 | access to local variable i |
+| D.cs:356:13:356:13 | access to local variable a |
+| D.cs:356:13:356:21 | ...; |
+| D.cs:360:20:360:30 | SSA def(last) |
+| D.cs:361:29:361:29 | access to local variable i |
+| D.cs:363:13:363:16 | access to local variable last |
+| D.cs:366:15:366:47 | SSA def(b) |
+| D.cs:370:9:373:9 | for (...;...;...) ... |
+| D.cs:370:25:370:25 | access to local variable i |
+| D.cs:371:9:373:9 | {...} |
+| D.cs:372:13:372:13 | access to local variable b |
+| D.cs:378:19:378:28 | SSA def(ioe) |
+| D.cs:382:9:385:27 | if (...) ... |
+| D.cs:385:13:385:15 | access to local variable ioe |
+| D.cs:388:36:388:36 | SSA param(a) |
+| D.cs:388:45:388:45 | SSA param(b) |
+| D.cs:390:13:390:43 | Int32 alen = ... |
+| D.cs:390:13:390:43 | Int32 alen = ... |
+| D.cs:390:32:390:32 | 0 |
+| D.cs:390:32:390:32 | 0 |
+| D.cs:390:36:390:36 | access to parameter a |
+| D.cs:393:21:393:21 | access to local variable i |
+| D.cs:393:21:393:21 | access to local variable i |
+| D.cs:394:9:396:9 | {...} |
+| D.cs:394:9:396:9 | {...} |
+| D.cs:395:20:395:20 | access to parameter a |
+| D.cs:397:9:397:44 | ... ...; |
+| D.cs:397:13:397:43 | Int32 blen = ... |
+| D.cs:397:32:397:32 | 0 |
+| D.cs:398:21:398:21 | access to local variable i |
+| D.cs:399:9:401:9 | {...} |
+| D.cs:400:20:400:20 | access to parameter b |
+| D.cs:405:35:405:35 | SSA param(x) |
+| D.cs:405:35:405:35 | SSA param(x) |
+| D.cs:405:35:405:35 | SSA param(x) |
+| D.cs:405:45:405:45 | SSA param(y) |
+| D.cs:405:45:405:45 | SSA param(y) |
+| D.cs:405:45:405:45 | SSA param(y) |
+| D.cs:407:42:407:63 | ... && ... |
+| D.cs:407:42:407:63 | ... && ... |
+| D.cs:407:55:407:55 | access to parameter y |
+| D.cs:407:55:407:55 | access to parameter y |
+| D.cs:409:9:410:25 | if (...) ... |
+| D.cs:409:9:410:25 | if (...) ... |
+| D.cs:410:13:410:13 | access to parameter y |
+| D.cs:411:9:412:25 | if (...) ... |
+| D.cs:412:13:412:13 | access to parameter x |
+| E.cs:9:18:9:26 | SSA def(a2) |
+| E.cs:10:13:10:54 | Boolean haveA2 = ... |
+| E.cs:11:16:11:24 | SSA def(a3) |
+| E.cs:12:13:12:52 | Boolean haveA3 = ... |
+| E.cs:12:38:12:39 | access to local variable a2 |
+| E.cs:14:13:14:14 | access to local variable a3 |
+| E.cs:23:13:23:30 | SSA def(s1) |
+| E.cs:24:13:24:41 | ... = ... |
+| E.cs:24:33:24:36 | null |
+| E.cs:26:9:27:26 | if (...) ... |
+| E.cs:27:13:27:14 | access to local variable s1 |
+| E.cs:32:16:32:26 | SSA def(last) |
+| E.cs:33:9:34:21 | foreach (... ... in ...) ... |
+| E.cs:35:9:35:12 | access to local variable last |
+| E.cs:37:9:37:19 | SSA def(last) |
+| E.cs:39:9:44:9 | {...} |
+| E.cs:40:13:41:25 | foreach (... ... in ...) ... |
+| E.cs:43:13:43:16 | access to local variable last |
+| E.cs:51:22:51:33 | SSA def(slice) |
+| E.cs:53:16:53:19 | access to local variable iter |
+| E.cs:54:9:63:9 | {...} |
+| E.cs:61:13:61:17 | access to local variable slice |
+| E.cs:61:13:61:27 | ...; |
+| E.cs:66:40:66:42 | SSA param(arr) |
+| E.cs:70:13:70:49 | ... = ... |
+| E.cs:70:13:70:50 | ...; |
+| E.cs:70:36:70:36 | 0 |
+| E.cs:72:9:73:23 | if (...) ... |
+| E.cs:73:13:73:15 | access to parameter arr |
+| E.cs:107:15:107:25 | SSA def(arr2) |
+| E.cs:111:9:112:30 | for (...;...;...) ... |
+| E.cs:111:25:111:25 | access to local variable i |
+| E.cs:112:13:112:16 | access to local variable arr2 |
+| E.cs:112:13:112:30 | ...; |
+| E.cs:120:16:120:20 | !... |
+| E.cs:121:9:143:9 | {...} |
+| E.cs:123:20:123:35 | ... && ... |
+| E.cs:123:29:123:29 | access to local variable j |
+| E.cs:124:13:142:13 | {...} |
+| E.cs:125:33:125:35 | access to local variable obj |
+| E.cs:128:21:128:23 | access to local variable obj |
+| E.cs:137:25:137:34 | SSA def(obj) |
+| E.cs:139:21:139:29 | continue; |
+| E.cs:141:17:141:26 | ...; |
+| E.cs:152:16:152:26 | SSA def(obj2) |
+| E.cs:158:9:159:28 | if (...) ... |
+| E.cs:159:13:159:16 | access to local variable obj2 |
+| E.cs:162:28:162:28 | SSA param(a) |
+| E.cs:164:13:164:40 | Int32 n = ... |
+| E.cs:164:29:164:29 | 0 |
+| E.cs:165:25:165:25 | access to local variable i |
+| E.cs:165:32:165:32 | access to local variable i |
+| E.cs:166:9:170:9 | {...} |
+| E.cs:167:21:167:21 | access to parameter a |
+| E.cs:173:29:173:31 | SSA param(obj) |
+| E.cs:173:29:173:31 | SSA param(obj) |
+| E.cs:175:14:175:42 | Boolean b2 = ... |
+| E.cs:175:33:175:37 | false |
+| E.cs:177:9:179:9 | {...} |
+| E.cs:178:13:178:15 | access to parameter obj |
+| E.cs:180:9:183:9 | if (...) ... |
+| E.cs:181:9:183:9 | {...} |
+| E.cs:184:9:187:9 | if (...) ... |
+| E.cs:186:13:186:15 | access to parameter obj |
+| E.cs:190:29:190:29 | SSA param(o) |
+| E.cs:192:17:192:17 | access to parameter o |
+| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) |
+| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) |
+| E.cs:201:11:201:11 | access to local variable o |
+| E.cs:203:11:203:11 | access to local variable o |
+| E.cs:206:28:206:28 | SSA param(s) |
+| E.cs:210:16:210:16 | access to parameter s |
+| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) |
+| E.cs:218:9:218:9 | access to local variable x |
+| E.cs:220:13:220:13 | access to local variable x |
+| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) |
+| E.cs:229:13:229:13 | access to local variable x |
+| E.cs:230:9:230:9 | access to local variable x |
+| E.cs:233:26:233:26 | SSA param(i) |
+| E.cs:235:16:235:16 | access to parameter i |
+| E.cs:238:26:238:26 | SSA param(i) |
+| E.cs:240:21:240:21 | access to parameter i |
+| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) |
+| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) |
+| E.cs:285:9:285:9 | access to local variable o |
+| E.cs:285:9:285:9 | access to local variable o |
+| Forwarding.cs:7:16:7:23 | SSA def(s) |
+| Forwarding.cs:14:9:17:9 | if (...) ... |
+| Forwarding.cs:19:9:22:9 | if (...) ... |
+| Forwarding.cs:24:9:27:9 | if (...) ... |
+| Forwarding.cs:29:9:32:9 | if (...) ... |
+| Forwarding.cs:34:9:37:9 | if (...) ... |
+| Forwarding.cs:35:9:37:9 | {...} |
+| Forwarding.cs:36:31:36:31 | access to local variable s |
+| Forwarding.cs:40:27:40:27 | access to local variable s |
+| GuardedString.cs:7:16:7:32 | SSA def(s) |
+| GuardedString.cs:14:9:17:9 | if (...) ... |
+| GuardedString.cs:19:9:20:40 | if (...) ... |
+| GuardedString.cs:19:26:19:26 | 0 |
+| GuardedString.cs:22:9:23:40 | if (...) ... |
+| GuardedString.cs:22:25:22:25 | 0 |
+| GuardedString.cs:25:9:26:40 | if (...) ... |
+| GuardedString.cs:25:26:25:26 | 0 |
+| GuardedString.cs:28:9:29:40 | if (...) ... |
+| GuardedString.cs:28:25:28:26 | 10 |
+| GuardedString.cs:31:9:32:40 | if (...) ... |
+| GuardedString.cs:31:26:31:27 | 10 |
+| GuardedString.cs:34:9:37:40 | if (...) ... |
+| GuardedString.cs:34:26:34:26 | 0 |
+| GuardedString.cs:35:31:35:31 | access to local variable s |
+| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) |
+| NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
+| NullMaybeBad.cs:7:27:7:27 | access to parameter o |
+| NullMaybeBad.cs:13:17:13:20 | null |
+| StringConcatenation.cs:14:16:14:23 | SSA def(s) |
+| StringConcatenation.cs:15:16:15:16 | access to local variable s |
+| StringConcatenation.cs:16:17:16:17 | access to local variable s |
+edges
+| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
+| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:10:13:10:30 | access to local variable synchronizedAlways |
+| A.cs:16:15:16:30 | SSA def(arrayNull) | A.cs:17:9:17:17 | access to local variable arrayNull |
+| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:31:27:31:37 | access to local variable arrayAccess |
+| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:36:27:36:37 | access to local variable arrayAccess |
+| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:32:27:32:37 | access to local variable fieldAccess |
+| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:37:27:37:37 | access to local variable fieldAccess |
+| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:33:28:33:39 | access to local variable methodAccess |
+| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:38:15:38:26 | access to local variable methodAccess |
+| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:34:27:34:36 | access to local variable methodCall |
+| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:39:27:39:36 | access to local variable methodCall |
+| A.cs:48:16:48:28 | SSA def(varRef) | A.cs:50:9:50:14 | access to local variable varRef |
+| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:45:9:45:25 | [b (line 7): false] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): false] access to parameter b |
+| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
+| Assert.cs:46:36:46:36 | [b (line 7): false] access to parameter b | Assert.cs:47:27:47:27 | access to local variable s |
+| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b | Assert.cs:47:27:47:27 | access to local variable s |
+| Assert.cs:49:9:49:25 | SSA def(s) | Assert.cs:50:37:50:37 | access to parameter b |
+| Assert.cs:50:37:50:37 | access to parameter b | Assert.cs:51:27:51:27 | access to local variable s |
+| B.cs:7:11:7:29 | SSA def(eqCallAlways) | B.cs:13:13:13:24 | access to local variable eqCallAlways |
+| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:13:13:13:36 | ...; |
+| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:15:9:16:26 | if (...) ... |
+| B.cs:13:13:13:36 | ...; | B.cs:15:9:16:26 | if (...) ... |
+| B.cs:15:9:16:26 | if (...) ... | B.cs:16:13:16:26 | ...; |
+| B.cs:15:9:16:26 | if (...) ... | B.cs:18:9:20:26 | if (...) ... |
+| B.cs:16:13:16:26 | ...; | B.cs:18:9:20:26 | if (...) ... |
+| B.cs:18:9:20:26 | if (...) ... | B.cs:18:25:18:27 | {...} |
+| B.cs:18:9:20:26 | if (...) ... | B.cs:20:13:20:26 | ...; |
+| B.cs:18:25:18:27 | {...} | B.cs:22:9:24:37 | if (...) ... |
+| B.cs:20:13:20:26 | ...; | B.cs:22:9:24:37 | if (...) ... |
+| B.cs:22:9:24:37 | if (...) ... | B.cs:24:13:24:25 | access to local variable neqCallAlways |
+| C.cs:10:16:10:23 | SSA def(o) | C.cs:16:9:19:9 | if (...) ... |
+| C.cs:16:9:19:9 | if (...) ... | C.cs:18:13:18:13 | access to local variable o |
+| C.cs:40:13:40:35 | SSA def(s) | C.cs:42:9:42:9 | access to local variable s |
+| C.cs:55:13:55:36 | SSA def(o2) | C.cs:57:9:57:10 | access to local variable o2 |
+| C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 |
+| C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 |
+| C.cs:95:13:95:45 | SSA def(o) | C.cs:96:15:96:15 | access to local variable o |
+| C.cs:95:13:95:45 | SSA def(o) | C.cs:97:13:97:13 | access to local variable o |
+| C.cs:103:13:103:23 | SSA def(list) | C.cs:104:27:104:30 | access to parameter list |
+| C.cs:103:13:103:23 | SSA def(list) | C.cs:104:27:104:30 | access to parameter list |
+| C.cs:104:9:108:9 | foreach (... ... in ...) ... | C.cs:104:22:104:22 | Int32 x |
+| C.cs:104:9:108:9 | foreach (... ... in ...) ... | C.cs:107:13:107:16 | access to parameter list |
+| C.cs:104:22:104:22 | Int32 x | C.cs:104:9:108:9 | foreach (... ... in ...) ... |
+| C.cs:104:27:104:30 | access to parameter list | C.cs:104:9:108:9 | foreach (... ... in ...) ... |
+| C.cs:160:9:160:16 | SSA def(s) | C.cs:163:13:163:13 | access to local variable s |
+| C.cs:168:9:168:16 | SSA def(s) | C.cs:171:13:171:13 | access to local variable s |
+| C.cs:179:13:179:20 | SSA def(s) | C.cs:178:13:178:13 | access to local variable s |
+| C.cs:194:9:194:16 | SSA def(s) | C.cs:197:13:197:13 | access to local variable s |
+| C.cs:198:13:198:20 | [b (line 193): true] SSA def(s) | C.cs:197:13:197:13 | access to local variable s |
+| C.cs:205:13:205:20 | SSA def(s) | C.cs:204:13:204:13 | access to local variable s |
+| C.cs:211:13:211:35 | SSA def(s) | C.cs:218:9:219:25 | if (...) ... |
+| C.cs:215:13:215:20 | SSA def(s) | C.cs:218:9:219:25 | if (...) ... |
+| C.cs:218:9:219:25 | if (...) ... | C.cs:219:13:219:13 | access to local variable s |
+| C.cs:223:13:223:20 | SSA def(s) | C.cs:224:9:224:9 | access to local variable s |
+| C.cs:230:22:230:22 | access to local variable s | C.cs:234:9:234:9 | access to local variable s |
+| C.cs:230:33:230:40 | SSA def(s) | C.cs:230:22:230:22 | access to local variable s |
+| C.cs:236:14:236:21 | SSA def(s) | C.cs:236:24:236:24 | access to local variable s |
+| C.cs:236:24:236:24 | access to local variable s | C.cs:238:13:238:13 | access to local variable s |
+| C.cs:236:35:236:42 | SSA def(s) | C.cs:236:24:236:24 | access to local variable s |
+| C.cs:241:24:241:31 | SSA def(s) | C.cs:243:13:243:13 | access to local variable s |
+| C.cs:249:15:249:22 | SSA def(a) | C.cs:250:9:250:9 | access to local variable a |
+| C.cs:258:15:258:23 | SSA def(ia) | C.cs:261:9:261:10 | access to local variable ia |
+| C.cs:258:15:258:23 | SSA def(ia) | C.cs:264:9:264:10 | access to local variable ia |
+| C.cs:259:18:259:26 | SSA def(sa) | C.cs:262:20:262:21 | access to local variable sa |
+| C.cs:259:18:259:26 | SSA def(sa) | C.cs:265:16:265:17 | access to local variable sa |
+| D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param |
+| D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param |
+| D.cs:58:13:58:41 | SSA def(o5) | D.cs:61:9:62:26 | if (...) ... |
+| D.cs:61:9:62:26 | if (...) ... | D.cs:62:13:62:14 | access to local variable o5 |
+| D.cs:68:13:68:34 | SSA def(o7) | D.cs:69:13:69:36 | Boolean ok = ... |
+| D.cs:69:13:69:36 | Boolean ok = ... | D.cs:73:13:73:14 | access to local variable o7 |
+| D.cs:75:13:75:34 | SSA def(o8) | D.cs:76:34:76:35 | 42 |
+| D.cs:76:13:76:43 | Int32 track = ... | D.cs:79:9:80:26 | if (...) ... |
+| D.cs:76:34:76:35 | 42 | D.cs:76:13:76:43 | Int32 track = ... |
+| D.cs:79:9:80:26 | if (...) ... | D.cs:81:9:82:26 | if (...) ... |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:14 | access to local variable o8 |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:26 | ...; |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:83:9:84:26 | if (...) ... |
+| D.cs:82:13:82:26 | ...; | D.cs:83:9:84:26 | if (...) ... |
+| D.cs:83:9:84:26 | if (...) ... | D.cs:84:13:84:14 | access to local variable o8 |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:22 | ...; |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:93:9:94:30 | if (...) ... |
+| D.cs:91:13:91:22 | ...; | D.cs:93:9:94:30 | if (...) ... |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:94:13:94:30 | ...; |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:94:21:94:22 | access to local variable xs |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:96:9:99:9 | if (...) ... |
+| D.cs:94:13:94:30 | ...; | D.cs:96:9:99:9 | if (...) ... |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:97:9:99:9 | {...} |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:98:21:98:22 | access to local variable xs |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:101:9:102:35 | if (...) ... |
+| D.cs:97:9:99:9 | {...} | D.cs:101:9:102:35 | if (...) ... |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:104:9:106:30 | if (...) ... |
+| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:102:35:102:35 | ; |
+| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:104:9:106:30 | if (...) ... |
+| D.cs:102:31:102:32 | access to local variable xs | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
+| D.cs:102:35:102:35 | ; | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
+| D.cs:104:9:106:30 | if (...) ... | D.cs:105:19:105:20 | access to local variable xs |
+| D.cs:104:9:106:30 | if (...) ... | D.cs:106:17:106:18 | access to local variable xs |
+| D.cs:118:9:118:30 | SSA def(x) | D.cs:120:13:120:13 | access to local variable x |
+| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:36:127:36 | access to parameter a |
+| D.cs:127:13:127:43 | Int32 alen = ... | D.cs:128:32:128:32 | 0 |
+| D.cs:127:13:127:43 | Int32 alen = ... | D.cs:128:32:128:32 | 0 |
+| D.cs:127:13:127:43 | Int32 alen = ... | D.cs:128:36:128:36 | access to parameter b |
+| D.cs:127:32:127:32 | 0 | D.cs:127:13:127:43 | Int32 alen = ... |
+| D.cs:127:32:127:32 | 0 | D.cs:127:13:127:43 | Int32 alen = ... |
+| D.cs:127:36:127:36 | access to parameter a | D.cs:127:13:127:43 | Int32 alen = ... |
+| D.cs:128:13:128:43 | Int32 blen = ... | D.cs:131:9:137:9 | {...} |
+| D.cs:128:13:128:43 | Int32 blen = ... | D.cs:131:9:137:9 | {...} |
+| D.cs:128:13:128:43 | Int32 blen = ... | D.cs:138:9:138:18 | ... ...; |
+| D.cs:128:32:128:32 | 0 | D.cs:128:13:128:43 | Int32 blen = ... |
+| D.cs:128:32:128:32 | 0 | D.cs:128:13:128:43 | Int32 blen = ... |
+| D.cs:128:36:128:36 | access to parameter b | D.cs:128:13:128:43 | Int32 blen = ... |
+| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:134:24:134:24 | access to parameter a |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:135:24:135:24 | access to parameter b |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:138:9:138:18 | ... ...; |
+| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:138:9:138:18 | ... ...; | D.cs:142:13:142:22 | ...; |
+| D.cs:142:13:142:22 | ...; | D.cs:143:9:146:9 | for (...;...;...) ... |
+| D.cs:143:9:146:9 | for (...;...;...) ... | D.cs:143:25:143:25 | access to local variable i |
+| D.cs:143:25:143:25 | access to local variable i | D.cs:144:9:146:9 | {...} |
+| D.cs:143:25:143:25 | access to local variable i | D.cs:145:20:145:20 | access to parameter a |
+| D.cs:144:9:146:9 | {...} | D.cs:143:25:143:25 | access to local variable i |
+| D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj |
+| D.cs:163:16:163:25 | SSA def(obj) | D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
+| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} | D.cs:171:9:171:11 | access to local variable obj |
+| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:29:241:32 | null |
+| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:36:241:37 | "" |
+| D.cs:241:13:241:37 | String other = ... | D.cs:244:9:247:25 | if (...) ... |
+| D.cs:241:29:241:32 | null | D.cs:241:13:241:37 | String other = ... |
+| D.cs:241:36:241:37 | "" | D.cs:241:13:241:37 | String other = ... |
+| D.cs:244:9:247:25 | if (...) ... | D.cs:245:13:245:13 | access to local variable o |
+| D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
+| D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
+| D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
+| D.cs:266:9:267:25 | if (...) ... | D.cs:267:13:267:13 | access to local variable o |
+| D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
+| D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
+| D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
+| D.cs:272:39:272:39 | access to local variable i | D.cs:272:25:272:25 | access to local variable i |
+| D.cs:273:9:288:9 | {...} | D.cs:281:13:287:13 | if (...) ... |
+| D.cs:281:13:287:13 | if (...) ... | D.cs:272:39:272:39 | access to local variable i |
+| D.cs:283:17:283:24 | SSA def(o) | D.cs:285:28:285:30 | {...} |
+| D.cs:283:17:283:24 | SSA def(o) | D.cs:286:17:286:30 | ...; |
+| D.cs:285:28:285:30 | {...} | D.cs:286:17:286:30 | ...; |
+| D.cs:286:17:286:30 | ...; | D.cs:272:39:272:39 | access to local variable i |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:13 | access to local variable o |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:25 | ...; |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:293:9:294:25 | if (...) ... |
+| D.cs:291:13:291:25 | ...; | D.cs:293:9:294:25 | if (...) ... |
+| D.cs:293:9:294:25 | if (...) ... | D.cs:294:13:294:13 | access to local variable o |
+| D.cs:296:16:296:26 | SSA def(prev) | D.cs:297:25:297:25 | access to local variable i |
+| D.cs:297:25:297:25 | access to local variable i | D.cs:298:9:302:9 | {...} |
+| D.cs:298:9:302:9 | {...} | D.cs:300:17:300:20 | access to local variable prev |
+| D.cs:304:16:304:23 | SSA def(s) | D.cs:307:13:311:13 | foreach (... ... in ...) ... |
+| D.cs:307:13:311:13 | foreach (... ... in ...) ... | D.cs:312:13:313:29 | if (...) ... |
+| D.cs:312:13:313:29 | if (...) ... | D.cs:313:17:313:17 | access to local variable s |
+| D.cs:316:16:316:23 | SSA def(r) | D.cs:318:16:318:62 | ... && ... |
+| D.cs:318:16:318:62 | ... && ... | D.cs:318:41:318:44 | access to local variable stat |
+| D.cs:318:16:318:62 | ... && ... | D.cs:324:9:324:9 | access to local variable r |
+| D.cs:318:41:318:44 | access to local variable stat | D.cs:324:9:324:9 | access to local variable r |
+| D.cs:351:15:351:22 | SSA def(a) | D.cs:355:9:356:21 | for (...;...;...) ... |
+| D.cs:355:9:356:21 | for (...;...;...) ... | D.cs:355:25:355:25 | access to local variable i |
+| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:13 | access to local variable a |
+| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:21 | ...; |
+| D.cs:356:13:356:21 | ...; | D.cs:355:25:355:25 | access to local variable i |
+| D.cs:360:20:360:30 | SSA def(last) | D.cs:361:29:361:29 | access to local variable i |
+| D.cs:361:29:361:29 | access to local variable i | D.cs:363:13:363:16 | access to local variable last |
+| D.cs:366:15:366:47 | SSA def(b) | D.cs:370:9:373:9 | for (...;...;...) ... |
+| D.cs:370:9:373:9 | for (...;...;...) ... | D.cs:370:25:370:25 | access to local variable i |
+| D.cs:370:25:370:25 | access to local variable i | D.cs:371:9:373:9 | {...} |
+| D.cs:370:25:370:25 | access to local variable i | D.cs:372:13:372:13 | access to local variable b |
+| D.cs:371:9:373:9 | {...} | D.cs:370:25:370:25 | access to local variable i |
+| D.cs:378:19:378:28 | SSA def(ioe) | D.cs:382:9:385:27 | if (...) ... |
+| D.cs:382:9:385:27 | if (...) ... | D.cs:385:13:385:15 | access to local variable ioe |
+| D.cs:388:36:388:36 | SSA param(a) | D.cs:390:32:390:32 | 0 |
+| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:32:390:32 | 0 |
+| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:36:390:36 | access to parameter a |
+| D.cs:390:13:390:43 | Int32 alen = ... | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:390:13:390:43 | Int32 alen = ... | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:390:32:390:32 | 0 | D.cs:390:13:390:43 | Int32 alen = ... |
+| D.cs:390:32:390:32 | 0 | D.cs:390:13:390:43 | Int32 alen = ... |
+| D.cs:390:36:390:36 | access to parameter a | D.cs:390:13:390:43 | Int32 alen = ... |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:395:20:395:20 | access to parameter a |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:397:9:397:44 | ... ...; |
+| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:397:9:397:44 | ... ...; | D.cs:397:32:397:32 | 0 |
+| D.cs:397:13:397:43 | Int32 blen = ... | D.cs:398:21:398:21 | access to local variable i |
+| D.cs:397:32:397:32 | 0 | D.cs:397:13:397:43 | Int32 blen = ... |
+| D.cs:398:21:398:21 | access to local variable i | D.cs:399:9:401:9 | {...} |
+| D.cs:398:21:398:21 | access to local variable i | D.cs:400:20:400:20 | access to parameter b |
+| D.cs:399:9:401:9 | {...} | D.cs:398:21:398:21 | access to local variable i |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:42:407:63 | ... && ... |
+| D.cs:407:42:407:63 | ... && ... | D.cs:407:55:407:55 | access to parameter y |
+| D.cs:407:42:407:63 | ... && ... | D.cs:407:55:407:55 | access to parameter y |
+| D.cs:407:42:407:63 | ... && ... | D.cs:409:9:410:25 | if (...) ... |
+| D.cs:407:55:407:55 | access to parameter y | D.cs:409:9:410:25 | if (...) ... |
+| D.cs:407:55:407:55 | access to parameter y | D.cs:409:9:410:25 | if (...) ... |
+| D.cs:409:9:410:25 | if (...) ... | D.cs:410:13:410:13 | access to parameter y |
+| D.cs:409:9:410:25 | if (...) ... | D.cs:411:9:412:25 | if (...) ... |
+| D.cs:411:9:412:25 | if (...) ... | D.cs:412:13:412:13 | access to parameter x |
+| E.cs:9:18:9:26 | SSA def(a2) | E.cs:10:13:10:54 | Boolean haveA2 = ... |
+| E.cs:10:13:10:54 | Boolean haveA2 = ... | E.cs:12:38:12:39 | access to local variable a2 |
+| E.cs:11:16:11:24 | SSA def(a3) | E.cs:12:13:12:52 | Boolean haveA3 = ... |
+| E.cs:12:13:12:52 | Boolean haveA3 = ... | E.cs:14:13:14:14 | access to local variable a3 |
+| E.cs:23:13:23:30 | SSA def(s1) | E.cs:24:33:24:36 | null |
+| E.cs:24:13:24:41 | ... = ... | E.cs:26:9:27:26 | if (...) ... |
+| E.cs:24:33:24:36 | null | E.cs:24:13:24:41 | ... = ... |
+| E.cs:26:9:27:26 | if (...) ... | E.cs:27:13:27:14 | access to local variable s1 |
+| E.cs:32:16:32:26 | SSA def(last) | E.cs:33:9:34:21 | foreach (... ... in ...) ... |
+| E.cs:33:9:34:21 | foreach (... ... in ...) ... | E.cs:35:9:35:12 | access to local variable last |
+| E.cs:37:9:37:19 | SSA def(last) | E.cs:39:9:44:9 | {...} |
+| E.cs:39:9:44:9 | {...} | E.cs:40:13:41:25 | foreach (... ... in ...) ... |
+| E.cs:40:13:41:25 | foreach (... ... in ...) ... | E.cs:43:13:43:16 | access to local variable last |
+| E.cs:51:22:51:33 | SSA def(slice) | E.cs:53:16:53:19 | access to local variable iter |
+| E.cs:53:16:53:19 | access to local variable iter | E.cs:54:9:63:9 | {...} |
+| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:17 | access to local variable slice |
+| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:27 | ...; |
+| E.cs:61:13:61:27 | ...; | E.cs:53:16:53:19 | access to local variable iter |
+| E.cs:66:40:66:42 | SSA param(arr) | E.cs:70:13:70:50 | ...; |
+| E.cs:66:40:66:42 | SSA param(arr) | E.cs:72:9:73:23 | if (...) ... |
+| E.cs:70:13:70:49 | ... = ... | E.cs:72:9:73:23 | if (...) ... |
+| E.cs:70:13:70:50 | ...; | E.cs:70:36:70:36 | 0 |
+| E.cs:70:36:70:36 | 0 | E.cs:70:13:70:49 | ... = ... |
+| E.cs:72:9:73:23 | if (...) ... | E.cs:73:13:73:15 | access to parameter arr |
+| E.cs:107:15:107:25 | SSA def(arr2) | E.cs:111:9:112:30 | for (...;...;...) ... |
+| E.cs:111:9:112:30 | for (...;...;...) ... | E.cs:111:25:111:25 | access to local variable i |
+| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:16 | access to local variable arr2 |
+| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:30 | ...; |
+| E.cs:112:13:112:30 | ...; | E.cs:111:25:111:25 | access to local variable i |
+| E.cs:120:16:120:20 | !... | E.cs:121:9:143:9 | {...} |
+| E.cs:121:9:143:9 | {...} | E.cs:123:20:123:35 | ... && ... |
+| E.cs:123:20:123:35 | ... && ... | E.cs:120:16:120:20 | !... |
+| E.cs:123:20:123:35 | ... && ... | E.cs:123:29:123:29 | access to local variable j |
+| E.cs:123:29:123:29 | access to local variable j | E.cs:120:16:120:20 | !... |
+| E.cs:123:29:123:29 | access to local variable j | E.cs:124:13:142:13 | {...} |
+| E.cs:123:29:123:29 | access to local variable j | E.cs:125:33:125:35 | access to local variable obj |
+| E.cs:124:13:142:13 | {...} | E.cs:128:21:128:23 | access to local variable obj |
+| E.cs:124:13:142:13 | {...} | E.cs:141:17:141:26 | ...; |
+| E.cs:137:25:137:34 | SSA def(obj) | E.cs:139:21:139:29 | continue; |
+| E.cs:139:21:139:29 | continue; | E.cs:123:20:123:35 | ... && ... |
+| E.cs:141:17:141:26 | ...; | E.cs:123:20:123:35 | ... && ... |
+| E.cs:152:16:152:26 | SSA def(obj2) | E.cs:158:9:159:28 | if (...) ... |
+| E.cs:158:9:159:28 | if (...) ... | E.cs:159:13:159:16 | access to local variable obj2 |
+| E.cs:162:28:162:28 | SSA param(a) | E.cs:164:29:164:29 | 0 |
+| E.cs:164:13:164:40 | Int32 n = ... | E.cs:165:25:165:25 | access to local variable i |
+| E.cs:164:29:164:29 | 0 | E.cs:164:13:164:40 | Int32 n = ... |
+| E.cs:165:25:165:25 | access to local variable i | E.cs:166:9:170:9 | {...} |
+| E.cs:165:25:165:25 | access to local variable i | E.cs:167:21:167:21 | access to parameter a |
+| E.cs:165:32:165:32 | access to local variable i | E.cs:165:25:165:25 | access to local variable i |
+| E.cs:166:9:170:9 | {...} | E.cs:165:32:165:32 | access to local variable i |
+| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
+| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
+| E.cs:175:14:175:42 | Boolean b2 = ... | E.cs:177:9:179:9 | {...} |
+| E.cs:175:14:175:42 | Boolean b2 = ... | E.cs:178:13:178:15 | access to parameter obj |
+| E.cs:175:14:175:42 | Boolean b2 = ... | E.cs:180:9:183:9 | if (...) ... |
+| E.cs:175:33:175:37 | false | E.cs:175:14:175:42 | Boolean b2 = ... |
+| E.cs:177:9:179:9 | {...} | E.cs:180:9:183:9 | if (...) ... |
+| E.cs:180:9:183:9 | if (...) ... | E.cs:181:9:183:9 | {...} |
+| E.cs:181:9:183:9 | {...} | E.cs:184:9:187:9 | if (...) ... |
+| E.cs:184:9:187:9 | if (...) ... | E.cs:186:13:186:15 | access to parameter obj |
+| E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
+| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:11:203:11 | access to local variable o |
+| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:11:201:11 | access to local variable o |
+| E.cs:206:28:206:28 | SSA param(s) | E.cs:210:16:210:16 | access to parameter s |
+| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
+| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
+| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
+| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x |
+| E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i |
+| E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
+| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
+| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
+| Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:14:9:17:9 | if (...) ... |
+| Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
+| Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:24:9:27:9 | if (...) ... |
+| Forwarding.cs:24:9:27:9 | if (...) ... | Forwarding.cs:29:9:32:9 | if (...) ... |
+| Forwarding.cs:29:9:32:9 | if (...) ... | Forwarding.cs:34:9:37:9 | if (...) ... |
+| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:35:9:37:9 | {...} |
+| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:36:31:36:31 | access to local variable s |
+| Forwarding.cs:35:9:37:9 | {...} | Forwarding.cs:40:27:40:27 | access to local variable s |
+| GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:14:9:17:9 | if (...) ... |
+| GuardedString.cs:14:9:17:9 | if (...) ... | GuardedString.cs:19:9:20:40 | if (...) ... |
+| GuardedString.cs:19:9:20:40 | if (...) ... | GuardedString.cs:19:26:19:26 | 0 |
+| GuardedString.cs:19:26:19:26 | 0 | GuardedString.cs:22:9:23:40 | if (...) ... |
+| GuardedString.cs:22:9:23:40 | if (...) ... | GuardedString.cs:22:25:22:25 | 0 |
+| GuardedString.cs:22:25:22:25 | 0 | GuardedString.cs:25:9:26:40 | if (...) ... |
+| GuardedString.cs:25:9:26:40 | if (...) ... | GuardedString.cs:25:26:25:26 | 0 |
+| GuardedString.cs:25:26:25:26 | 0 | GuardedString.cs:28:9:29:40 | if (...) ... |
+| GuardedString.cs:28:9:29:40 | if (...) ... | GuardedString.cs:28:25:28:26 | 10 |
+| GuardedString.cs:28:25:28:26 | 10 | GuardedString.cs:31:9:32:40 | if (...) ... |
+| GuardedString.cs:31:9:32:40 | if (...) ... | GuardedString.cs:31:26:31:27 | 10 |
+| GuardedString.cs:31:26:31:27 | 10 | GuardedString.cs:34:9:37:40 | if (...) ... |
+| GuardedString.cs:34:9:37:40 | if (...) ... | GuardedString.cs:34:26:34:26 | 0 |
+| GuardedString.cs:34:26:34:26 | 0 | GuardedString.cs:35:31:35:31 | access to local variable s |
+| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) | NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
+| NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o |
+| StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:15:16:15:16 | access to local variable s |
+| StringConcatenation.cs:15:16:15:16 | access to local variable s | StringConcatenation.cs:16:17:16:17 | access to local variable s |
+#select
+| C.cs:64:9:64:10 | access to local variable o1 | C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null here because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
+| C.cs:68:9:68:10 | access to local variable o2 | C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null here because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
+| C.cs:96:15:96:15 | access to local variable o | C.cs:95:13:95:45 | SSA def(o) | C.cs:96:15:96:15 | access to local variable o | Variable $@ may be null here because of $@ assignment. | C.cs:95:13:95:13 | o | o | C.cs:95:13:95:45 | Object o = ... | this |
+| C.cs:104:27:104:30 | access to parameter list | C.cs:103:13:103:23 | SSA def(list) | C.cs:104:27:104:30 | access to parameter list | Variable $@ may be null here because of $@ assignment. | C.cs:100:42:100:45 | list | list | C.cs:103:13:103:23 | ... = ... | this |
+| C.cs:178:13:178:13 | access to local variable s | C.cs:179:13:179:20 | SSA def(s) | C.cs:178:13:178:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:152:13:152:13 | s | s | C.cs:179:13:179:20 | ... = ... | this |
+| C.cs:204:13:204:13 | access to local variable s | C.cs:205:13:205:20 | SSA def(s) | C.cs:204:13:204:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:186:13:186:13 | s | s | C.cs:205:13:205:20 | ... = ... | this |
+| C.cs:224:9:224:9 | access to local variable s | C.cs:223:13:223:20 | SSA def(s) | C.cs:224:9:224:9 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:211:13:211:13 | s | s | C.cs:223:13:223:20 | ... = ... | this |
+| C.cs:243:13:243:13 | access to local variable s | C.cs:241:24:241:31 | SSA def(s) | C.cs:243:13:243:13 | access to local variable s | Variable $@ may be null here because of $@ assignment. | C.cs:229:16:229:16 | s | s | C.cs:241:24:241:31 | ... = ... | this |
+| D.cs:23:9:23:13 | access to parameter param | D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null here because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
+| D.cs:32:9:32:13 | access to parameter param | D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null here as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
+| D.cs:62:13:62:14 | access to local variable o5 | D.cs:58:13:58:41 | SSA def(o5) | D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null here because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
+| D.cs:73:13:73:14 | access to local variable o7 | D.cs:68:13:68:34 | SSA def(o7) | D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null here because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
+| D.cs:82:13:82:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null here because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
+| D.cs:84:13:84:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null here because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
+| D.cs:91:13:91:14 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:94:21:94:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:98:21:98:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:102:31:102:32 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:105:19:105:20 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null here because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
+| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
+| D.cs:135:24:135:24 | access to parameter b | D.cs:125:44:125:44 | SSA param(b) | D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
+| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
+| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
+| D.cs:151:9:151:11 | access to parameter obj | D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
+| D.cs:171:9:171:11 | access to local variable obj | D.cs:163:16:163:25 | SSA def(obj) | D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null here because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
+| D.cs:245:13:245:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
+| D.cs:247:13:247:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
+| D.cs:253:13:253:14 | access to local variable o2 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null here because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
+| D.cs:267:13:267:13 | access to local variable o | D.cs:258:16:258:23 | SSA def(o) | D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
+| D.cs:291:13:291:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
+| D.cs:291:13:291:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
+| D.cs:294:13:294:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
+| D.cs:294:13:294:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null here because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
+| D.cs:300:17:300:20 | access to local variable prev | D.cs:296:16:296:26 | SSA def(prev) | D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null here because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
+| D.cs:313:17:313:17 | access to local variable s | D.cs:304:16:304:23 | SSA def(s) | D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
+| D.cs:324:9:324:9 | access to local variable r | D.cs:316:16:316:23 | SSA def(r) | D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null here because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
+| D.cs:356:13:356:13 | access to local variable a | D.cs:351:15:351:22 | SSA def(a) | D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null here because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
+| D.cs:363:13:363:16 | access to local variable last | D.cs:360:20:360:30 | SSA def(last) | D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null here because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
+| D.cs:372:13:372:13 | access to local variable b | D.cs:366:15:366:47 | SSA def(b) | D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null here because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
+| D.cs:395:20:395:20 | access to parameter a | D.cs:388:36:388:36 | SSA param(a) | D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
+| D.cs:400:20:400:20 | access to parameter b | D.cs:388:45:388:45 | SSA param(b) | D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null here as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null here as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
+| E.cs:12:38:12:39 | access to local variable a2 | E.cs:9:18:9:26 | SSA def(a2) | E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null here because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
+| E.cs:14:13:14:14 | access to local variable a3 | E.cs:11:16:11:24 | SSA def(a3) | E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null here because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
+| E.cs:27:13:27:14 | access to local variable s1 | E.cs:23:13:23:30 | SSA def(s1) | E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null here because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
+| E.cs:35:9:35:12 | access to local variable last | E.cs:32:16:32:26 | SSA def(last) | E.cs:35:9:35:12 | access to local variable last | Variable $@ may be null here because of $@ assignment. | E.cs:32:16:32:19 | last | last | E.cs:32:16:32:26 | String last = ... | this |
+| E.cs:43:13:43:16 | access to local variable last | E.cs:37:9:37:19 | SSA def(last) | E.cs:43:13:43:16 | access to local variable last | Variable $@ may be null here because of $@ assignment. | E.cs:32:16:32:19 | last | last | E.cs:37:9:37:19 | ... = ... | this |
+| E.cs:61:13:61:17 | access to local variable slice | E.cs:51:22:51:33 | SSA def(slice) | E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null here because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
+| E.cs:73:13:73:15 | access to parameter arr | E.cs:66:40:66:42 | SSA param(arr) | E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null here as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
+| E.cs:112:13:112:16 | access to local variable arr2 | E.cs:107:15:107:25 | SSA def(arr2) | E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null here because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
+| E.cs:125:33:125:35 | access to local variable obj | E.cs:137:25:137:34 | SSA def(obj) | E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null here because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
+| E.cs:159:13:159:16 | access to local variable obj2 | E.cs:152:16:152:26 | SSA def(obj2) | E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null here as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
+| E.cs:167:21:167:21 | access to parameter a | E.cs:162:28:162:28 | SSA param(a) | E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null here as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
+| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
+| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
+| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
+| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null here as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
+| E.cs:192:17:192:17 | access to parameter o | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null here as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
+| E.cs:201:11:201:11 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:11:201:11 | access to local variable o | Variable $@ may be null here because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
+| E.cs:203:11:203:11 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:11:203:11 | access to local variable o | Variable $@ may be null here because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
+| E.cs:218:9:218:9 | access to local variable x | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
+| E.cs:230:9:230:9 | access to local variable x | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null here because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
+| E.cs:235:16:235:16 | access to parameter i | E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
+| E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
+| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null here because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
+| NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null here because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
+| StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

From 3a5962aa347a34bc08964a29adb2b0e61fbef00a Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Fri, 14 Dec 2018 13:14:26 +0100
Subject: [PATCH 20/69] JS: minor fixups in ClientRequests.qll

---
 .../src/semmle/javascript/frameworks/ClientRequests.qll  | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
index 596e5e3bf1a8..93196d346c6b 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
@@ -67,7 +67,7 @@ private string httpMethodName() {
 }
 
 /**
- * Gets the name of a property that likely contains a  URL value.
+ * Gets the name of a property that likely contains a URL value.
  */
 private string urlPropertyName() {
   result = "uri" or
@@ -93,16 +93,13 @@ private class RequestUrlRequest extends CustomClientRequest {
       (
         callee = DataFlow::moduleImport(moduleName) or
         callee = DataFlow::moduleMember(moduleName, httpMethodName())
-      ) and
-      (
-        url = getArgument(0) or
-        url = getOptionArgument(0, urlPropertyName())
       )
     )
   }
 
   override DataFlow::Node getUrl() {
-    result = url
+    result = getArgument(0) or
+    result = getOptionArgument(0, urlPropertyName())
   }
 
   override DataFlow::Node getADataNode() {

From 60fe0176ede763b1b093d08ec6c0e705462b9f97 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Mon, 17 Dec 2018 10:28:01 +0100
Subject: [PATCH 21/69] JS: add ClientRequest::getHost

---
 .../javascript/frameworks/ClientRequests.qll  | 41 ++++++++++++++++++-
 .../semmle/javascript/frameworks/Electron.qll |  8 ++++
 .../javascript/frameworks/NodeJSLib.qll       |  8 ++++
 .../semmle/javascript/frameworks/jQuery.qll   |  2 +
 .../ClientRequests/ClientRequest.expected     |  4 ++
 .../ClientRequest_getHost.expected            |  4 ++
 .../ClientRequests/ClientRequest_getHost.ql   |  4 ++
 .../ClientRequest_getUrl.expected             |  4 ++
 .../frameworks/ClientRequests/tst.js          | 12 ++++++
 9 files changed, 85 insertions(+), 2 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.expected
 create mode 100644 javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.ql

diff --git a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
index 93196d346c6b..ee62d6035fc1 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
@@ -21,6 +21,11 @@ abstract class CustomClientRequest extends DataFlow::InvokeNode {
    */
   abstract DataFlow::Node getUrl();
 
+  /**
+   * Gets the host of the request.
+   */
+  abstract DataFlow::Node getHost();
+
   /**
    * Gets a node that contributes to the data-part this request.
    */
@@ -50,6 +55,13 @@ class ClientRequest extends DataFlow::InvokeNode {
     result = custom.getUrl()
   }
 
+  /**
+   * Gets the host of the request.
+   */
+  DataFlow::Node getHost() {
+    result = custom.getHost()
+  }
+
   /**
    * Gets a node that contributes to the data-part this request.
    */
@@ -102,6 +114,10 @@ private class RequestUrlRequest extends CustomClientRequest {
     result = getOptionArgument(0, urlPropertyName())
   }
 
+  override DataFlow::Node getHost() {
+    none()
+  }
+
   override DataFlow::Node getADataNode() {
     result = getArgument(1)
   }
@@ -126,10 +142,18 @@ private class AxiosUrlRequest extends CustomClientRequest {
     )
   }
 
+  private DataFlow::Node getOptionArgument(string name) {
+    // depends on the method name and the call arity, over-approximating slightly in the name of simplicity
+    result = getOptionArgument([0..2], name)
+  }
+
   override DataFlow::Node getUrl() {
     result = getArgument(0) or
-    // depends on the method name and the call arity, over-approximating slightly in the name of simplicity
-    result = getOptionArgument([0..2], urlPropertyName())
+    result = getOptionArgument(urlPropertyName())
+  }
+
+  override DataFlow::Node getHost() {
+    result = getOptionArgument("host")
   }
 
   override DataFlow::Node getADataNode() {
@@ -176,6 +200,8 @@ private class FetchUrlRequest extends CustomClientRequest {
     result = url
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "headers" or name = "body" |
@@ -206,6 +232,14 @@ private class GotUrlRequest extends CustomClientRequest {
     not exists (getOptionArgument(1, "baseUrl"))
   }
 
+  override DataFlow::Node getHost() {
+    exists (string name |
+      name = "host" or
+      name = "hostname" |
+      result = getOptionArgument(1, name)
+    )
+  }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "headers" or name = "body" or name = "query" |
@@ -235,6 +269,8 @@ private class SuperAgentUrlRequest extends CustomClientRequest {
     result = url
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "set" or name = "send" or name = "query" |
@@ -252,5 +288,6 @@ private class XMLHttpRequest extends CustomClientRequest {
 
   override DataFlow::Node getUrl() { result = getAMethodCall("open").getArgument(1) }
 
+  override DataFlow::Node getHost() { none() }
   override DataFlow::Node getADataNode() { result = getAMethodCall("send").getArgument(0) }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Electron.qll b/javascript/ql/src/semmle/javascript/frameworks/Electron.qll
index 454de0a11d7d..fe8010d8fc89 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Electron.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Electron.qll
@@ -64,6 +64,14 @@ module Electron {
       result = getOptionArgument(0, "url")
     }
 
+    override DataFlow::Node getHost() {
+      exists (string name |
+        name = "host" or
+        name = "hostname" |
+        result = getOptionArgument(0, name)
+      )
+    }
+
     override DataFlow::Node getADataNode() {
       exists (string name |
         name = "write" or name = "end" |
diff --git a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
index 35091d9c2180..a7355f3c4b37 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
@@ -737,6 +737,14 @@ module NodeJSLib {
       result = url
     }
 
+    override DataFlow::Node getHost() {
+      exists (string name |
+        name = "host" or
+        name = "hostname" |
+        result = getOptionArgument(1, name)
+      )
+    }
+
     override DataFlow::Node getADataNode() {
       exists (string name |
         name = "write" or name = "end" |
diff --git a/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll b/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll
index ab923574207d..92906282d0dc 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll
@@ -359,5 +359,7 @@ private class JQueryClientRequest extends CustomClientRequest {
     result = getOptionArgument([0 .. 1], "url")
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() { result = getOptionArgument([0 .. 1], "data") }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected
index a52f0fa500d2..9346e9f7e4b9 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected
@@ -32,3 +32,7 @@
 | tst.js:77:5:77:32 | $.getJS ...  data}) |
 | tst.js:78:5:78:38 | $.getJS ...  data}) |
 | tst.js:80:15:80:34 | new XMLHttpRequest() |
+| tst.js:87:5:87:39 | http.ge ...  host}) |
+| tst.js:89:5:89:23 | axios({host: host}) |
+| tst.js:91:5:91:34 | got(rel ...  host}) |
+| tst.js:93:5:93:35 | net.req ... host }) |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.expected
new file mode 100644
index 000000000000..025cf360ac29
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.expected
@@ -0,0 +1,4 @@
+| tst.js:87:5:87:39 | http.ge ...  host}) | tst.js:87:34:87:37 | host |
+| tst.js:89:5:89:23 | axios({host: host}) | tst.js:89:18:89:21 | host |
+| tst.js:91:5:91:34 | got(rel ...  host}) | tst.js:91:29:91:32 | host |
+| tst.js:93:5:93:35 | net.req ... host }) | tst.js:93:29:93:32 | host |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.ql b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.ql
new file mode 100644
index 000000000000..95d6776570f3
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getHost.ql
@@ -0,0 +1,4 @@
+import javascript
+
+from ClientRequest r
+select r, r.getHost()
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected
index f9e4de1ee213..7bc692a0d7a5 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected
@@ -38,3 +38,7 @@
 | tst.js:78:5:78:38 | $.getJS ...  data}) | tst.js:78:15:78:37 | {url: u ... : data} |
 | tst.js:78:5:78:38 | $.getJS ...  data}) | tst.js:78:21:78:23 | url |
 | tst.js:80:15:80:34 | new XMLHttpRequest() | tst.js:81:17:81:19 | url |
+| tst.js:87:5:87:39 | http.ge ...  host}) | tst.js:87:14:87:24 | relativeUrl |
+| tst.js:89:5:89:23 | axios({host: host}) | tst.js:89:11:89:22 | {host: host} |
+| tst.js:91:5:91:34 | got(rel ...  host}) | tst.js:91:9:91:19 | relativeUrl |
+| tst.js:93:5:93:35 | net.req ... host }) | tst.js:93:17:93:34 | { hostname: host } |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js b/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
index ee638893a527..34a5bea9ed50 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
@@ -81,3 +81,15 @@ import {ClientRequest, net} from 'electron';
     xhr.open(_, url);
     xhr.send(data);
 });
+
+(function() {
+
+    http.get(relativeUrl, {host: host});
+
+    axios({host: host});
+
+    got(relativeUrl, {host: host});
+
+    net.request({ hostname: host });
+
+});

From c6b4e29b93a170ff0c92574adcf2b85dd297706d Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Mon, 17 Dec 2018 10:06:15 +0100
Subject: [PATCH 22/69] JS: add "host" as a sink for `js/request-forgery`

---
 .../javascript/security/dataflow/RequestForgery.qll       | 8 ++++++--
 .../query-tests/Security/CWE-918/RequestForgery.expected  | 3 +++
 javascript/ql/test/query-tests/Security/CWE-918/tst.js    | 2 ++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
index 6881382672ab..4a24bff2c28c 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
@@ -72,8 +72,11 @@ module RequestForgery {
 
     ClientRequest request;
 
+    string kind;
+
     ClientRequestUrlAsSink() {
-      this = request.getUrl()
+      this = request.getUrl() and kind = "URL" or
+      this = request.getHost() and kind = "host"
     }
 
     override DataFlow::Node getARequest() {
@@ -81,7 +84,8 @@ module RequestForgery {
     }
 
     override string getKind() {
-      result = "URL"
+      result = kind
     }
+
   }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected b/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
index b4368363730a..2947bcf824f6 100644
--- a/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
@@ -13,6 +13,7 @@ nodes
 | tst.js:26:36:26:42 | tainted |
 | tst.js:28:13:28:43 | "http:/ ... tainted |
 | tst.js:28:37:28:43 | tainted |
+| tst.js:32:34:32:40 | tainted |
 edges
 | tst.js:12:9:12:52 | tainted | tst.js:16:13:16:19 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:18:17:18:23 | tainted |
@@ -20,6 +21,7 @@ edges
 | tst.js:12:9:12:52 | tainted | tst.js:24:25:24:31 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:26:36:26:42 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:28:37:28:43 | tainted |
+| tst.js:12:9:12:52 | tainted | tst.js:32:34:32:40 | tainted |
 | tst.js:12:19:12:42 | url.par ... , true) | tst.js:12:19:12:48 | url.par ... ).query |
 | tst.js:12:19:12:48 | url.par ... ).query | tst.js:12:19:12:52 | url.par ... ery.url |
 | tst.js:12:19:12:52 | url.par ... ery.url | tst.js:12:9:12:52 | tainted |
@@ -34,3 +36,4 @@ edges
 | tst.js:24:5:24:32 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:24:13:24:31 | "http://" + tainted | The $@ of this request depends on $@. | tst.js:24:13:24:31 | "http://" + tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
 | tst.js:26:5:26:43 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:26:13:26:42 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:26:13:26:42 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
 | tst.js:28:5:28:44 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:28:13:28:43 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:28:13:28:43 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
+| tst.js:32:5:32:42 | http.ge ... inted}) | tst.js:12:29:12:35 | req.url | tst.js:32:34:32:40 | tainted | The $@ of this request depends on $@. | tst.js:32:34:32:40 | tainted | host | tst.js:12:29:12:35 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/tst.js b/javascript/ql/test/query-tests/Security/CWE-918/tst.js
index b502e56bd12f..3ef100e3960f 100644
--- a/javascript/ql/test/query-tests/Security/CWE-918/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-918/tst.js
@@ -28,4 +28,6 @@ var server = http.createServer(function(req, res) {
     request("http://example.com/" + tainted); // NOT OK
 
     request("http://example.com/?" + tainted); // OK
+
+    http.get(relativeUrl, {host: tainted}); // NOT OK
 })

From 3cd62234d4b4604b563cb853ce33834c40d3b2e9 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Fri, 14 Dec 2018 13:20:29 +0100
Subject: [PATCH 23/69] JS: change notes for `js/request-forgery` improvements

---
 change-notes/1.20/analysis-javascript.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index 69f6613c26cd..d08253753563 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -25,6 +25,7 @@
 |--------------------------------------------|------------------------------|------------------------------------------------------------------------------|
 | Client-side cross-site scripting           | More results                 | This rule now recognizes WinJS functions that are vulnerable to HTML injection. |
 | Insecure randomness | More results | This rule now flags insecure uses of `crypto.pseudoRandomBytes`. |
+| Uncontrolled data used in network request  | More results                 | This rule now recognizes host values that are vulnerable to injection. |
 | Unused parameter                           | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
 | Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |
 

From ada0115d6aec72a067374df19b9589f1b8ac9e4d Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 14 Dec 2018 10:14:23 +0000
Subject: [PATCH 24/69] C#: Remove `getUrl()` predicates

As described on https://lgtm.com/help/ql/locations#providing-location-information,
there is no need to provide a `getUrl()` predicate, when there is a `getLocation()`
predicate. Not only is it redundant, but it can also be slow because of string
construction.
---
 csharp/ql/src/semmle/code/cil/Type.qll           |  1 -
 csharp/ql/src/semmle/code/csharp/Location.qll    | 16 ++++------------
 csharp/ql/src/semmle/code/csharp/Member.qll      | 11 -----------
 csharp/ql/src/semmle/code/csharp/Type.qll        |  1 -
 .../AnonymousObjectCreation3.expected            |  4 ++--
 .../namespaces/Namespaces1.expected              |  2 +-
 .../namespaces/Namespaces10.expected             |  2 +-
 .../namespaces/Namespaces2.expected              |  2 +-
 .../namespaces/Namespaces3.expected              |  3 ++-
 .../namespaces/Namespaces4.expected              |  2 +-
 .../namespaces/Namespaces5.expected              |  2 +-
 .../namespaces/Namespaces6.expected              |  2 +-
 .../namespaces/Namespaces7.expected              |  2 +-
 .../namespaces/Namespaces8.expected              |  2 +-
 .../ql/test/library-tests/types/Types27.expected |  2 +-
 .../ql/test/library-tests/types/Types34.expected |  2 +-
 .../DefaultToString/DefaultToString.expected     | 14 +++++++-------
 17 files changed, 25 insertions(+), 45 deletions(-)

diff --git a/csharp/ql/src/semmle/code/cil/Type.qll b/csharp/ql/src/semmle/code/cil/Type.qll
index 6096d7d6ae5f..e0e64c4a9d17 100644
--- a/csharp/ql/src/semmle/code/cil/Type.qll
+++ b/csharp/ql/src/semmle/code/cil/Type.qll
@@ -23,7 +23,6 @@ class Namespace extends DotNet::Namespace, TypeContainer, @namespace {
   override Namespace getParent() { result = this.getParentNamespace() }
   override Namespace getParentNamespace() { parent_namespace(this, result) }
   override string getName() { namespaces(this,result) }
-  string getUrl() { result="" }
   override Location getLocation() { none() }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/Location.qll b/csharp/ql/src/semmle/code/csharp/Location.qll
index 9d48822cfa73..c1983e19ba19 100644
--- a/csharp/ql/src/semmle/code/csharp/Location.qll
+++ b/csharp/ql/src/semmle/code/csharp/Location.qll
@@ -37,24 +37,16 @@ class Location extends @location
   string toString() { none() }
 
   /** Gets the start line of this location. */
-  int getStartLine() {
-     locations_default(this,_,result,_,_,_)
-  }
+  final int getStartLine() { this.hasLocationInfo(_, result, _, _, _) }
 
   /** Gets the end line of this location. */
-  int getEndLine() {
-     locations_default(this,_,_,_,result,_)
-  }
+  final int getEndLine() { this.hasLocationInfo(_, _, _, result, _) }
 
   /** Gets the start column of this location. */
-  int getStartColumn() {
-     locations_default(this,_,_,result,_,_)
-  }
+  final int getStartColumn() { this.hasLocationInfo(_, _, result, _, _) }
 
   /** Gets the end column of this location. */
-  int getEndColumn() {
-     locations_default(this,_,_,_,_,result)
-  }
+  final int getEndColumn() { this.hasLocationInfo(_, _, _, _, result) }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/Member.qll b/csharp/ql/src/semmle/code/csharp/Member.qll
index bfbb44ac912f..10200635f191 100644
--- a/csharp/ql/src/semmle/code/csharp/Member.qll
+++ b/csharp/ql/src/semmle/code/csharp/Member.qll
@@ -36,17 +36,6 @@ class Declaration extends DotNet::Declaration, Element, @declaration {
     result = this.getDeclaringType().getQualifiedName() + "." + this.toStringWithTypes()
   }
 
-  /** Define URL for declarations with no location. */
-  string getURL() {
-    if exists(this.getLocation()) then
-      exists(string path, int a, int b, int c, int d |
-        this.getLocation().hasLocationInfo(path, a, b, c, d) |
-        toUrl(path, a, b, c, d, result)
-      )
-    else
-      result = ""
-  }
-
   /**
    * Holds if this declaration has been generated by the compiler, for example
    * implicit constructors or accessors.
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index 4dfb7f179a8e..d1da7ddf1811 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -751,7 +751,6 @@ class Class extends RefType, @class_type {
  * ```
  */
 class AnonymousClass extends Class {
-
   AnonymousClass() { this.getName().matches("<%") }
 }
 
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
index ac7d5ce915a5..e16c51b69cb4 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
@@ -1,2 +1,2 @@
-| expressions.cs:417:9:420:9 | object creation of type <>__AnonType0<String,String[]> |  | String[] |
-| expressions.cs:421:9:424:9 | object creation of type <>__AnonType0<String,String[]> |  | String[] |
+| expressions.cs:417:9:420:9 | object creation of type <>__AnonType0<String,String[]> | file://:0:0:0:0 | String[] |
+| expressions.cs:421:9:424:9 | object creation of type <>__AnonType0<String,String[]> | file://:0:0:0:0 | String[] |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces1.expected b/csharp/ql/test/library-tests/namespaces/Namespaces1.expected
index 2f46a087ac9a..783fe121f4e7 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces1.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces1.expected
@@ -1 +1 @@
-|  | N1.N2 |
+| namespaces.cs:5:11:5:15 | N1.N2 |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces10.expected b/csharp/ql/test/library-tests/namespaces/Namespaces10.expected
index a1f48b2f4f86..809960852f16 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces10.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces10.expected
@@ -1 +1 @@
-|  | R1 | namespaces.cs:73:11:73:14 | A<> | namespaces.cs:80:11:80:11 | A |
+| namespaces.cs:70:11:70:12 | R1 | namespaces.cs:73:11:73:14 | A<> | namespaces.cs:80:11:80:11 | A |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces2.expected b/csharp/ql/test/library-tests/namespaces/Namespaces2.expected
index fa08acd8dbdf..7f7d27c43a37 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces2.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces2.expected
@@ -1 +1 @@
-|  | M1.M2 |
+| namespaces.cs:16:15:16:16 | M1.M2 |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces3.expected b/csharp/ql/test/library-tests/namespaces/Namespaces3.expected
index 5445040f4f3c..c3a4c14020fb 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces3.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces3.expected
@@ -1 +1,2 @@
-|  | P1.P2 |
+| namespaces.cs:26:11:26:15 | P1.P2 |
+| namespaces.cs:33:11:33:15 | P1.P2 |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces4.expected b/csharp/ql/test/library-tests/namespaces/Namespaces4.expected
index fa08acd8dbdf..7f7d27c43a37 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces4.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces4.expected
@@ -1 +1 @@
-|  | M1.M2 |
+| namespaces.cs:16:15:16:16 | M1.M2 |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces5.expected b/csharp/ql/test/library-tests/namespaces/Namespaces5.expected
index e8d8d60fb1a0..e2a60e04a6a3 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces5.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces5.expected
@@ -1 +1 @@
-|  | Empty |
+| namespaces.cs:44:11:44:15 | Empty |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces6.expected b/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
index 6ed973b5a249..39fee338b4b9 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
@@ -1 +1 @@
-|  | Q1 |  | Q1.Q2 |
+| file://:0:0:0:0 | Q1 | namespaces.cs:50:11:50:15 | Q1.Q2 |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces7.expected b/csharp/ql/test/library-tests/namespaces/Namespaces7.expected
index e213322d8542..52d04a67cb7d 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces7.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces7.expected
@@ -1 +1 @@
-|  | Q3 | namespaces.cs:64:11:64:11 | B | namespaces.cs:53:11:53:11 | A |
+| namespaces.cs:57:11:57:12 | Q3 | namespaces.cs:64:11:64:11 | B | namespaces.cs:53:11:53:11 | A |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces8.expected b/csharp/ql/test/library-tests/namespaces/Namespaces8.expected
index 8ec2d605524b..9689292b19d7 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces8.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces8.expected
@@ -1 +1 @@
-|  | Q3 | namespaces.cs:66:11:66:11 | C | namespaces.cs:53:11:53:11 | A |
+| namespaces.cs:57:11:57:12 | Q3 | namespaces.cs:66:11:66:11 | C | namespaces.cs:53:11:53:11 | A |
diff --git a/csharp/ql/test/library-tests/types/Types27.expected b/csharp/ql/test/library-tests/types/Types27.expected
index 3d7e0b414d6e..9a4a69374f71 100644
--- a/csharp/ql/test/library-tests/types/Types27.expected
+++ b/csharp/ql/test/library-tests/types/Types27.expected
@@ -1 +1 @@
-|  | null |
+| file://:0:0:0:0 | null |
diff --git a/csharp/ql/test/library-tests/types/Types34.expected b/csharp/ql/test/library-tests/types/Types34.expected
index 6e099625069d..37e62f991313 100644
--- a/csharp/ql/test/library-tests/types/Types34.expected
+++ b/csharp/ql/test/library-tests/types/Types34.expected
@@ -1 +1 @@
-|  | Class[][] |  | Class[] |
+| file://:0:0:0:0 | Class[][] | file://:0:0:0:0 | Class[] |
diff --git a/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected b/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected
index 8ef2e407766e..3c20ab85d525 100644
--- a/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected	
+++ b/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected	
@@ -1,10 +1,10 @@
 | DefaultToString.cs:9:27:9:27 | access to local variable d | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToString.cs:4:7:4:21 | DefaultToString | DefaultToString |
 | DefaultToString.cs:10:28:10:28 | access to local variable d | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToString.cs:4:7:4:21 | DefaultToString | DefaultToString |
-| DefaultToString.cs:16:27:16:30 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
-| DefaultToString.cs:19:24:19:27 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
+| DefaultToString.cs:16:27:16:30 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
+| DefaultToString.cs:19:24:19:27 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
 | DefaultToStringBad.cs:8:35:8:35 | access to local variable p | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToStringBad.cs:14:11:14:16 | Person | Person |
-| DefaultToStringBad.cs:11:38:11:41 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
-| WriteLineArray.cs:7:23:7:26 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
-| WriteLineArray.cs:8:27:8:30 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
-| WriteLineArray.cs:10:36:10:39 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
-| WriteLineArray.cs:11:40:11:43 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
+| DefaultToStringBad.cs:11:38:11:41 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
+| WriteLineArray.cs:7:23:7:26 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
+| WriteLineArray.cs:8:27:8:30 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
+| WriteLineArray.cs:10:36:10:39 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
+| WriteLineArray.cs:11:40:11:43 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |

From 50cba92f5f16c3a040a6abe19e158e08b2e31cb6 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Mon, 17 Dec 2018 10:58:46 +0100
Subject: [PATCH 25/69] JS: remove slow test
 Security/heuristics/AdditionalCommandInjections

---
 .../heuristics/AdditionalCommandInjections.expected      | 1 -
 .../Security/heuristics/AdditionalCommandInjections.ql   | 9 ---------
 .../Security/heuristics/HeuristicSink.expected           | 1 -
 .../Security/heuristics/HeuristicSource.expected         | 1 -
 .../Security/heuristics/additionalCommandInjections.js   | 3 ---
 5 files changed, 15 deletions(-)
 delete mode 100644 javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.expected
 delete mode 100644 javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.ql
 delete mode 100644 javascript/ql/test/library-tests/Security/heuristics/additionalCommandInjections.js

diff --git a/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.expected b/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.expected
deleted file mode 100644
index d47a2cde28cd..000000000000
--- a/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.expected
+++ /dev/null
@@ -1 +0,0 @@
-| additionalCommandInjections.js:2:11:2:45 | "prgm - ... place() | additionalCommandInjections.js:2:28:2:35 | password |
diff --git a/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.ql b/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.ql
deleted file mode 100644
index ad6b6b2172d6..000000000000
--- a/javascript/ql/test/library-tests/Security/heuristics/AdditionalCommandInjections.ql
+++ /dev/null
@@ -1,9 +0,0 @@
-import javascript
-import semmle.javascript.security.dataflow.CommandInjection::CommandInjection
-
-private import semmle.javascript.heuristics.all
-// tests that the imports above changes the behavior of the standard taint tracking query
-
-from Configuration cfg, Source source, Sink sink
-where cfg.hasFlow(source, sink)
-select sink, source
diff --git a/javascript/ql/test/library-tests/Security/heuristics/HeuristicSink.expected b/javascript/ql/test/library-tests/Security/heuristics/HeuristicSink.expected
index 9886d1f455b3..b08ba55ddda7 100644
--- a/javascript/ql/test/library-tests/Security/heuristics/HeuristicSink.expected
+++ b/javascript/ql/test/library-tests/Security/heuristics/HeuristicSink.expected
@@ -1,4 +1,3 @@
-| additionalCommandInjections.js:2:11:2:45 | "prgm - ... place() |
 | sinks.js:2:14:2:17 | sink |
 | sinks.js:3:5:3:17 | script + sink |
 | sinks.js:4:9:4:12 | sink |
diff --git a/javascript/ql/test/library-tests/Security/heuristics/HeuristicSource.expected b/javascript/ql/test/library-tests/Security/heuristics/HeuristicSource.expected
index 29877ba9a0b2..52862db346b6 100644
--- a/javascript/ql/test/library-tests/Security/heuristics/HeuristicSource.expected
+++ b/javascript/ql/test/library-tests/Security/heuristics/HeuristicSource.expected
@@ -1,3 +1,2 @@
-| additionalCommandInjections.js:2:28:2:35 | password |
 | sources.js:2:5:2:12 | password |
 | sources.js:3:5:3:20 | JSON.stringify() |
diff --git a/javascript/ql/test/library-tests/Security/heuristics/additionalCommandInjections.js b/javascript/ql/test/library-tests/Security/heuristics/additionalCommandInjections.js
deleted file mode 100644
index f569215db8c6..000000000000
--- a/javascript/ql/test/library-tests/Security/heuristics/additionalCommandInjections.js
+++ /dev/null
@@ -1,3 +0,0 @@
-(function() {
-    o.run("prgm --pass " + password.replace())
-})();

From 4a631b42d43c5a7c9a2e2ae7acd945ebaa1970ff Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esben@semmle.com>
Date: Mon, 17 Dec 2018 12:55:34 +0100
Subject: [PATCH 26/69] JS: use `.lastIndexOf` in
 js/incomplete-url-substring-sanitization

---
 .../Security/CWE-020/IncompleteUrlSubstringSanitization.ql    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql b/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql
index 8ea0a9106d12..97988dec805d 100644
--- a/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql
+++ b/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql
@@ -15,7 +15,7 @@ private import semmle.javascript.dataflow.InferredTypes
 
 from DataFlow::MethodCallNode call, string name, DataFlow::Node substring, string target
 where
-      (name = "indexOf" or name = "includes" or name = "startsWith" or name = "endsWith") and
+      (name = "indexOf" or name = "lastIndexOf" or name = "includes" or name = "startsWith" or name = "endsWith") and
       call.getMethodName() = name and
       substring = call.getArgument(0) and
       substring.mayHaveStringValue(target) and
@@ -27,7 +27,7 @@ where
       ) and
       // whitelist
       not (
-        name = "indexOf" and
+        (name = "indexOf" or name = "lastIndexOf") and
         (
           // arithmetic on the indexOf-result
           any(ArithmeticExpr e).getAnOperand().getUnderlyingValue() = call.asExpr()

From 5040d3e26c73eb5ad698657da90c594fde4f1d24 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 14 Dec 2018 15:39:09 +0000
Subject: [PATCH 27/69] JS: add query for loop index bug

---
 ...djustmentAfterConcurrentModification.qhelp |  68 ++++++++
 ...exAdjustmentAfterConcurrentModification.ql | 155 ++++++++++++++++++
 ...exAdjustmentAfterConcurrentModification.js |   9 +
 ...justmentAfterConcurrentModificationGood.js |  10 ++
 ...ntAfterConcurrentModificationGoodFilter.js |   3 +
 ...stmentAfterConcurrentModification.expected |   3 +
 ...djustmentAfterConcurrentModification.qlref |   1 +
 .../tst.js                                    | 113 +++++++++++++
 8 files changed, 362 insertions(+)
 create mode 100644 javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
 create mode 100644 javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
 create mode 100644 javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js
 create mode 100644 javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js
 create mode 100644 javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js
 create mode 100644 javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
 create mode 100644 javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref
 create mode 100644 javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js

diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
new file mode 100644
index 000000000000..20bf93105d3e
--- /dev/null
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
@@ -0,0 +1,68 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>
+  Items can be removed from an array using the <code>splice</code> method, but when doing so,
+  all subseequent items will be shifted to a lower index. If this is done while iterating over
+  the array, the shifting may cause the loop to skip over the element immediately after the
+  removed element.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Determine what the loop is supposed to do:
+<ul>
+  <li>
+    If the intention is to remove <em>every occurence</em> of a certain value, decrement the loop counter after removing an element, to counterbalance
+    the shift.
+  </li>
+  <li>
+    If the loop is only intended to remove <em>a single value</em> from the array, consider adding a <code>break</code> after the <code>splice</code> call.
+  </li>
+  <li>
+    If the loop is deliberately skipping over elements, consider moving the index increment into the body of the loop,
+    so it is clear that the loop is not a trivial array iteration loop.
+  </li>
+</ul>
+</p>
+
+</recommendation>
+<example>
+
+<p>
+In this example, a function is intended to remove "<code>..</code>" parts from a path:
+</p>
+
+<sample src="examples/MisleadingIndentationAfterControlStmt.js" />
+
+<p>
+However, whenever the input contain two "<code>..</code>" parts right after one another, only the first will be removed.
+For example, the string "<code>../../secret.txt</code>" will be mapped to "<code>../secret.txt</code>". After removing
+the element at index 0, the loop counter is incremented to 1, but the second "<code>..</code>" string has now been shifted down to
+index 0 and will therefore be skipped.
+</p>
+
+<p>
+One way to avoid this is to decrement the loop counter after removing an element from the array:
+</p>
+
+<sample src="examples/MisleadingIndentationAfterControlStmtGood.js" />
+
+<p>
+Alternatively, use the <code>filter</code> method:
+</p>
+
+<sample src="examples/MisleadingIndentationAfterControlStmtGoodFilter.js" />
+
+</example>
+<references>
+
+<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/splice">Array.prototype.splice()</a>.</li>
+<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter">Array.prototype.filter()</a>.</li>
+
+</references>
+</qhelp>
diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
new file mode 100644
index 000000000000..23f19afc127d
--- /dev/null
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
@@ -0,0 +1,155 @@
+/**
+ * @name Missing index adjustment after concurrent modification
+ * @description Removing elements from an array while iterating over it can cause the loop to skip over some elements,
+ *              unless the loop index is decremented accordingly. 
+ * @kind problem
+ * @problem.severity warning
+ * @id js/missing-index-adjustment-after-concurrent-modification
+ * @tags correctness
+ * @precision high
+ */
+import javascript
+
+/**
+ * Operation that inserts or removes elements from an array while shifting all elements
+ * occuring after the insertion/removal point.
+ *
+ * Does not include `push` and `pop` since these never shift any elements.
+ */
+class ArrayShiftingCall extends DataFlow::MethodCallNode {
+  string name;
+
+  ArrayShiftingCall() {
+    name = getMethodName() and
+    (name = "splice" or name = "shift" or name = "unshift")
+  }
+
+  DataFlow::SourceNode getArray() {
+    result = getReceiver().getALocalSource()
+  }
+}
+
+/**
+ * A call to `splice` on an array.
+ */
+class SpliceCall extends ArrayShiftingCall {
+  SpliceCall() {
+    name = "splice"
+  }
+
+  /**
+   * Gets the index from which elements are removed and possibly new elemenst are inserted.
+   */
+  DataFlow::Node getIndex() {
+    result = getArgument(0)
+  }
+
+  /**
+   * Gets the number of removed elements.
+   */
+  int getNumRemovedElements() {
+    result = getArgument(1).asExpr().getIntValue() and
+    result >= 0
+  }
+
+  /**
+   * Gets the number of inserted elements.
+   */
+  int getNumInsertedElements() {
+    result = getNumArgument() - 2 and
+    result >= 0
+  }
+}
+
+/**
+ * A `for` loop iterating over the indices of an array, in increasing order.
+ */
+class ArrayIterationLoop extends ForStmt {
+  DataFlow::SourceNode array;
+  LocalVariable indexVariable;
+  
+  ArrayIterationLoop() {
+    exists (RelationalComparison compare | compare = getTest() |
+      compare.getLesserOperand() = indexVariable.getAnAccess() and
+      compare.getGreaterOperand() = array.getAPropertyRead("length").asExpr()) and
+    getUpdate().(IncExpr).getOperand() = indexVariable.getAnAccess()
+  }
+
+  /**
+   * Gets the variable holding the loop variable and current array index.
+   */
+  LocalVariable getIndexVariable() {
+    result = indexVariable
+  }
+
+  /**
+   * Gets the loop entry point.
+   */
+  ReachableBasicBlock getLoopEntry() {
+    result = getTest().getFirstControlFlowNode().getBasicBlock()
+  }
+
+  /**
+   * Gets a call that potentially shifts the elements of the given array.
+   */
+  ArrayShiftingCall getAnArrayShiftingCall() {
+    result.getArray() = array
+  }
+
+  /**
+   * Gets a call to `splice` that removes elements from the looped-over array at the current index 
+   *
+   * The `splice` call is not guaranteed to be inside the loop body.
+   */
+  SpliceCall getACandidateSpliceCall() {
+    result = getAnArrayShiftingCall() and
+    result.getIndex().asExpr() = getIndexVariable().getAnAccess() and
+    result.getNumRemovedElements() > result.getNumInsertedElements()
+  }
+
+  /**
+   * Holds if `cfg` modifies the index variable or shifts array elements, disturbing the
+   * relationship between the array and the index variable.
+   */
+  predicate hasIndexingManipulation(ControlFlowNode cfg) {
+    cfg.(VarDef).getAVariable() = getIndexVariable() or
+    cfg = getAnArrayShiftingCall().asExpr()
+  }
+
+  /**
+   * Holds if there is a `loop entry -> cfg` path that does not involve index manipulation or a successful index equality check.
+   */
+  predicate hasPathTo(ControlFlowNode cfg) {
+    exists(getACandidateSpliceCall()) and // restrict size of predicate
+    cfg = getLoopEntry().getFirstNode()
+    or
+    hasPathTo(cfg.getAPredecessor()) and
+    getLoopEntry().dominates(cfg.getBasicBlock()) and
+    not hasIndexingManipulation(cfg) and
+    // Ignore splice calls guarded by an index equality check.
+    // This indicates that the index of an element is the basis for removal, not its value,
+    // which means it may be okay to skip over elements.
+    not exists (ConditionGuardNode guard, EqualityTest test | cfg = guard |
+      test = guard.getTest() and
+      test.getAnOperand() = getIndexVariable().getAnAccess() and
+      guard.getOutcome() = test.getPolarity())
+  }
+
+  /**
+   * Holds if there is a `loop entry -> splice -> cfg` path that does not involve index manipulation,
+   * other than the `splice` call.
+   */
+  predicate hasPathThrough(SpliceCall splice, ControlFlowNode cfg) {
+    splice = getACandidateSpliceCall() and
+    cfg = splice.asExpr() and
+    hasPathTo(cfg.getAPredecessor())
+    or
+    hasPathThrough(splice, cfg.getAPredecessor()) and
+    getLoopEntry().dominates(cfg.getBasicBlock()) and
+    not hasIndexingManipulation(cfg)
+  }
+}
+
+from ArrayIterationLoop loop, SpliceCall splice
+where loop.hasPathThrough(splice, loop.getUpdate().getFirstControlFlowNode())
+select splice, "Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting."
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js
new file mode 100644
index 000000000000..ccff5c5d208b
--- /dev/null
+++ b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js
@@ -0,0 +1,9 @@
+function removePathTraversal(path) {
+  let parts = path.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === '..') {
+      parts.splice(i, 1);
+    }
+  }
+  return path.join('/');
+}
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js
new file mode 100644
index 000000000000..3ebedc7ced91
--- /dev/null
+++ b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js
@@ -0,0 +1,10 @@
+function removePathTraversal(path) {
+  let parts = path.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === '..') {
+      parts.splice(i, 1);
+      --i; // adjust for array shift
+    }
+  }
+  return path.join('/');
+}
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js
new file mode 100644
index 000000000000..eba08d045d2d
--- /dev/null
+++ b/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js
@@ -0,0 +1,3 @@
+function removePathTraversal(path) {
+  return path.split('/').filter(part => part !== '..').join('/');
+}
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
new file mode 100644
index 000000000000..8348040e8734
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
@@ -0,0 +1,3 @@
+| tst.js:4:27:4:44 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
+| tst.js:13:29:13:46 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
+| tst.js:24:9:24:26 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref
new file mode 100644
index 000000000000..0367f1f38878
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref
@@ -0,0 +1 @@
+Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
new file mode 100644
index 000000000000..6de02e2c5744
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
@@ -0,0 +1,113 @@
+function removeX(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === 'X') parts.splice(i, 1); // NOT OK
+  }
+  return parts.join('/');
+}
+
+function removeXInnerLoop(string, n) {
+  let parts = string.split('/');
+  for (let j = 0; j < n; ++j) {
+    for (let i = 0; i < parts.length; ++i) {
+      if (parts[i] === 'X') parts.splice(i, 1); // NOT OK
+    }
+  }
+  return parts.join('/');
+}
+
+function removeXOuterLoop(string, n) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    for (let j = 0; j < n; ++j) {
+      if (parts[i] === 'X') {
+        parts.splice(i, 1); // NOT OK
+        break;
+      }
+    }
+  }
+  return parts.join('/');
+}
+
+function decrementAfter(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === 'X') {
+        parts.splice(i, 1); // OK
+        --i;
+    }
+  }
+  return parts.join('/');
+}
+
+function postDecrementArgument(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === 'X') {
+        parts.splice(i--, 1); // OK
+    }
+  }
+  return parts.join('/');
+}
+
+
+function breakAfter(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === 'X') {
+        parts.splice(i, 1); // OK - only removes first occurrence
+        break;
+    }
+  }
+  return parts.join('/');
+}
+
+function insertNewElements(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (parts[i] === 'X') {
+        parts.splice(i, 1, '.'); // OK - no shifting due to insert
+    }
+  }
+  return parts.join('/');
+}
+
+function spliceAfterLoop(string) {
+  let parts = string.split('/');
+  let i = 0;
+  for (; i < parts.length; ++i) {
+    if (parts[i] === 'X') break;
+  }
+  if (parts[i] === 'X') {
+    parts.splice(i, 1); // OK - not inside loop 
+  }
+  return parts.join('/');
+}
+
+function spliceAfterLoopNested(string) {
+  let parts = string.split('/');
+  for (let j = 0; j < parts.length; ++j) {
+    let i = j;
+    for (; i < parts.length; ++i) {
+        if (parts[i] === 'X') break;
+    }
+    parts.splice(i, 1); // OK - not inside 'i' loop
+  }
+  return parts.join('/');
+}
+
+function removeAtSpecificPlace(string, k) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (i === k && parts[i] === 'X') parts.splice(i, 1); // OK - more complex logic
+  }
+  return parts.join('/');
+}
+
+function removeFirstAndLast(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (i === 0 || i === parts.length - 1) parts.splice(i, 1); // OK - out of scope of this query
+  }
+  return parts.join('/');
+}

From e822510d6b916176a46e9caa22eb17cb7addc4c7 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 17 Dec 2018 15:33:05 +0100
Subject: [PATCH 28/69] C#: Fix typo

---
 .../src/semmle/code/csharp/controlflow/ControlFlowElement.qll   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
index 15481f02956c..8738b5b3da88 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
@@ -79,7 +79,7 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
    * `pred` ending with this element, and `pred` is an immediate predecessor
    * of `succ`.
    *
-   * Moroever, this control flow element corresponds to multiple control flow nodes,
+   * Moreover, this control flow element corresponds to multiple control flow nodes,
    * which is why
    *
    * ```

From d3f6362ba2287c3640cf4dc3927324d5c905f426 Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <schack@semmle.com>
Date: Mon, 17 Dec 2018 15:40:46 +0100
Subject: [PATCH 29/69] Java: Add missing override annotations.

---
 java/ql/src/Metrics/Internal/Extents.qll | 4 ++--
 java/ql/src/external/CodeDuplication.qll | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/java/ql/src/Metrics/Internal/Extents.qll b/java/ql/src/Metrics/Internal/Extents.qll
index 1f1d1c55eb00..38494b1bd968 100644
--- a/java/ql/src/Metrics/Internal/Extents.qll
+++ b/java/ql/src/Metrics/Internal/Extents.qll
@@ -15,7 +15,7 @@ import java
  * including the body (if any), as opposed to the location of its name only.
  */
 class RangeCallable extends Callable {
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
     exists(int elSuper, int ecSuper | super.hasLocationInfo(path, sl, sc, elSuper, ecSuper) |
       this.getBody().hasLocationInfo(path, _, _, el, ec)
       or
@@ -39,7 +39,7 @@ class RangeCallable extends Callable {
  * including the range of its members (if any), as opposed to the location of its name only.
  */
 class RangeRefType extends RefType {
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
     exists(int elSuper, int ecSuper | super.hasLocationInfo(path, sl, sc, elSuper, ecSuper) |
       lastMember().hasLocationInfo(path, _, _, el, ec)
       or
diff --git a/java/ql/src/external/CodeDuplication.qll b/java/ql/src/external/CodeDuplication.qll
index 243e874cf6a1..ce01160695a9 100644
--- a/java/ql/src/external/CodeDuplication.qll
+++ b/java/ql/src/external/CodeDuplication.qll
@@ -51,11 +51,13 @@ class Copy extends @duplication_or_similarity {
 }
 
 class DuplicateBlock extends Copy, @duplication {
-  string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
+  override string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
 }
 
 class SimilarBlock extends Copy, @similarity {
-  string toString() { result = "Similar code: " + sourceLines() + " almost duplicated lines." }
+  override string toString() {
+    result = "Similar code: " + sourceLines() + " almost duplicated lines."
+  }
 }
 
 Method sourceMethod() { hasLocation(result, _) and numlines(result, _, _, _) }

From 280382e91ecd071d18eb55b05f5d670130ac5b8c Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Mon, 17 Dec 2018 15:19:26 +0000
Subject: [PATCH 30/69] JS: whitelist if array access at another index is seen

---
 ...issingIndexAdjustmentAfterConcurrentModification.ql | 10 +++++++++-
 .../tst.js                                             | 10 ++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
index 23f19afc127d..23bc456ce6e2 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
@@ -126,13 +126,21 @@ class ArrayIterationLoop extends ForStmt {
     hasPathTo(cfg.getAPredecessor()) and
     getLoopEntry().dominates(cfg.getBasicBlock()) and
     not hasIndexingManipulation(cfg) and
+
     // Ignore splice calls guarded by an index equality check.
     // This indicates that the index of an element is the basis for removal, not its value,
     // which means it may be okay to skip over elements.
     not exists (ConditionGuardNode guard, EqualityTest test | cfg = guard |
       test = guard.getTest() and
       test.getAnOperand() = getIndexVariable().getAnAccess() and
-      guard.getOutcome() = test.getPolarity())
+      guard.getOutcome() = test.getPolarity()) and
+
+    // Block flow after inspecting an array element other than that at the current index.
+    // For example, if the splice happens after inspecting `array[i + 1]`, then the next
+    // element has already been "looked at" and so it doesn't matter if we skip it.
+    not exists (IndexExpr index | cfg = index |
+      array.flowsToExpr(index.getBase()) and
+      not index.getIndex() = getIndexVariable().getAnAccess())
   }
 
   /**
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
index 6de02e2c5744..cebe8569c087 100644
--- a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
+++ b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
@@ -111,3 +111,13 @@ function removeFirstAndLast(string) {
   }
   return parts.join('/');
 }
+
+function inspectNextElement(string) {
+  let parts = string.split('/');
+  for (let i = 0; i < parts.length; ++i) {
+    if (i < parts.length - 1 && parts[i] === parts[i + 1]) {
+      parts.splice(i, 1); // OK - next element has been looked at
+    }
+  }
+  return parts.join('/');
+}

From d9ae5933d4e0a31fb4938c5b7969ca5a9101d0b6 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 17 Dec 2018 16:13:25 +0100
Subject: [PATCH 31/69] C#: Remove deprecated predicates

---
 .../ql/src/semmle/code/csharp/Assignable.qll  |  97 ---------------
 csharp/ql/src/semmle/code/csharp/Stmt.qll     |  28 -----
 csharp/ql/src/semmle/code/csharp/Type.qll     |  22 ----
 csharp/ql/src/semmle/code/csharp/XML.qll      |  13 --
 .../src/semmle/code/csharp/dataflow/SSA.qll   |  81 ------------
 .../src/semmle/code/csharp/exprs/Access.qll   |  82 -------------
 .../ql/src/semmle/code/csharp/exprs/Expr.qll  |  38 +-----
 .../code/csharp/frameworks/Microsoft.qll      |   4 -
 .../semmle/code/csharp/frameworks/System.qll  | 116 ------------------
 .../code/csharp/frameworks/microsoft/Owin.qll |   4 -
 .../code/csharp/frameworks/system/CodeDom.qll |   4 -
 .../csharp/frameworks/system/Collections.qll  |  16 ---
 .../code/csharp/frameworks/system/Data.qll    |   8 --
 .../csharp/frameworks/system/Diagnostics.qll  |  12 --
 .../code/csharp/frameworks/system/IO.qll      |  25 ----
 .../csharp/frameworks/system/Reflection.qll   |  12 --
 .../code/csharp/frameworks/system/Runtime.qll |   4 -
 .../code/csharp/frameworks/system/Text.qll    |  12 --
 .../csharp/frameworks/system/Threading.qll    |   4 -
 .../code/csharp/frameworks/system/Web.qll     |  20 ---
 .../code/csharp/frameworks/system/Xml.qll     |   4 -
 .../frameworks/system/codedom/Compiler.qll    |   8 --
 .../frameworks/system/collections/Generic.qll |  28 -----
 .../system/collections/Specialized.qll        |   8 --
 .../frameworks/system/data/SqlClient.qll      |   8 --
 .../frameworks/system/io/Compression.qll      |   4 -
 .../system/runtime/InteropServices.qll        |  16 ---
 .../frameworks/system/threading/Tasks.qll     |  12 --
 .../csharp/frameworks/system/web/Services.qll |   8 --
 .../code/csharp/frameworks/system/web/UI.qll  |  24 ----
 .../frameworks/system/web/ui/WebControls.qll  |   8 --
 .../csharp/frameworks/test/VisualStudio.qll   |   4 -
 32 files changed, 3 insertions(+), 731 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Assignable.qll b/csharp/ql/src/semmle/code/csharp/Assignable.qll
index 822a9daa17b0..e6002f5f9dcc 100644
--- a/csharp/ql/src/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Assignable.qll
@@ -113,49 +113,6 @@ class AssignableRead extends AssignableAccess {
   AssignableRead getAReachableRead() {
     result = this.getANextRead+()
   }
-
-  /**
-   * Gets a next uncertain read of the same underlying assignable. That is,
-   * a read that can be reached from this read without passing through any other
-   * reads, and which *may* read the same value. Example:
-   *
-   * ```
-   * int Field;
-   *
-   * void SetField(int i) {
-   *   this.Field = i;
-   *   Use(this.Field);
-   *   if (i > 0)
-   *     this.Field = i - 1;
-   *   else if (i < 0)
-   *     SetField(1);
-   *   Use(this.Field);
-   *   Use(this.Field);
-   * }
-   * ```
-   *
-   * - The read of `i` on line 6 is next to the read on line 4.
-   * - The reads of `i` on lines 7 and 8 are next to the read on line 6.
-   * - The read of `this.Field` on line 10 is next to the read on line 5.
-   *   (This is the only truly uncertain read.)
-   * - The read of `this.Field` on line 11 is next to the read on line 10.
-   */
-  deprecated
-  AssignableRead getANextUncertainRead() {
-    Ssa::Internal::adjacentReadPair(this, result)
-  }
-
-  /**
-   * Gets a next uncertain read of the same underlying assignable. That is,
-   * a read that can be reached from this read, and which *may* read the same
-   * value.
-   *
-   * This is the transitive closure of `getANextUncertainRead()`.
-   */
-  deprecated
-  AssignableRead getAReachableUncertainRead() {
-    result = this.getANextUncertainRead+()
-  }
 }
 
 /**
@@ -484,10 +441,6 @@ class AssignableDefinition extends TAssignableDefinition {
    */
   Expr getExpr() { none() }
 
-  /** DEPRECATED: Use `getAControlFlowNode()` instead. */
-  deprecated
-  ControlFlow::Node getControlFlowNode() { result = this.getAControlFlowNode() }
-
   /** Gets the enclosing callable of this definition. */
   Callable getEnclosingCallable() { result = this.getExpr().getEnclosingCallable() }
 
@@ -560,56 +513,6 @@ class AssignableDefinition extends TAssignableDefinition {
     result = this.getAFirstRead().getANextRead*()
   }
 
-  /**
-   * Gets a first uncertain read of the same underlying assignable. That is,
-   * a read that can be reached from this definition without passing through any
-   * other reads, and which *may* read the value assigned in this definition.
-   * Example:
-   *
-   * ```
-   * int Field;
-   *
-   * void SetField(int i) {
-   *   this.Field = i;
-   *   Use(this.Field);
-   *   if (i > 0)
-   *     this.Field = i - 1;
-   *   else if (i < 0)
-   *     SetField(1);
-   *   Use(this.Field);
-   *   Use(this.Field);
-   * }
-   * ```
-   *
-   * - The read of `i` on line 4 is a first read of the implicit parameter definition
-   *   on line 3.
-   * - The read of `this.Field` on line 5 is a first read of the definition on line 4.
-   * - The read of `this.Field` on line 10 is a first read of the definition on
-   *   line 7. (This is the only truly uncertain read.)
-   *
-   * Subsequent uncertain reads can be found by following the steps defined by
-   * `AssignableRead.getANextUncertainRead()`.
-   */
-  deprecated
-  AssignableRead getAFirstUncertainRead() {
-    exists(Ssa::ExplicitDefinition def |
-      def.getADefinition() = this |
-      result = def.getAFirstUncertainRead()
-    )
-  }
-
-  /**
-   * Gets a reachable uncertain read of the same underlying assignable. That is,
-   * a read that can be reached from this definition, and which *may* read the
-   * value assigned in this definition.
-   *
-   * This is the equivalent with `getAFirstUncertainRead().getANextUncertainRead*()`.
-   */
-  deprecated
-  AssignableRead getAReachableUncertainRead() {
-    result = this.getAFirstUncertainRead().getANextUncertainRead*()
-  }
-
   /** Gets a textual representation of this assignable definition. */
   string toString() { none() }
 
diff --git a/csharp/ql/src/semmle/code/csharp/Stmt.qll b/csharp/ql/src/semmle/code/csharp/Stmt.qll
index 0b4ee73ace8a..199030e341a1 100644
--- a/csharp/ql/src/semmle/code/csharp/Stmt.qll
+++ b/csharp/ql/src/semmle/code/csharp/Stmt.qll
@@ -1190,22 +1190,6 @@ class UsingStmt extends Stmt, @using_stmt {
   /** Gets a local variable declaration of this `using` statement. */
   LocalVariableDeclExpr getAVariableDeclExpr() { result = this.getVariableDeclExpr(_) }
 
-  /** DEPRECATED: Use `getVariable(0)` instead. */
-  deprecated
-  LocalVariable getVariable() { result = getVariableDeclExpr().getVariable() }
-
-  /** DEPRECATED: Use `getAVariableDeclExpr()` instead. */
-  deprecated
-  LocalVariableDeclExpr getVariableDeclExpr() { result.getParent() = this }
-
-  /** DEPRECATED: Use `getAnExpr()` instead. */
-  deprecated Expr getInitializer() {
-    if exists(this.getVariableDeclExpr(0)) then
-      result = this.getVariableDeclExpr(0).getInitializer()
-    else
-      result.getParent() = this
-  }
-
   /**
    * Gets the expression directly used by this `using` statement, if any. For
    * example, `f` on line 2 in
@@ -1389,14 +1373,6 @@ class FixedStmt extends Stmt, @fixed_stmt {
   /** Gets a local variable declaration of this `fixed` statement. */
   LocalVariableDeclExpr getAVariableDeclExpr() { result = this.getVariableDeclExpr(_) }
 
-  /** DEPRECATED: Use `getVariable(0)` instead. */
-  deprecated
-  LocalVariable getVariable() { result = getVariableDeclExpr().getVariable() }
-
-  /** DEPRECATED: Use `getVariableDeclExpr(0) instead. */
-  deprecated
-  LocalVariableDeclExpr getVariableDeclExpr() { result.getParent() = this }
-
   /** Gets the body of this `fixed` statement. */
   Stmt getBody() { result.getParent() = this }
 
@@ -1441,10 +1417,6 @@ class LabeledStmt extends Stmt, @labeled_stmt {
                and result = this.getParent().getChild(i+1))
   }
 
-  /** DEPRECATED: Use `getStmt()` instead. */
-  deprecated
-  Stmt getReferredStatement() { result = this.getStmt() }
-
   /** Gets the label of this statement. */
   string getLabel() { exprorstmt_name(this, result) }
 
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index 4dfb7f179a8e..b63c2516bda7 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -134,12 +134,6 @@ class ValueOrRefType extends DotNet::ValueOrRefType, Type, Attributable, @value_
     result.hasName(name)
   }
 
-  /**
-   * DEPRECATED: Use `hasMethod()` instead.
-   */
-  deprecated
-  predicate inheritsMethod(Method m) { this.hasMethod(m) }
-
   /**
    * Holds if this type has method `m`, that is, either `m` is declared in this
    * type, or `m` is inherited by this type.
@@ -164,14 +158,6 @@ class ValueOrRefType extends DotNet::ValueOrRefType, Type, Attributable, @value_
    */
   predicate hasMethod(Method m) { this.hasMember(m) }
 
-  /**
-   * DEPRECATED: Use `hasCallable()` instead.
-   */
-  deprecated
-  predicate inheritsCallable(Callable c) {
-    this.hasCallable(c)
-  }
-
   /**
    * Holds if this type has callable `c`, that is, either `c` is declared in this
    * type, or `c` is inherited by this type.
@@ -202,14 +188,6 @@ class ValueOrRefType extends DotNet::ValueOrRefType, Type, Attributable, @value_
     hasMember(c.(Accessor).getDeclaration())
   }
 
-  /**
-   * DEPRECATED: Use `hasMember()` instead.
-   */
-  deprecated
-  predicate inheritsMember(Member m) {
-    this.hasMember(m)
-  }
-
   /**
    * Holds if this type has member `m`, that is, either `m` is declared in this
    * type, or `m` is inherited by this type.
diff --git a/csharp/ql/src/semmle/code/csharp/XML.qll b/csharp/ql/src/semmle/code/csharp/XML.qll
index 8e434aa7866d..18be5bbee1f5 100644
--- a/csharp/ql/src/semmle/code/csharp/XML.qll
+++ b/csharp/ql/src/semmle/code/csharp/XML.qll
@@ -78,19 +78,6 @@ class XMLParent extends @xmlparent {
     result = count(int pos | xmlChars(_,_,this,pos,_,_))
   }
 
-  /**
-   * DEPRECATED: Internal.
-   *
-   * Append the character sequences of this XML parent from left to right, separated by a space,
-   * up to a specified (zero-based) index.
-   */
-  deprecated
-  string charsSetUpTo(int n) {
-    (n = 0 and xmlChars(_,result,this,0,_,_)) or
-    (n > 0 and exists(string chars | xmlChars(_,chars,this,n,_,_) |
-                         result = this.charsSetUpTo(n-1) + " " + chars))
-  }
-
   /** Append all the character sequences of this XML parent from left to right, separated by a space. */
   string allCharactersString() {
     result = concat(string chars, int pos | xmlChars(_, chars, this, pos, _, _) | chars, " " order by pos)
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index e8fa362ebf89..e1af158d0d4e 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -758,42 +758,6 @@ module Ssa {
       ssaRefRank(bb2, i2, v, _) = 1
     }
 
-    /**
-     * Holds if the value defined at non-trivial SSA definition `def` can reach `read`
-     * without passing through any other read, but possibly through pseudo definitions
-     * and uncertain definitions.
-     */
-    deprecated
-    predicate firstUncertainRead(TrackedDefinition def, AssignableRead read) {
-      firstReadSameVar(def, read)
-      or
-      exists(TrackedVar v, TrackedDefinition redef, BasicBlock b1, int i1, BasicBlock b2, int i2 |
-        redef instanceof UncertainDefinition or redef instanceof PseudoDefinition
-        |
-        adjacentVarRefs(v, b1, i1, b2, i2) and
-        definesAt(def, b1, i1, v) and
-        definesAt(redef, b2, i2, v) and
-        firstUncertainRead(redef, read)
-      )
-    }
-
-    /**
-     * INTERNAL: Use `AssignableRead.getANextUncertainRead()` instead.
-     */
-    deprecated
-    predicate adjacentReadPair(AssignableRead read1, AssignableRead read2) {
-      adjacentReadPairSameVar(read1, read2)
-      or
-      exists(TrackedVar v, TrackedDefinition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
-        adjacentVarRefs(v, bb1, i1, bb2, i2) and
-        variableRead(bb1, i1, v, read1.getAControlFlowNode(), _) and
-        definesAt(def, bb2, i2, v) and
-        firstUncertainRead(def, read2) |
-        def instanceof UncertainDefinition or
-        def instanceof PseudoDefinition
-      )
-    }
-
     private cached module Cached {
       /**
        * Holds if `read` is a last read of the non-trivial SSA definition `def`.
@@ -2146,47 +2110,6 @@ module Ssa {
       lastRead(this, result)
     }
 
-    /**
-     * Gets a first uncertain read of the source variable underlying this
-     * SSA definition. That is, a read that can be reached from this SSA definition
-     * without passing through any other reads or SSA definitions, except for
-     * phi nodes and uncertain updates. Example:
-     *
-     * ```
-     * int Field;
-     *
-     * void SetField(int i) {
-     *   this.Field = i;
-     *   Use(this.Field);
-     *   if (i > 0)
-     *     this.Field = i - 1;
-     *   else if (i < 0)
-     *     SetField(1);
-     *   Use(this.Field);
-     *   Use(this.Field);
-     * }
-     * ```
-     *
-     * - The read of `i` on line 4 can be reached from the explicit SSA
-     *   definition (wrapping an implicit entry definition) on line 3.
-     * - The reads of `i` on lines 6 and 7 are not the first reads of any SSA
-     *   definition.
-     * - The read of `this.Field` on line 5 can be reached from the explicit SSA
-     *   definition on line 4.
-     * - The read of `this.Field` on line 10 can be reached from the explicit SSA
-     *   definition on line 7, the implicit SSA definition on line 9, and the phi
-     *   node between lines 9 and 10.
-     * - The read of `this.Field` on line 11 is not the first read of any SSA
-     *   definition.
-     *
-     * Subsequent uncertain reads can be found by following the steps defined by
-     * `AssignableRead.getANextUncertainRead()`.
-     */
-    deprecated
-    AssignableRead getAFirstUncertainRead() {
-      firstUncertainRead(this, result)
-    }
-
     /**
      * Gets a definition that ultimately defines this SSA definition and is
      * not itself a pseudo node. Example:
@@ -2459,10 +2382,6 @@ module Ssa {
       )
     }
 
-    override AssignableRead getAFirstUncertainRead() {
-      result = this.getARead()
-    }
-
     override string toString() {
       result = getToStringPrefix(this) + "SSA untracked def(" + getSourceVariable() + ")"
     }
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Access.qll b/csharp/ql/src/semmle/code/csharp/exprs/Access.qll
index b03a5b64c7a9..196f1e5fe5cc 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Access.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Access.qll
@@ -128,28 +128,6 @@ class MemberAccess extends Access, QualifiableExpr, @member_access_expr {
 class AssignableAccess extends Access, @assignable_access_expr {
   override Assignable getTarget() { none() }
 
-  /**
-   * DEPRECATED: use the class `AssignableRead` instead.
-   */
-  deprecated predicate isReadAccess() {
-    this instanceof AssignableRead
-  }
-
-  /**
-   * DEPRECATED: use the class `AssignableWrite` instead.
-   */
-  deprecated predicate isWriteAccess() {
-    this instanceof AssignableWrite
-  }
-
-  /**
-   * DEPRECATED: use the classes `AssignableRead` and `AssignableWrite` instead.
-   */
-  deprecated predicate isReadWriteAccess() {
-    this instanceof AssignableRead and
-    this instanceof AssignableWrite
-  }
-
   /**
    * Holds if this access passes the assignable being accessed as an `out`
    * argument in a method call.
@@ -207,16 +185,6 @@ class VariableRead extends VariableAccess, AssignableRead {
   override VariableRead getAReachableRead() {
     result = AssignableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override VariableRead getANextUncertainRead() {
-    result = AssignableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override VariableRead getAReachableUncertainRead() {
-    result = AssignableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
@@ -249,16 +217,6 @@ class LocalScopeVariableRead extends LocalScopeVariableAccess, VariableRead {
   override LocalScopeVariableRead getAReachableRead() {
     result = VariableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override LocalScopeVariableRead getANextUncertainRead() {
-    result = VariableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override LocalScopeVariableRead getAReachableUncertainRead() {
-    result = VariableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
@@ -305,16 +263,6 @@ class ParameterRead extends ParameterAccess, LocalScopeVariableRead {
   override ParameterRead getAReachableRead() {
     result = LocalScopeVariableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override ParameterRead getANextUncertainRead() {
-    result = LocalScopeVariableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override ParameterRead getAReachableUncertainRead() {
-    result = LocalScopeVariableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
@@ -372,16 +320,6 @@ class LocalVariableRead extends LocalVariableAccess, LocalScopeVariableRead {
   override LocalVariableRead getAReachableRead() {
     result = LocalScopeVariableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override LocalVariableRead getANextUncertainRead() {
-    result = LocalScopeVariableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override LocalVariableRead getAReachableUncertainRead() {
-    result = LocalScopeVariableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
@@ -526,16 +464,6 @@ class PropertyRead extends PropertyAccess, AssignableRead {
   override PropertyRead getAReachableRead() {
     result = AssignableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override PropertyRead getANextUncertainRead() {
-    result = AssignableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override PropertyRead getAReachableUncertainRead() {
-    result = AssignableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
@@ -685,16 +613,6 @@ class IndexerRead extends IndexerAccess, AssignableRead {
   override IndexerRead getAReachableRead() {
     result = AssignableRead.super.getAReachableRead()
   }
-
-  deprecated
-  override IndexerRead getANextUncertainRead() {
-    result = AssignableRead.super.getANextUncertainRead()
-  }
-
-  deprecated
-  override IndexerRead getAReachableUncertainRead() {
-    result = AssignableRead.super.getAReachableUncertainRead()
-  }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index 1f802b84d552..6c2b720dc968 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -275,39 +275,7 @@ class IsExpr extends Expr, @is_expr {
    */
   Expr getExpr() { result = this.getChild(0) }
 
-  /**
-   * Deprecated: Use `IsTypeExpr.getTypeAccess()` instead.
-   * Gets the type access in this `is` expression, for example `string` in
-   * `x is string`.
-   */
-  deprecated
-  TypeAccess getTypeAccess() { none() }
-
-  /**
-   * Deprecated: Use `IsTypeExpr.getCheckedType()` instead.
-   * Gets the type being accessed in this `is` expression, for example `string`
-   * in `x is string`.
-   */
-  deprecated
-  Type getCheckedType() { none() }
-
   override string toString() { result = "... is ..." }
-
-  /**
-   * Deprecated: Use `IsPatternExpr.getVariableDeclExpr()` instead.
-   * Gets the local variable declaration in an `is` pattern expression,
-   * if any. For example `string s` in `x is string s`.
-   */
-  deprecated
-  LocalVariableDeclExpr getVariableDeclExpr() { none() }
-
-  /**
-   * Deprecated: Use `instanceof IsPatternExpr` instead.
-   * Holds if this `is` expression is an `is` pattern expression, for example
-   * `x is string s`.
-   */
-  deprecated
-  predicate isPattern() { this instanceof IsPatternExpr }
 }
 
 /**
@@ -322,13 +290,13 @@ class IsTypeExpr extends IsExpr
    * Gets the type being accessed in this `is` expression, for example `string`
    * in `x is string`.
    */
-  override Type getCheckedType() { result = typeAccess.getTarget() }
+  Type getCheckedType() { result = typeAccess.getTarget() }
 
   /**
    * Gets the type access in this `is` expression, for example `string` in
    * `x is string`.
    */
-  override TypeAccess getTypeAccess() { result = typeAccess }
+  TypeAccess getTypeAccess() { result = typeAccess }
 }
 
 /**
@@ -343,7 +311,7 @@ class IsPatternExpr extends IsTypeExpr
    * Gets the local variable declaration in this `is` pattern expression.
    * For example `string s` in `x is string s`.
    */
-  override LocalVariableDeclExpr getVariableDeclExpr() { result = typeDecl }
+  LocalVariableDeclExpr getVariableDeclExpr() { result = typeDecl }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/Microsoft.qll b/csharp/ql/src/semmle/code/csharp/frameworks/Microsoft.qll
index e174966a8d91..4d353e219ebb 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/Microsoft.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/Microsoft.qll
@@ -8,7 +8,3 @@ class MicrosoftNamespace extends Namespace {
     this.hasName("Microsoft")
   }
 }
-
-/** DEPRECATED. Gets the `Microsoft` namespace. */
-deprecated
-MicrosoftNamespace getMicrosoftNamespace() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/System.qll b/csharp/ql/src/semmle/code/csharp/frameworks/System.qll
index 27b1e43b5196..823fdef24e59 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/System.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/System.qll
@@ -10,10 +10,6 @@ class SystemNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System` namespace. */
-deprecated
-SystemNamespace getSystemNamespace() { any() }
-
 /** A class in the `System` namespace. */
 class SystemClass extends Class {
   SystemClass() {
@@ -63,10 +59,6 @@ class SystemActionDelegateType extends SystemDelegateType {
   }
 }
 
-/** DEPRECATED. Gets the `System.Action` delegate type. */
-deprecated
-SystemActionDelegateType getSystemActionDelegateType() { any() }
-
 /** The `System.Action<T1, ..., Tn>` delegate type. */
 class SystemActionTDelegateType extends SystemUnboundGenericDelegateType {
   SystemActionTDelegateType() {
@@ -74,10 +66,6 @@ class SystemActionTDelegateType extends SystemUnboundGenericDelegateType {
   }
 }
 
-/** DEPRECATED. Gets a `System.Action<T1, ..., Tn>` delegate type. */
-deprecated
-SystemActionTDelegateType getSystemActionTDelegateType() { any() }
-
 /** `System.Array` class. */
 class SystemArrayClass extends SystemClass {
   SystemArrayClass() {
@@ -85,10 +73,6 @@ class SystemArrayClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Array` class. */
-deprecated
-SystemArrayClass getSystemArrayClass() { any() }
-
 /** The `System.Boolean` structure. */
 class SystemBooleanStruct extends BoolType {
   /** Gets the `Parse(string)` method. */
@@ -120,10 +104,6 @@ class SystemBooleanStruct extends BoolType {
   }
 }
 
-/** DEPRECATED. Gets the `System.Boolean` structure. */
-deprecated
-SystemBooleanStruct getSystemBooleanStruct() { any() }
-
 /** The `System.Convert` class. */
 class SystemConvertClass extends SystemClass {
   SystemConvertClass() {
@@ -131,10 +111,6 @@ class SystemConvertClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Convert` class. */
-deprecated
-SystemConvertClass getSystemConvertClass() { any() }
-
 /** `System.Delegate` class. */
 class SystemDelegateClass extends SystemClass {
   SystemDelegateClass() {
@@ -142,10 +118,6 @@ class SystemDelegateClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Delegate` class. */
-deprecated
-SystemDelegateClass getSystemDelegateClass() { any() }
-
 /** The `System.DivideByZeroException` class. */
 class SystemDivideByZeroExceptionClass extends SystemClass {
   SystemDivideByZeroExceptionClass() {
@@ -153,10 +125,6 @@ class SystemDivideByZeroExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.DivideByZeroException` class. */
-deprecated
-SystemDivideByZeroExceptionClass getSystemDivideByZeroExceptionClass() { any() }
-
 /** The `System.Enum` class. */
 class SystemEnumClass extends SystemClass {
   SystemEnumClass() {
@@ -164,10 +132,6 @@ class SystemEnumClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Enum` class. */
-deprecated
-SystemEnumClass getSystemEnumClass() { any() }
-
 /** The `System.Exception` class. */
 class SystemExceptionClass extends SystemClass {
   SystemExceptionClass() {
@@ -175,10 +139,6 @@ class SystemExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Exception` class. */
-deprecated
-SystemExceptionClass getSystemExceptionClass() { any() }
-
 /** The `System.Func<T1, ..., Tn, TResult>` delegate type. */
 class SystemFuncDelegateType extends SystemUnboundGenericDelegateType {
   SystemFuncDelegateType() {
@@ -199,10 +159,6 @@ class SystemFuncDelegateType extends SystemUnboundGenericDelegateType {
   }
 }
 
-/** DEPRECATED. Gets a `System.Func<T1, ..., Tn, TResult>` delegate type. */
-deprecated
-SystemFuncDelegateType getSystemFuncDelegateType() { any() }
-
 /** The `System.IComparable` interface. */
 class SystemIComparableInterface extends SystemInterface {
   SystemIComparableInterface() {
@@ -223,10 +179,6 @@ class SystemIComparableInterface extends SystemInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.IComparable` interface. */
-deprecated
-SystemIComparableInterface getSystemIComparableInterface() { any() }
-
 /** The `System.IComparable<T>` interface. */
 class SystemIComparableTInterface extends SystemUnboundGenericInterface {
   SystemIComparableTInterface() {
@@ -247,10 +199,6 @@ class SystemIComparableTInterface extends SystemUnboundGenericInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.IComparable<T>` interface. */
-deprecated
-SystemIComparableTInterface getSystemIComparableTInterface() { any() }
-
 /** The `System.IEquatable<T>` interface. */
 class SystemIEquatableTInterface extends SystemUnboundGenericInterface {
   SystemIEquatableTInterface() {
@@ -271,10 +219,6 @@ class SystemIEquatableTInterface extends SystemUnboundGenericInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.IEquatable<T>` interface. */
-deprecated
-SystemIEquatableTInterface getSystemIEquatableTInterface() { any() }
-
 /** The `System.IFormatProvider` interface. */
 class SystemIFormatProviderInterface extends SystemInterface {
   SystemIFormatProviderInterface() {
@@ -282,10 +226,6 @@ class SystemIFormatProviderInterface extends SystemInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.IFormatProvider` interface. */
-deprecated
-SystemIFormatProviderInterface getSystemIFormatProviderInterface() { any() }
-
 /** The `System.Int32` structure. */
 class SystemInt32Struct extends IntType {
   /** Gets the `Parse(string, ...)` method. */
@@ -313,10 +253,6 @@ class SystemInt32Struct extends IntType {
   }
 }
 
-/** DEPRECATED. Gets the `System.Int32` structure. */
-deprecated
-SystemInt32Struct getSystemInt32Struct() { any() }
-
 /** The `System.InvalidCastException` class. */
 class SystemInvalidCastExceptionClass extends SystemClass {
   SystemInvalidCastExceptionClass() {
@@ -324,10 +260,6 @@ class SystemInvalidCastExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.InvalidCastException` class. */
-deprecated
-SystemInvalidCastExceptionClass getSystemInvalidCastExceptionClass() { any() }
-
 /** The `System.Lazy<T>` class. */
 class SystemLazyClass extends SystemUnboundGenericClass {
   SystemLazyClass() {
@@ -346,10 +278,6 @@ class SystemLazyClass extends SystemUnboundGenericClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Lazy<T>` class. */
-deprecated
-SystemLazyClass getSystemLazyClass() { any() }
-
 /** The `System.NullReferenceException` class. */
 class SystemNullReferenceExceptionClass extends SystemClass {
   SystemNullReferenceExceptionClass() {
@@ -357,10 +285,6 @@ class SystemNullReferenceExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.NullReferenceException` class. */
-deprecated
-SystemNullReferenceExceptionClass getSystemNullReferenceExceptionClass() { any() }
-
 /** The `System.Object` class. */
 class SystemObjectClass extends SystemClass {
   SystemObjectClass() {
@@ -448,10 +372,6 @@ class SystemObjectClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Object` class. */
-deprecated
-SystemObjectClass getSystemObjectClass() { any() }
-
 /** The `System.OutOfMemoryException` class. */
 class SystemOutOfMemoryExceptionClass extends SystemClass {
   SystemOutOfMemoryExceptionClass() {
@@ -459,10 +379,6 @@ class SystemOutOfMemoryExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.OutOfMemoryException` class. */
-deprecated
-SystemOutOfMemoryExceptionClass getSystemOutOfMemoryExceptionClass() { any() }
-
 /** The `System.OverflowException` class. */
 class SystemOverflowExceptionClass extends SystemClass {
   SystemOverflowExceptionClass() {
@@ -470,10 +386,6 @@ class SystemOverflowExceptionClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.OverflowException` class. */
-deprecated
-SystemOverflowExceptionClass getSystemOverflowExceptionClass() { any() }
-
 /** The `System.Predicate<T>` delegate type. */
 class SystemPredicateDelegateType extends SystemUnboundGenericDelegateType {
   SystemPredicateDelegateType() {
@@ -483,10 +395,6 @@ class SystemPredicateDelegateType extends SystemUnboundGenericDelegateType {
   }
 }
 
-/** DEPRECATED. Gets the `System.Predicate<T>` delegate type. */
-deprecated
-SystemPredicateDelegateType getSystemPredicateDelegateType() { any() }
-
 /** The `System.String` class. */
 class SystemStringClass extends StringType {
   /** Gets the `Equals(object)` method. */
@@ -642,10 +550,6 @@ class SystemStringClass extends StringType {
   }
 }
 
-/** DEPRECATED. Gets the `System.String` class. */
-deprecated
-SystemStringClass getSystemStringClass() { any() }
-
 /** A `ToString()` method. */
 class ToStringMethod extends Method {
   ToStringMethod() {
@@ -693,10 +597,6 @@ class SystemTypeClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Type` class. */
-deprecated
-SystemTypeClass getSystemTypeClass() { any() }
-
 /** The `System.Uri` class. */
 class SystemUriClass extends SystemClass {
   SystemUriClass() {
@@ -731,10 +631,6 @@ class SystemUriClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Uri` class. */
-deprecated
-SystemUriClass getSystemUriClass() { any() }
-
 /** The `System.ValueType` class. */
 class SystemValueTypeClass extends SystemClass {
   SystemValueTypeClass() {
@@ -742,10 +638,6 @@ class SystemValueTypeClass extends SystemClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.ValueType` class. */
-deprecated
-SystemValueTypeClass getSystemValueTypeClass() { any() }
-
 /** The `System.IntPtr` type. */
 class SystemIntPtrType extends ValueType {
   SystemIntPtrType() {
@@ -755,10 +647,6 @@ class SystemIntPtrType extends ValueType {
   }
 }
 
-/** DEPRECATED. Gets the `System.IntPtr` type. */
-deprecated
-SystemIntPtrType getSystemIntPtrType() { any() }
-
 /** The `System.IDisposable` interface. */
 class SystemIDisposableInterface extends SystemInterface {
   SystemIDisposableInterface() {
@@ -777,10 +665,6 @@ class SystemIDisposableInterface extends SystemInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.IDisposable` interface. */
-deprecated
-SystemIDisposableInterface getSystemIDisposableInterface() { any() }
-
 /** A method that overrides `int object.GetHashCode()`. */
 class GetHashCodeMethod extends Method {
   GetHashCodeMethod() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/Owin.qll b/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/Owin.qll
index 8be2a6cab763..2a54980bc7fc 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/Owin.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/Owin.qll
@@ -14,10 +14,6 @@ class MicrosoftOwinNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `Microsoft.Owin` namespace. */
-deprecated
-MicrosoftOwinNamespace getMicrosoftOwinNamespace() { any() }
-
 /** The `Microsoft.Owin.IOwinRequest` class. */
 class MicrosoftOwinIOwinRequestClass extends Class {
   MicrosoftOwinIOwinRequestClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/CodeDom.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/CodeDom.qll
index eb06a6373fdc..b5e29ee9db11 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/CodeDom.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/CodeDom.qll
@@ -9,7 +9,3 @@ class SystemCodeDomNamespace extends Namespace {
     this.hasName("CodeDom")
   }
 }
-
-/** DEPRECATED. Gets the `System.CodeDom` namespace. */
-deprecated
-SystemCodeDomNamespace getSystemCodeDomNamespace() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Collections.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Collections.qll
index 76e797bbeeba..2fa9822ced3b 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Collections.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Collections.qll
@@ -10,10 +10,6 @@ class SystemCollectionsNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections` namespace. */
-deprecated
-SystemCollectionsNamespace getSystemCollectionsNamespace() { any() }
-
 /** An interface in the `System.Collections` namespace. */
 class SystemCollectionsInterface extends Interface {
   SystemCollectionsInterface() {
@@ -43,10 +39,6 @@ class SystemCollectionsIComparerInterface extends SystemCollectionsInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.IComparer` interface. */
-deprecated
-SystemCollectionsIComparerInterface getSystemCollectionsIComparerInterface() { any() }
-
 /** The `System.Collections.IEnumerable` interface. */
 class SystemCollectionsIEnumerableInterface extends SystemCollectionsInterface {
   SystemCollectionsIEnumerableInterface() {
@@ -54,10 +46,6 @@ class SystemCollectionsIEnumerableInterface extends SystemCollectionsInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.IEnumerable` interface. */
-deprecated
-SystemCollectionsIEnumerableInterface getSystemCollectionsIEnumerableInterface() { any() }
-
 /** The `System.Collections.IEnumerator` interface. */
 class SystemCollectionsIEnumeratorInterface extends SystemCollectionsInterface {
   SystemCollectionsIEnumeratorInterface() {
@@ -74,10 +62,6 @@ class SystemCollectionsIEnumeratorInterface extends SystemCollectionsInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.IEnumerator` interface. */
-deprecated
-SystemCollectionsIEnumeratorInterface getSystemCollectionsIEnumeratorInterface() { any() }
-
 /** The `System.Collections.ICollection` interface. */
 class SystemCollectionsICollectionInterface extends SystemCollectionsInterface {
   SystemCollectionsICollectionInterface() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Data.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Data.qll
index 18be7b7e9269..09f54916024a 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Data.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Data.qll
@@ -10,10 +10,6 @@ class SystemDataNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Data` namespace. */
-deprecated
-SystemDataNamespace getSystemDataNamespace() { any() }
-
 /** An interface in the `System.Data` namespace. */
 class SystemDataInterface extends Interface {
   SystemDataInterface() {
@@ -37,10 +33,6 @@ class SystemDataIDbCommandInterface extends SystemDataInterface {
   }
 }
 
-/** DEPRECATED. Gets the `System.Data.IDbCommand` interface. */
-deprecated
-SystemDataIDbCommandInterface getSystemDataIDbCommandInterface() { any() }
-
 /** The `System.Data.IDbConnection` interface. */
 class SystemDataIDbConnectionInterface extends SystemDataInterface {
   SystemDataIDbConnectionInterface() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Diagnostics.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Diagnostics.qll
index 182812cf71a3..48119f599d85 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Diagnostics.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Diagnostics.qll
@@ -10,10 +10,6 @@ class SystemDiagnosticsNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Diagnostics` namespace. */
-deprecated
-SystemDiagnosticsNamespace getSystemDiagnosticsNamespace() { any() }
-
 /** A class in the `System.Diagnostics` namespace. */
 class SystemDiagnosticsClass extends Class {
   SystemDiagnosticsClass() {
@@ -40,10 +36,6 @@ class SystemDiagnosticsDebugClass extends SystemDiagnosticsClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Diagnostics.Debug` class. */
-deprecated
-SystemDiagnosticsDebugClass getSystemDiagnosticsDebugClass() { any() }
-
 /** The `System.Diagnostics.ProcessStartInfo` class. */
 class SystemDiagnosticsProcessStartInfoClass extends SystemDiagnosticsClass {
   SystemDiagnosticsProcessStartInfoClass() {
@@ -73,7 +65,3 @@ class SystemDiagnosticsProcessClass extends SystemDiagnosticsClass {
     result.getReturnType() instanceof SystemDiagnosticsProcessClass
   }
 }
-
-/** DEPRECATED. Gets the `System.Diagnostics.Process` class. */
-deprecated
-SystemDiagnosticsProcessClass getSystemDiagnosticsProcessClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/IO.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/IO.qll
index cf3d62bdae9e..f645df32b2c2 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/IO.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/IO.qll
@@ -10,10 +10,6 @@ class SystemIONamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO` namespace. */
-deprecated
-SystemIONamespace getSystemIONamespace() { any() }
-
 /** A class in the `System.IO` namespace. */
 class SystemIOClass extends Class {
   SystemIOClass() {
@@ -35,11 +31,6 @@ class SystemIOFileClass extends SystemIOClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO.File` class. */
-deprecated
-SystemIOFileClass getSystemIOFileClass() { any() }
-
-
 /** The `System.IO.FileStream` class. */
 class SystemIOFileStreamClass extends SystemIOClass {
   SystemIOFileStreamClass() {
@@ -61,10 +52,6 @@ class SystemIOPathClass extends SystemIOClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO.Path` class. */
-deprecated
-SystemIOPathClass getSystemIOPathClass() { any() }
-
 /** The `System.IO.StringReader` class. */
 class SystemIOStringReaderClass extends SystemIOClass {
   SystemIOStringReaderClass() {
@@ -72,10 +59,6 @@ class SystemIOStringReaderClass extends SystemIOClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO.StringReader` class. */
-deprecated
-SystemIOStringReaderClass getSystemIOStringReaderClass() { any() }
-
 /** The `System.IO.Stream` class. */
 class SystemIOStreamClass extends SystemIOClass {
   SystemIOStreamClass() {
@@ -123,10 +106,6 @@ class SystemIOStreamClass extends SystemIOClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO.Stream` class. */
-deprecated
-SystemIOStreamClass getSystemIOStreamClass() { any() }
-
 /** The `System.IO.MemoryStream` class. */
 class SystemIOMemoryStreamClass extends SystemIOClass {
   SystemIOMemoryStreamClass() {
@@ -139,7 +118,3 @@ class SystemIOMemoryStreamClass extends SystemIOClass {
     result.hasName("ToArray")
   }
 }
-
-/** DEPRECATED. Gets the `System.IO.MemoryStream` class. */
-deprecated
-SystemIOMemoryStreamClass getSystemIOMemoryStreamClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Reflection.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Reflection.qll
index f13887c854de..a4e5bfaf5a6f 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Reflection.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Reflection.qll
@@ -10,10 +10,6 @@ class SystemReflectionNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Reflection` namespace. */
-deprecated
-SystemReflectionNamespace getSystemReflectionNamespace() { any() }
-
 /** A class in the `System.Reflection` namespace. */
 class SystemReflectionClass extends Class {
   SystemReflectionClass() {
@@ -58,17 +54,9 @@ class SystemReflectionMethodBaseClass extends SystemReflectionClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Reflection.MethodBase` class. */
-deprecated
-SystemReflectionMethodBaseClass getSystemReflectionMethodBaseClass() { any() }
-
 /** The `System.Reflection.MethodInfo` class. */
 class SystemReflectionMethodInfoClass extends SystemReflectionClass {
   SystemReflectionMethodInfoClass() {
     this.hasName("MethodInfo")
   }
 }
-
-/** DEPRECATED. Gets the `System.Reflection.MethodInfo` class. */
-deprecated
-SystemReflectionMethodInfoClass getSystemReflectionMethodInfoClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Runtime.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Runtime.qll
index 0de50d85ca66..8c03fc494202 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Runtime.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Runtime.qll
@@ -9,7 +9,3 @@ class SystemRuntimeNamespace extends Namespace {
     this.hasName("Runtime")
   }
 }
-
-/** DEPRECATED. Gets the `System.Runtime` namespace. */
-deprecated
-SystemRuntimeNamespace getSystemRuntimeNamespace() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Text.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Text.qll
index 9f9173ea10ca..4b50128cf1df 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Text.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Text.qll
@@ -10,10 +10,6 @@ class SystemTextNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Text` namespace. */
-deprecated
-SystemTextNamespace getSystemTextNamespace() { any() }
-
 /** A class in the `System.Text` namespace. */
 class SystemTextClass extends Class {
   SystemTextClass() {
@@ -33,10 +29,6 @@ class SystemTextStringBuilderClass extends SystemTextClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Text.StringBuilder` class. */
-deprecated
-SystemTextStringBuilderClass getSystemTextStringBuilderClass() { any() }
-
 /** The `System.Text.Encoding` class. */
 class SystemTextEncodingClass extends SystemTextClass {
   SystemTextEncodingClass() {
@@ -58,7 +50,3 @@ class SystemTextEncodingClass extends SystemTextClass {
     result = this.getAMethod("GetChars")
   }
 }
-
-/** DEPRECATED. Gets the `System.Text.Encoding` class. */
-deprecated
-SystemTextEncodingClass getSystemTextEncodingClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Threading.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Threading.qll
index be5d225f35b9..3c147882d194 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Threading.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Threading.qll
@@ -9,7 +9,3 @@ class SystemThreadingNamespace extends Namespace {
     this.hasName("Threading")
   }
 }
-
-/** DEPRECATED. Gets the `System.Threading` namespace. */
-deprecated
-SystemThreadingNamespace getSystemThreadingNamespace() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Web.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Web.qll
index fc0d2e3b8f69..a46926c8342a 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Web.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Web.qll
@@ -11,10 +11,6 @@ class SystemWebNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Web` namespace. */
-deprecated
-SystemWebNamespace getSystemWebNamespace() { any() }
-
 /** A class in the `System.Web` namespace. */
 class SystemWebClass extends Class {
   SystemWebClass() {
@@ -288,19 +284,3 @@ class SystemWebHtmlString extends SystemWebClass {
     this.hasName("HtmlString")
   }
 }
-
-/** DEPRECATED. Gets the `System.Web.HttpRequest` class. */
-deprecated
-SystemWebHttpRequestClass getSystemWebHttpRequestClass() { any() }
-
-/** DEPRECATED. Gets the `System.Web.UnvalidatedRequestValues` class. */
-deprecated
-SystemWebUnvalidatedRequestValues getSystemWebUnvalidatedRequestValues() { any() }
-
-/** DEPRECATED. Gets the `System.Web.HttpRequestMessage` class. */
-deprecated
-SystemWebHttpRequestMessageClass getSystemWebHttpRequestMessageClass() { any() }
-
-/** DEPRECATED. Gets the `System.Web.HttpResponse` class. */
-deprecated
-SystemWebHttpResponseClass getSystemWebHttpResponseClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll
index eba7beb3a088..cb8c855b0206 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll
@@ -18,10 +18,6 @@ class SystemXmlSchemaNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Xml` namespace. */
-deprecated
-SystemXmlNamespace getSystemXmlNamespace() { any() }
-
 /** A class in the `System.Xml` namespace. */
 class SystemXmlClass extends Class {
   SystemXmlClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/codedom/Compiler.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/codedom/Compiler.qll
index 72610a13ebca..6a1da6be8731 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/codedom/Compiler.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/codedom/Compiler.qll
@@ -10,10 +10,6 @@ class SystemCodeDomCompilerNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.CodeDom.Compiler` namespace. */
-deprecated
-SystemCodeDomCompilerNamespace getSystemCodeDomCompilerNamespace() { any() }
-
 /** A reference type in the `System.CodeDom.Compiler` namespace. */
 class SystemCodeDomCompilerClass extends RefType {
   SystemCodeDomCompilerClass() {
@@ -28,10 +24,6 @@ class SystemCodeDomCompilerGeneratedCodeAttributeClass extends SystemCodeDomComp
   }
 }
 
-/** DEPRECATED. Gets the `System.CodeDom.Compiler.GeneratedCodeAttribute` class. */
-deprecated
-SystemCodeDomCompilerGeneratedCodeAttributeClass getSystemCodeDomCompilerGeneratedCodeAttributeClass() { any() }
-
 /** The `System.CodeDom.Compiler.ICodeCompiler` class. */
 class SystemCodeDomCompilerICodeCompilerClass extends SystemCodeDomCompilerClass {
   SystemCodeDomCompilerICodeCompilerClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Generic.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Generic.qll
index 9179a2b58fe0..17358fbac1d0 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Generic.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Generic.qll
@@ -10,10 +10,6 @@ class SystemCollectionsGenericNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic` namespace. */
-deprecated
-SystemCollectionsGenericNamespace getSystemCollectionsGenericNamespace() { any() }
-
 /** An unbound generic interface in the `System.Collections.Generic` namespace. */
 class SystemCollectionsGenericUnboundGenericInterface extends UnboundGenericInterface {
   SystemCollectionsGenericUnboundGenericInterface() {
@@ -50,10 +46,6 @@ class SystemCollectionsGenericIComparerTInterface extends SystemCollectionsGener
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.IComparer<T>` interface. */
-deprecated
-SystemCollectionsGenericIComparerTInterface getSystemCollectionsGenericIComparerTInterface() { any() }
-
 /** The `System.Collections.Generic.IEqualityComparer<T>` interface. */
 class SystemCollectionsGenericIEqualityComparerTInterface extends SystemCollectionsGenericUnboundGenericInterface {
   SystemCollectionsGenericIEqualityComparerTInterface() {
@@ -76,10 +68,6 @@ class SystemCollectionsGenericIEqualityComparerTInterface extends SystemCollecti
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.IEqualityComparer<T>` interface. */
-deprecated
-SystemCollectionsGenericIEqualityComparerTInterface getSystemCollectionsGenericIEqualityComparerTInterface() { any() }
-
 /** The `System.Collections.Generic.IEnumerable<T>` interface. */
 class SystemCollectionsGenericIEnumerableTInterface extends SystemCollectionsGenericUnboundGenericInterface {
   SystemCollectionsGenericIEnumerableTInterface() {
@@ -89,10 +77,6 @@ class SystemCollectionsGenericIEnumerableTInterface extends SystemCollectionsGen
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.IEnumerable<T>` interface. */
-deprecated
-SystemCollectionsGenericIEnumerableTInterface getSystemCollectionsGenericIEnumerableTInterface() { any() }
-
 /** The `System.Collections.Generic.IEnumerator<T>` interface. */
 class SystemCollectionsGenericIEnumeratorInterface extends SystemCollectionsGenericUnboundGenericInterface {
   SystemCollectionsGenericIEnumeratorInterface() {
@@ -111,10 +95,6 @@ class SystemCollectionsGenericIEnumeratorInterface extends SystemCollectionsGene
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.IEnumerator<T>` interface. */
-deprecated
-SystemCollectionsGenericIEnumeratorInterface getSystemCollectionsGenericIEnumeratorInterface() { any() }
-
 /** The `System.Collections.Generic.IList<T>` interface. */
 class SystemCollectionsGenericIListTInterface extends SystemCollectionsGenericUnboundGenericInterface {
   SystemCollectionsGenericIListTInterface() {
@@ -124,10 +104,6 @@ class SystemCollectionsGenericIListTInterface extends SystemCollectionsGenericUn
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.IList<T>` interface. */
-deprecated
-SystemCollectionsGenericIListTInterface getSystemCollectionsGenericIListTInterface() { any() }
-
 /** The `System.Collections.Generic.KeyValuePair<TKey, TValue>` structure. */
 class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGenericUnboundGenericStruct {
   SystemCollectionsGenericKeyValuePairStruct() {
@@ -155,10 +131,6 @@ class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGeneri
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Generic.KeyValuePair<TKey, TValue>` structure. */
-deprecated
-SystemCollectionsGenericKeyValuePairStruct getSystemCollectionsGenericKeyValuePairStruct() { any() }
-
 /** The `System.Collections.Generic.ICollection<>` interface. */
 class SystemCollectionsGenericICollectionInterface extends SystemCollectionsGenericUnboundGenericInterface {
   SystemCollectionsGenericICollectionInterface() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Specialized.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Specialized.qll
index d99633ec0394..4d36a558ea54 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Specialized.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/collections/Specialized.qll
@@ -10,10 +10,6 @@ class SystemCollectionsSpecializedNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Collections.Specialized` namespace. */
-deprecated
-SystemCollectionsSpecializedNamespace getSystemCollectionsSpecializedNamespace() { any() }
-
 /** A class in the `System.Collections.Specialized` namespace. */
 class SystemCollectionsSpecializedClass extends Class {
   SystemCollectionsSpecializedClass() {
@@ -27,7 +23,3 @@ class SystemCollectionsSpecializedNameValueCollectionClass extends SystemCollect
     this.hasName("NameValueCollection")
   }
 }
-
-/** DEPRECATED. Gets the `System.Collections.Specialized.NameValueCollection` class. */
-deprecated
-SystemCollectionsSpecializedNameValueCollectionClass getSystemCollectionsSpecializedNameValueCollectionClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/data/SqlClient.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/data/SqlClient.qll
index 3a6e6f6c4fa2..8961aad8f612 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/data/SqlClient.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/data/SqlClient.qll
@@ -10,10 +10,6 @@ class SystemDataSqlClientNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Data.SqlClient` namespace. */
-deprecated
-SystemDataSqlClientNamespace getSystemDataSqlClientNamespace() { any() }
-
 /** A class in the `System.Data.SqlClient` namespace. */
 class SystemDataSqlClientClass extends Class {
   SystemDataSqlClientClass() {
@@ -28,10 +24,6 @@ class SystemDataSqlClientSqlDataAdapterClass extends SystemDataSqlClientClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Data.SqlClient.SqlDataAdapter` class. */
-deprecated
-SystemDataSqlClientSqlDataAdapterClass getSystemDataSqlClientSqlDataAdapterClass() { any() }
-
 /** The `System.Data.SqlClient.SqlConnection` class. */
 class SystemDataSqlClientSqlConnectionClass extends SystemDataSqlClientClass {
   SystemDataSqlClientSqlConnectionClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/io/Compression.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/io/Compression.qll
index 95ad2c3b5ad7..14b42dadf10f 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/io/Compression.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/io/Compression.qll
@@ -10,10 +10,6 @@ class SystemIOCompressionNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.IO` namespace. */
-deprecated
-SystemIOCompressionNamespace getSystemIOCompressionNamespace() { any() }
-
 /** A class in the `System.IO.Compression` namespace. */
 class SystemIOCompressionClass extends Class {
   SystemIOCompressionClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/runtime/InteropServices.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/runtime/InteropServices.qll
index a2ce047a0c90..48b55e97324f 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/runtime/InteropServices.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/runtime/InteropServices.qll
@@ -11,10 +11,6 @@ class SystemRuntimeInteropServicesNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Runtime.InteropServices` namespace. */
-deprecated
-SystemRuntimeInteropServicesNamespace getSystemRuntimeInteropServicesNamespace() { any() }
-
 /** A class in the `System.Runtime.InteropServices` namespace. */
 class SystemRuntimeInteropServicesClass extends Class {
   SystemRuntimeInteropServicesClass() {
@@ -29,10 +25,6 @@ class SystemRuntimeInteropServicesDllImportAttributeClass extends SystemRuntimeI
   }
 }
 
-/** DEPRECATED. Gets the `System.Runtime.InteropServices.DllImportAttribute` class. */
-deprecated
-SystemRuntimeInteropServicesDllImportAttributeClass getSystemRuntimeInteropServicesDllImportAttributeClass() { any() }
-
 /** The `System.Runtime.InteropServices.Marshal` class. */
 class SystemRuntimeInteropServicesMarshalClass extends SystemRuntimeInteropServicesClass {
   SystemRuntimeInteropServicesMarshalClass() {
@@ -70,17 +62,9 @@ class SystemRuntimeInteropServicesMarshalClass extends SystemRuntimeInteropServi
   }
 }
 
-/** DEPRECATED. Gets the `System.Runtime.InteropServices.Marshal` class. */
-deprecated
-SystemRuntimeInteropServicesMarshalClass getSystemRuntimeInteropServicesMarshalClass() { any() }
-
 /** The `System.Runtime.InteropServices.ComImportAttribute` class. */
 class SystemRuntimeInteropServicesComImportAttributeClass extends SystemRuntimeInteropServicesClass {
   SystemRuntimeInteropServicesComImportAttributeClass() {
     this.hasName("ComImportAttribute")
   }
 }
-
-/** DEPRECATED. Gets the `System.Runtime.InteropServices.ComImportAttribute` class. */
-deprecated
-SystemRuntimeInteropServicesComImportAttributeClass getSystemRuntimeInteropServicesComImportAttributeClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/threading/Tasks.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/threading/Tasks.qll
index d6e0ac818e55..2e5e4739afdc 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/threading/Tasks.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/threading/Tasks.qll
@@ -10,10 +10,6 @@ class SystemThreadingTasksNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Threading.Tasks` namespace. */
-deprecated
-SystemThreadingTasksNamespace getSystemThreadingTasksNamespace() { any() }
-
 /** A class in the `System.Threading.Tasks` namespace. */
 class SystemThreadingTasksClass extends Class {
   SystemThreadingTasksClass() {
@@ -35,10 +31,6 @@ class SystemThreadingTasksTaskClass extends SystemThreadingTasksClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Threading.Tasks.Task` class. */
-deprecated
-SystemThreadingTasksTaskClass getSystemThreadingTasksTaskClass() { any() }
-
 /** The `System.Threading.Tasks.Task<T>` class. */
 class SystemThreadingTasksTaskTClass extends SystemThreadingTasksUnboundGenericClass {
   SystemThreadingTasksTaskTClass() {
@@ -54,7 +46,3 @@ class SystemThreadingTasksTaskTClass extends SystemThreadingTasksUnboundGenericC
     result.getType() = this.getTypeParameter(0)
   }
 }
-
-/** DEPRECATED. Gets the `System.Threading.Tasks.Task<T>` class. */
-deprecated
-SystemThreadingTasksTaskTClass getSystemThreadingTasksTaskTClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/Services.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/Services.qll
index 0f8da33e29df..21bc2c269ad6 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/Services.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/Services.qll
@@ -10,10 +10,6 @@ class SystemWebServicesNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Web.Services` namespace. */
-deprecated
-SystemWebServicesNamespace getSystemWebServicesNamespace() { any() }
-
 /** A class in the `System.Web.Services` namespace. */
 class SystemWebServicesClass extends Class {
   SystemWebServicesClass() {
@@ -27,7 +23,3 @@ class SystemWebServicesWebMethodAttributeClass extends SystemWebServicesClass {
     this.hasName("WebMethodAttribute")
   }
 }
-
-/** DEPRECATED. Gets the `System.Web.Services.WebMethodAttribute` class. */
-deprecated
-SystemWebServicesWebMethodAttributeClass getSystemWebServicesWebMethodAttributeClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/UI.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/UI.qll
index 82f814a38d24..ff1627e6b83a 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/UI.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/UI.qll
@@ -10,10 +10,6 @@ class SystemWebUINamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Web.UI` namespace. */
-deprecated
-SystemWebUINamespace getSystemWebUINamespace() { any() }
-
 /** A class in the `System.Web.UI` namespace. */
 class SystemWebUIClass extends Class {
   SystemWebUIClass() {
@@ -28,10 +24,6 @@ class SystemWebUIControlClass extends SystemWebUIClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.UI.Control` class. */
-deprecated
-SystemWebUIControlClass getSystemWebUIControlClass() { any() }
-
 /** The `System.Web.UI.Page` class. */
 class SystemWebUIPageClass extends SystemWebUIClass {
   SystemWebUIPageClass() {
@@ -75,10 +67,6 @@ class SystemWebUIPageClass extends SystemWebUIClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.UI.Page` class. */
-deprecated
-SystemWebUIPageClass getSystemWebUIPageClass() { any() }
-
 /** The `System.Web.UI.HtmlTextWriter` class. */
 class SystemWebUIHtmlTextWriterClass extends SystemWebUIClass {
   SystemWebUIHtmlTextWriterClass() {
@@ -116,10 +104,6 @@ class SystemWebUIHtmlTextWriterClass extends SystemWebUIClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.UI.HtmlTextWriter` class. */
-deprecated
-SystemWebUIHtmlTextWriterClass getSystemWebUIHtmlTextWriterClass() { any() }
-
 /** The `System.Web.UI.AttributeCollection` class. */
 class SystemWebUIAttributeCollectionClass extends SystemWebUIClass {
   SystemWebUIAttributeCollectionClass() {
@@ -139,10 +123,6 @@ class SystemWebUIAttributeCollectionClass extends SystemWebUIClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.UI.AttributeCollection` class. */
-deprecated
-SystemWebUIAttributeCollectionClass getSystemWebUIAttributeCollectionClass() { any() }
-
 /** The `System.Web.UI.ClientScriptManager` class. */
 class SystemWebUIClientScriptManagerClass extends SystemWebUIClass {
   SystemWebUIClientScriptManagerClass() {
@@ -161,7 +141,3 @@ class SystemWebUIClientScriptManagerClass extends SystemWebUIClass {
     result.hasName("RegisterClientScriptBlock")
   }
 }
-
-/** DEPRECATED. Gets the `System.UI.ClientScriptManager` class. */
-deprecated
-SystemWebUIClientScriptManagerClass getSystemWebUIClientScriptManagerClass() { any() }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/ui/WebControls.qll b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/ui/WebControls.qll
index 05a577dd4bd5..5dad4dc72bdd 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/system/web/ui/WebControls.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/system/web/ui/WebControls.qll
@@ -10,10 +10,6 @@ class SystemWebUIWebControlsNamespace extends Namespace {
   }
 }
 
-/** DEPRECATED. Gets the `System.Web.UI.WebControls` namespace. */
-deprecated
-SystemWebUIWebControlsNamespace getSystemWebUIWebControlsNamespace() { any() }
-
 /** A class in the `System.Web.UI.WebControls` namespace. */
 class SystemWebUIWebControlsClass extends Class {
   SystemWebUIWebControlsClass() {
@@ -37,10 +33,6 @@ class SystemWebUIWebControlsTextBoxClass extends SystemWebUIWebControlsClass {
   }
 }
 
-/** DEPRECATED. Gets the `System.Web.UI.WebControls.TextBox` class. */
-deprecated
-SystemWebUIWebControlsTextBoxClass getSystemWebUIWebControlsTextBoxClass() { any() }
-
 /** The `System.Web.UI.WebControls.Label` class. */
 class SystemWebUIWebControlsLabelClass extends SystemWebUIWebControlsClass {
   SystemWebUIWebControlsLabelClass() {
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/test/VisualStudio.qll b/csharp/ql/src/semmle/code/csharp/frameworks/test/VisualStudio.qll
index 062b6e584b21..9e73c73f0a06 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/test/VisualStudio.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/test/VisualStudio.qll
@@ -114,7 +114,3 @@ class AssertFailedExceptionClass extends ExceptionClass {
     this.hasName("AssertFailedException")
   }
 }
-
-/** DEPRECATED. Gets the `Microsoft.VisualStudio.TestTools.UnitTesting.Assert` class. */
-deprecated
-VSTestAssertClass getVSTestAssertClass() { any() }

From d595f20cb1971f3357e55881ab255646a52beb13 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Mon, 17 Dec 2018 15:29:10 +0000
Subject: [PATCH 32/69] JS: add to correctness-more suite

---
 javascript/config/suites/javascript/correctness-more | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/config/suites/javascript/correctness-more b/javascript/config/suites/javascript/correctness-more
index 2e57bcd7327b..540f88387b69 100644
--- a/javascript/config/suites/javascript/correctness-more
+++ b/javascript/config/suites/javascript/correctness-more
@@ -12,6 +12,7 @@
 + semmlecode-javascript-queries/LanguageFeatures/InconsistentNew.ql: /Correctness/Language Features
 + semmlecode-javascript-queries/LanguageFeatures/SpuriousArguments.ql: /Correctness/Language Features
 + semmlecode-javascript-queries/Statements/MisleadingIndentationAfterControlStmt.ql: /Correctness/Statements
++ semmlecode-javascript-queries/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/ReturnOutsideFunction.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/SuspiciousUnusedLoopIterationVariable.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/UselessConditional.ql: /Correctness/Statements

From e1c25c81f657a41789e4f385030deaafd13175e7 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Mon, 17 Dec 2018 16:34:18 +0000
Subject: [PATCH 33/69] JS: add change note

---
 change-notes/1.20/analysis-javascript.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index 14a4104c7ddc..f31fd00787e1 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -13,6 +13,7 @@
 | Double escaping or unescaping (`js/double-escaping`) | correctness, security, external/cwe/cwe-116 | Highlights potential double escaping or unescaping of special characters, indicating a possible violation of [CWE-116](https://cwe.mitre.org/data/definitions/116.html). Results are shown on LGTM by default. |
 | Incomplete URL substring sanitization | correctness, security, external/cwe/cwe-020 | Highlights URL sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results shown on LGTM by default. |
 | Incorrect suffix check (`js/incorrect-suffix-check`) | correctness, security, external/cwe/cwe-020 | Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
+| Missing index adjustment after concurrent modification (`js/missing-index-adjustment-after-concurrent-modification`) | correctness | Highlights code that removes an element from an array while iterating over it, causing the loop to skip over some elements. Results are shown on LGTM by default. |
 | Useless comparison test (`js/useless-comparison-test`) | correctness | Highlights code that is unreachable due to a numeric comparison that is always true or always false. Results are shown on LGTM by default. |
 
 ## Changes to existing queries

From edf1df1577312d4fb1ff6b7e7a8214f04a16c892 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Tue, 18 Dec 2018 10:43:12 +0100
Subject: [PATCH 34/69] C#: Remove tests for deprecated predicates

---
 .../ssa/DefAdjacentUncertainRead.expected     | 200 -----------
 .../dataflow/ssa/DefAdjacentUncertainRead.ql  |   5 -
 .../ssa/ReadAdjacentUncertainRead.expected    | 145 --------
 .../dataflow/ssa/ReadAdjacentUncertainRead.ql |   5 -
 .../ssa/SsaAdjacentUncertainRead.expected     | 334 ------------------
 .../dataflow/ssa/SsaAdjacentUncertainRead.ql  |   5 -
 6 files changed, 694 deletions(-)
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.expected
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.ql
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.expected
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.ql
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.expected
 delete mode 100644 csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.ql

diff --git a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.expected
deleted file mode 100644
index e710a6e870fb..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.expected
+++ /dev/null
@@ -1,200 +0,0 @@
-WARNING: Predicate getAFirstUncertainRead has been deprecated and may be removed in future (DefAdjacentUncertainRead.ql:4,18-40)
-| Capture.cs:6:16:6:16 | i | Capture.cs:6:16:6:16 | i | Capture.cs:8:17:8:17 | access to parameter i |
-| Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | ... = ... | Capture.cs:14:17:14:17 | access to parameter i |
-| Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | Int32 x = ... | Capture.cs:34:13:34:13 | access to local variable x |
-| Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | ... = ... | Capture.cs:16:17:16:17 | access to local variable x |
-| Capture.cs:8:13:8:13 | x | Capture.cs:43:9:43:13 | ... = ... | Capture.cs:44:11:44:11 | access to local variable x |
-| Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | Action a = ... | Capture.cs:38:9:38:9 | access to local variable a |
-| Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | Int32 y = ... | Capture.cs:26:17:26:17 | access to local variable y |
-| Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | Action b = ... | Capture.cs:25:13:25:13 | access to local variable b |
-| Capture.cs:29:13:29:13 | z | Capture.cs:29:13:29:17 | Int32 z = ... | Capture.cs:35:13:35:13 | access to local variable z |
-| Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | ... = ... | Capture.cs:41:13:41:13 | access to local variable z |
-| Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | Action c = ... | Capture.cs:32:9:32:9 | access to local variable c |
-| Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | a | Capture.cs:54:9:54:9 | access to parameter a |
-| Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | Action b = ... | Capture.cs:53:9:53:9 | access to local variable b |
-| Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | strings | Capture.cs:61:9:61:15 | access to parameter strings |
-| Capture.cs:59:13:59:13 | i | Capture.cs:59:13:59:17 | Int32 i = ... | Capture.cs:62:13:62:13 | access to local variable i |
-| Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | Func<String,Int32> e = ... | Capture.cs:61:24:61:24 | access to local variable e |
-| Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | strings | Capture.cs:68:18:68:24 | access to parameter strings |
-| Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | s | Capture.cs:68:37:68:37 | access to parameter s |
-| Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | s | Capture.cs:69:59:69:59 | access to parameter s |
-| Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | strings | Capture.cs:77:9:77:15 | access to parameter strings |
-| Capture.cs:75:13:75:13 | i | Capture.cs:75:13:75:17 | Int32 i = ... | Capture.cs:78:13:78:13 | access to local variable i |
-| Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | Expression<Func<String,Int32>> e = ... | Capture.cs:77:24:77:24 | access to local variable e |
-| Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | i | Capture.cs:81:34:81:34 | access to parameter i |
-| Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | strings | Capture.cs:87:9:87:15 | access to parameter strings |
-| Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | Expression<Func<String,Boolean>> e = ... | Capture.cs:87:23:87:23 | access to local variable e |
-| Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | d | Capture.cs:92:24:92:24 | access to parameter d |
-| Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | Int32 x = ... | Capture.cs:99:20:99:20 | access to local variable x |
-| Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | ... = ... | Capture.cs:106:20:106:20 | access to local variable z |
-| Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | Int32 x = ... | Capture.cs:118:17:118:17 | access to local variable x |
-| Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | ... = ... | Capture.cs:126:17:126:17 | access to local variable b |
-| Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | Int32 c = ... | Capture.cs:137:13:137:13 | access to local variable c |
-| Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | ... = ... | Capture.cs:134:17:134:17 | access to local variable c |
-| Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | Int32 d = ... | Capture.cs:145:13:145:13 | access to local variable d |
-| Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | Int32 f = ... | Capture.cs:155:13:155:13 | access to local variable f |
-| Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | ... = ... | Capture.cs:177:17:177:17 | access to local variable h |
-| Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | MyEventHandler eh = ... | Capture.cs:199:27:199:28 | access to local variable eh |
-| Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | MyEventHandler eh2 = ... | Capture.cs:204:27:204:29 | access to local variable eh2 |
-| Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | Process p = ... | Capture.cs:213:17:213:17 | access to local variable p |
-| Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | EventHandler exited = ... | Capture.cs:213:29:213:34 | access to local variable exited |
-| Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | ... = ... | Capture.cs:237:34:237:34 | access to local variable i |
-| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | b | Consistency.cs:11:17:11:17 | access to parameter b |
-| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | Int32 i = ... | Consistency.cs:16:17:16:17 | access to local variable i |
-| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | Consistency c | Consistency.cs:26:13:26:13 | access to local variable c |
-| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | ... = ... | Consistency.cs:33:9:33:9 | access to parameter c |
-| Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | ... = ... | Consistency.cs:39:39:39:39 | access to local variable i |
-| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | S s | Consistency.cs:45:9:45:9 | access to local variable s |
-| Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:47:49:47 | access to parameter a |
-| Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | i | Consistency.cs:49:49:49:49 | access to parameter i |
-| Consistency.cs:51:20:51:20 | a | Consistency.cs:51:20:51:20 | a | Consistency.cs:53:28:53:28 | access to parameter a |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:3:26:3:26 | w | DefUse.cs:9:13:9:13 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:19:13:19:18 | ... = ... | DefUse.cs:20:17:20:17 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:29:13:29:18 | ... = ... | DefUse.cs:35:13:35:13 | access to parameter w |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:5:13:5:17 | Int32 x = ... | DefUse.cs:11:13:11:13 | access to local variable x |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:6:14:6:19 | Int64 y = ... | DefUse.cs:8:13:8:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:13:13:13:18 | ... = ... | DefUse.cs:14:17:14:17 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:18:13:18:18 | ... = ... | DefUse.cs:23:13:23:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:28:13:28:18 | ... = ... | DefUse.cs:34:13:34:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:39:13:39:18 | ... = ... | DefUse.cs:42:13:42:13 | access to local variable y |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | Int32 z = ... | DefUse.cs:45:13:45:13 | access to local variable z |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | access to local variable z | DefUse.cs:48:13:48:13 | access to local variable z |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | access to local variable z | DefUse.cs:51:13:51:13 | access to local variable z |
-| DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | Int32 i = ... | DefUse.cs:61:13:61:13 | access to local variable i |
-| DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | ... = ... | DefUse.cs:72:9:72:9 | access to local variable i |
-| DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | ...++ | DefUse.cs:73:13:73:13 | access to local variable i |
-| DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | ... = ... | DefUse.cs:76:9:76:9 | access to local variable i |
-| DefUse.cs:59:13:59:13 | i | DefUse.cs:76:9:76:11 | ...-- | DefUse.cs:77:13:77:13 | access to local variable i |
-| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | TestClass tc = ... | DefUse.cs:68:9:68:10 | access to local variable tc |
-| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:79:13:79:18 | Int32 x1 = ... | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | access to local variable x1 | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | access to local variable x1 | DefUse.cs:81:13:81:14 | access to local variable x1 |
-| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | Int32 x2 = ... | DefUse.cs:85:15:85:16 | access to local variable x2 |
-| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | access to local variable x2 | DefUse.cs:87:13:87:14 | access to local variable x2 |
-| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:86:15:86:16 | access to local variable x2 | DefUse.cs:87:13:87:14 | access to local variable x2 |
-| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | Int32 x3 = ... | DefUse.cs:92:15:92:16 | access to local variable x3 |
-| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | access to local variable x3 | DefUse.cs:94:13:94:14 | access to local variable x3 |
-| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | access to local variable x4 | DefUse.cs:95:13:95:14 | access to local variable x4 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:97:13:97:18 | Int32 x5 = ... | DefUse.cs:98:16:98:17 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:101:13:101:23 | ... = ... | DefUse.cs:98:16:98:17 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:104:9:104:15 | ... = ... | DefUse.cs:105:13:105:14 | access to local variable x5 |
-| DefUse.cs:118:45:118:45 | i | DefUse.cs:118:45:118:45 | i | DefUse.cs:118:65:118:65 | access to parameter i |
-| DefUse.cs:120:17:120:21 | Field | DefUse.cs:53:9:53:17 | ... = ... | DefUse.cs:54:13:54:17 | access to field Field |
-| DefUse.cs:122:16:122:21 | Field2 | DefUse.cs:63:9:63:18 | ... = ... | DefUse.cs:64:13:64:18 | access to field Field2 |
-| DefUse.cs:124:16:124:21 | Field3 | DefUse.cs:66:9:66:18 | ... = ... | DefUse.cs:69:13:69:18 | access to field Field3 |
-| DefUse.cs:126:16:126:19 | Prop | DefUse.cs:56:9:56:16 | ... = ... | DefUse.cs:57:13:57:16 | access to property Prop |
-| DefUse.cs:128:19:128:19 | i | DefUse.cs:128:19:128:19 | i | DefUse.cs:129:19:129:19 | access to parameter i |
-| DefUse.cs:134:22:134:22 | d | DefUse.cs:134:22:134:22 | d | DefUse.cs:135:14:135:14 | access to parameter d |
-| DefUse.cs:142:68:142:69 | ie | DefUse.cs:142:68:142:69 | ie | DefUse.cs:144:27:144:28 | access to parameter ie |
-| DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | String x | DefUse.cs:146:17:146:17 | access to local variable x |
-| DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:155:9:155:18 | ... = ... | DefUse.cs:156:13:156:18 | access to field Field4 |
-| DefUse.cs:166:9:166:14 | Field5 | DefUse.cs:184:9:184:18 | ... = ... | DefUse.cs:185:13:185:18 | access to field Field5 |
-| DefUse.cs:166:9:166:14 | Field5 | DefUse.cs:188:13:188:22 | ... = ... | DefUse.cs:189:17:189:22 | access to field Field5 |
-| DefUse.cs:167:23:167:23 | i | DefUse.cs:167:23:167:23 | i | DefUse.cs:169:13:169:13 | access to parameter i |
-| DefUse.cs:167:23:167:23 | i | DefUse.cs:170:9:170:13 | ... = ... | DefUse.cs:182:13:182:13 | access to parameter i |
-| DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | ... = ... | DefUse.cs:174:17:174:17 | access to parameter i |
-| DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | Action a = ... | DefUse.cs:181:9:181:9 | access to local variable a |
-| DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | ... = ... | DefUse.cs:191:9:191:9 | access to local variable a |
-| Example.cs:4:9:4:13 | Field | Example.cs:8:9:8:22 | ... = ... | Example.cs:9:13:9:22 | access to field Field |
-| Example.cs:4:9:4:13 | Field | Example.cs:11:13:11:30 | ... = ... | Example.cs:14:13:14:22 | access to field Field |
-| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | i | Example.cs:8:22:8:22 | access to parameter i |
-| Example.cs:18:16:18:16 | p | Example.cs:18:16:18:16 | p | Example.cs:22:17:22:17 | access to parameter p |
-| Example.cs:18:16:18:16 | p | Example.cs:18:16:18:16 | p | Example.cs:25:13:25:13 | access to parameter p |
-| Example.cs:18:16:18:16 | p | Example.cs:23:13:23:17 | ... = ... | Example.cs:25:13:25:13 | access to parameter p |
-| Example.cs:18:24:18:24 | b | Example.cs:18:24:18:24 | b | Example.cs:20:13:20:13 | access to parameter b |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:24:9:24:23 | ... = ... | Fields.cs:25:13:25:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:42:9:42:23 | ... = ... | Fields.cs:44:13:44:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:45:9:45:25 | ... = ... | Fields.cs:46:13:46:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:80:9:80:25 | ... = ... | Fields.cs:82:19:82:22 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:83:9:83:25 | ... = ... | Fields.cs:85:19:85:22 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:85:9:85:22 | ... = ... | Fields.cs:86:9:86:15 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:87:9:87:22 | ... = ... | Fields.cs:89:9:89:15 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:88:9:88:25 | ... = ... | Fields.cs:90:19:90:22 | access to field xs |
-| Fields.cs:18:15:18:15 | x | Fields.cs:20:9:20:14 | ... = ... | Fields.cs:21:13:21:13 | access to local variable x |
-| Fields.cs:30:13:30:13 | f | Fields.cs:30:13:30:28 | Fields f = ... | Fields.cs:31:19:31:19 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:49:13:49:28 | ... = ... | Fields.cs:50:13:50:13 | access to local variable f |
-| Fields.cs:32:15:32:15 | z | Fields.cs:47:9:47:14 | ... = ... | Fields.cs:48:13:48:13 | access to local variable z |
-| Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | Fields f = ... | Fields.cs:80:9:80:9 | access to local variable f |
-| Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | Action a = ... | Fields.cs:81:9:81:9 | access to local variable a |
-| Fields.cs:79:23:79:23 | b | Fields.cs:79:23:79:35 | Action b = ... | Fields.cs:84:9:84:9 | access to local variable b |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:97:9:97:30 | ... = ... | Fields.cs:98:20:98:26 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:102:9:102:28 | ... = ... | Fields.cs:104:16:104:25 | access to field Field |
-| Fields.cs:95:19:95:19 | f | Fields.cs:95:19:95:19 | f | Fields.cs:97:9:97:9 | access to parameter f |
-| Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | f | Fields.cs:107:38:107:38 | access to parameter f |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:13:28:13:32 | access to field Field | OutRef.cs:15:13:15:17 | access to field Field |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:16:21:16:25 | access to field Field | OutRef.cs:17:13:17:17 | access to field Field |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:16:32:16:36 | access to field Field | OutRef.cs:17:13:17:17 | access to field Field |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:19:21:19:25 | access to field Field | OutRef.cs:20:13:20:17 | access to field Field |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:19:32:19:38 | access to field Field | OutRef.cs:21:13:21:19 | access to field Field |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | Int32 j = ... | OutRef.cs:10:32:10:32 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | access to local variable j | OutRef.cs:12:13:12:13 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | access to local variable j | OutRef.cs:23:13:23:13 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | access to local variable j | OutRef.cs:25:13:25:13 | access to local variable j |
-| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | Int32 i | OutRef.cs:11:13:11:13 | access to local variable i |
-| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | access to local variable i | OutRef.cs:14:13:14:13 | access to local variable i |
-| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | OutRef t = ... | OutRef.cs:19:32:19:32 | access to local variable t |
-| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | j | OutRef.cs:30:13:30:13 | access to parameter j |
-| OutRef.cs:34:38:34:38 | j | OutRef.cs:34:38:34:38 | j | OutRef.cs:36:13:36:13 | access to parameter j |
-| OutRef.cs:39:24:39:24 | b | OutRef.cs:39:24:39:24 | b | OutRef.cs:41:13:41:13 | access to parameter b |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:8:13:8:13 | access to local variable o |
-| Patterns.cs:8:22:8:23 | i1 | Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:10:38:10:39 | access to local variable i1 |
-| Patterns.cs:12:30:12:31 | s1 | Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:14:41:14:42 | access to local variable s1 |
-| Patterns.cs:24:22:24:23 | i2 | Patterns.cs:24:18:24:23 | Int32 i2 | Patterns.cs:24:30:24:31 | access to local variable i2 |
-| Patterns.cs:27:22:27:23 | i3 | Patterns.cs:27:18:27:23 | Int32 i3 | Patterns.cs:28:42:28:43 | access to local variable i3 |
-| Patterns.cs:30:25:30:26 | s2 | Patterns.cs:30:18:30:26 | String s2 | Patterns.cs:31:45:31:46 | access to local variable s2 |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:24:9:24:23 | ... = ... | Properties.cs:25:13:25:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:42:9:42:23 | ... = ... | Properties.cs:44:13:44:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:45:9:45:25 | ... = ... | Properties.cs:46:13:46:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:76:9:76:25 | ... = ... | Properties.cs:78:19:78:22 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:79:9:79:25 | ... = ... | Properties.cs:81:19:81:22 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:81:9:81:22 | ... = ... | Properties.cs:82:9:82:15 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:83:9:83:22 | ... = ... | Properties.cs:85:9:85:15 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:84:9:84:25 | ... = ... | Properties.cs:86:19:86:22 | access to property xs |
-| Properties.cs:18:15:18:15 | x | Properties.cs:20:9:20:14 | ... = ... | Properties.cs:21:13:21:13 | access to local variable x |
-| Properties.cs:30:13:30:13 | f | Properties.cs:30:13:30:32 | Properties f = ... | Properties.cs:31:19:31:19 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:49:13:49:32 | ... = ... | Properties.cs:50:13:50:13 | access to local variable f |
-| Properties.cs:32:15:32:15 | z | Properties.cs:47:9:47:14 | ... = ... | Properties.cs:48:13:48:13 | access to local variable z |
-| Properties.cs:61:23:61:23 | i | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:18 | ...-- | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | Properties f = ... | Properties.cs:76:9:76:9 | access to local variable f |
-| Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | Action a = ... | Properties.cs:77:9:77:9 | access to local variable a |
-| Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | Action b = ... | Properties.cs:80:9:80:9 | access to local variable b |
-| Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | p | Properties.cs:106:42:106:42 | access to parameter p |
-| Test.cs:3:9:3:13 | field | Test.cs:7:9:7:17 | ... = ... | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:3:9:3:13 | field | Test.cs:21:13:21:22 | ... = ... | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:3:9:3:13 | field | Test.cs:57:9:57:17 | ... = ... | Test.cs:58:13:58:17 | access to field field |
-| Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | param1 | Test.cs:11:13:11:18 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:27:17:27:24 | ...++ | Test.cs:27:17:27:22 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:27:17:27:24 | ...++ | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:41:13:41:23 | ... = ... | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:5:67:5:72 | param2 | Test.cs:5:67:5:72 | param2 | Test.cs:39:27:39:32 | access to parameter param2 |
-| Test.cs:8:13:8:13 | x | Test.cs:8:13:8:17 | Int32 x = ... | Test.cs:13:13:13:13 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:8:13:8:17 | Int32 x = ... | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:13:13:13:15 | ...++ | Test.cs:14:19:14:19 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:14:17:14:19 | ++... | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:36:13:36:18 | ... = ... | Test.cs:36:13:36:13 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:36:13:36:18 | ... = ... | Test.cs:43:16:43:16 | access to local variable x |
-| Test.cs:9:13:9:13 | y | Test.cs:14:13:14:19 | ... = ... | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:19:13:19:17 | ... = ... | Test.cs:20:13:20:13 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:20:13:20:18 | ... = ... | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:31:13:31:18 | ... = ... | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:10:13:10:13 | z | Test.cs:15:13:15:17 | ... = ... | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:10:13:10:13 | z | Test.cs:22:13:22:17 | ... = ... | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:34:18:34:18 | i | Test.cs:34:18:34:22 | Int32 i = ... | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:34:18:34:18 | i | Test.cs:34:33:34:35 | ...++ | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:39:22:39:22 | w | Test.cs:39:22:39:22 | Int32 w | Test.cs:41:23:41:23 | access to local variable w |
-| Test.cs:46:16:46:18 | in | Test.cs:46:16:46:18 | in | Test.cs:48:13:48:15 | access to parameter in |
-| Test.cs:68:45:68:45 | e | Test.cs:68:45:68:45 | DivideByZeroException e | Test.cs:70:17:70:17 | access to local variable e |
-| Tuples.cs:5:9:5:13 | Field | Tuples.cs:20:9:20:34 | ... = ... | Tuples.cs:22:13:22:17 | access to field Field |
-| Tuples.cs:5:9:5:13 | Field | Tuples.cs:26:9:26:33 | ... = ... | Tuples.cs:27:13:27:17 | access to field Field |
-| Tuples.cs:5:9:5:13 | Field | Tuples.cs:26:9:26:33 | ... = ... | Tuples.cs:28:13:28:19 | access to field Field |
-| Tuples.cs:6:9:6:16 | Property | Tuples.cs:20:9:20:34 | ... = ... | Tuples.cs:21:13:21:20 | access to property Property |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:10:9:10:54 | ... = ... | Tuples.cs:11:13:11:13 | access to local variable x |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:14:9:14:32 | ... = ... | Tuples.cs:15:13:15:13 | access to local variable x |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:23:9:23:37 | ... = ... | Tuples.cs:24:13:24:13 | access to local variable x |
-| Tuples.cs:10:23:10:23 | b | Tuples.cs:10:9:10:54 | ... = ... | Tuples.cs:12:13:12:13 | access to local variable b |
-| Tuples.cs:10:23:10:23 | b | Tuples.cs:14:9:14:32 | ... = ... | Tuples.cs:16:13:16:13 | access to local variable b |
-| Tuples.cs:10:33:10:33 | s | Tuples.cs:10:9:10:54 | ... = ... | Tuples.cs:13:13:13:13 | access to local variable s |
-| Tuples.cs:10:33:10:33 | s | Tuples.cs:14:9:14:32 | ... = ... | Tuples.cs:17:13:17:13 | access to local variable s |
-| Tuples.cs:18:40:18:44 | tuple | Tuples.cs:18:40:18:57 | (Int32,(Boolean,String)) tuple = ... | Tuples.cs:19:13:19:17 | access to local variable tuple |
-| Tuples.cs:25:13:25:13 | t | Tuples.cs:25:13:25:28 | Tuples t = ... | Tuples.cs:26:17:26:17 | access to local variable t |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.ql b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.ql
deleted file mode 100644
index 4953c57f3406..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentUncertainRead.ql
+++ /dev/null
@@ -1,5 +0,0 @@
-import csharp
-
-from AssignableDefinition def, AssignableRead read
-where read = def.getAFirstUncertainRead()
-select def.getTarget(), def, read
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.expected
deleted file mode 100644
index d6a74cb33d2b..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.expected
+++ /dev/null
@@ -1,145 +0,0 @@
-WARNING: Predicate getANextUncertainRead has been deprecated and may be removed in future (ReadAdjacentUncertainRead.ql:4,21-42)
-| Capture.cs:6:16:6:16 | i | Capture.cs:8:17:8:17 | access to parameter i | Capture.cs:33:13:33:13 | access to parameter i |
-| Capture.cs:6:16:6:16 | i | Capture.cs:33:13:33:13 | access to parameter i | Capture.cs:39:13:39:13 | access to parameter i |
-| Capture.cs:8:13:8:13 | x | Capture.cs:16:17:16:17 | access to local variable x | Capture.cs:17:21:17:21 | access to local variable x |
-| Capture.cs:8:13:8:13 | x | Capture.cs:34:13:34:13 | access to local variable x | Capture.cs:40:13:40:13 | access to local variable x |
-| Capture.cs:8:13:8:13 | x | Capture.cs:44:11:44:11 | access to local variable x | Capture.cs:45:13:45:13 | access to local variable x |
-| Capture.cs:8:13:8:13 | x | Capture.cs:45:13:45:13 | access to local variable x | Capture.cs:47:13:47:13 | access to local variable x |
-| Capture.cs:10:16:10:16 | a | Capture.cs:38:9:38:9 | access to local variable a | Capture.cs:46:12:46:12 | access to local variable a |
-| Capture.cs:65:45:65:51 | strings | Capture.cs:68:18:68:24 | access to parameter strings | Capture.cs:70:9:70:15 | access to parameter strings |
-| Consistency.cs:5:9:5:13 | Field | Consistency.cs:26:13:26:19 | access to field Field | Consistency.cs:27:13:27:19 | access to field Field |
-| Consistency.cs:25:29:25:29 | c | Consistency.cs:26:13:26:13 | access to local variable c | Consistency.cs:27:13:27:13 | access to local variable c |
-| Consistency.cs:44:11:44:11 | s | Consistency.cs:45:9:45:9 | access to local variable s | Consistency.cs:46:13:46:13 | access to local variable s |
-| Consistency.cs:51:20:51:20 | a | Consistency.cs:53:28:53:28 | access to parameter a | Consistency.cs:55:36:55:36 | access to parameter a |
-| Consistency.cs:51:20:51:20 | a | Consistency.cs:55:36:55:36 | access to parameter a | Consistency.cs:56:36:56:36 | access to parameter a |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:9:13:9:13 | access to parameter w | DefUse.cs:24:13:24:13 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:20:17:20:17 | access to parameter w | DefUse.cs:24:13:24:13 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:35:13:35:13 | access to parameter w | DefUse.cs:53:17:53:17 | access to parameter w |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:11:13:11:13 | access to local variable x | DefUse.cs:26:13:26:13 | access to local variable x |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:26:13:26:13 | access to local variable x | DefUse.cs:37:13:37:13 | access to local variable x |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:37:13:37:13 | access to local variable x | DefUse.cs:44:17:44:17 | access to local variable x |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:44:17:44:17 | access to local variable x | DefUse.cs:56:16:56:16 | access to local variable x |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:14:17:14:17 | access to local variable y | DefUse.cs:23:13:23:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:34:13:34:13 | access to local variable y | DefUse.cs:42:13:42:13 | access to local variable y |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:48:13:48:13 | access to local variable z | DefUse.cs:50:23:50:23 | access to local variable z |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | access to local variable x5 | DefUse.cs:100:17:100:18 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | access to local variable x5 | DefUse.cs:104:9:104:10 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:100:17:100:18 | access to local variable x5 | DefUse.cs:101:18:101:19 | access to local variable x5 |
-| DefUse.cs:122:16:122:21 | Field2 | DefUse.cs:64:13:64:18 | access to field Field2 | DefUse.cs:80:37:80:42 | access to field Field2 |
-| DefUse.cs:122:16:122:21 | Field2 | DefUse.cs:80:37:80:42 | access to field Field2 | DefUse.cs:80:37:80:42 | access to field Field2 |
-| DefUse.cs:144:22:144:22 | x | DefUse.cs:146:17:146:17 | access to local variable x | DefUse.cs:147:17:147:17 | access to local variable x |
-| DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:156:13:156:18 | access to field Field4 | DefUse.cs:157:13:157:18 | access to field Field4 |
-| DefUse.cs:152:9:152:14 | Field4 | DefUse.cs:162:13:162:18 | access to field Field4 | DefUse.cs:163:13:163:18 | access to field Field4 |
-| DefUse.cs:166:9:166:14 | Field5 | DefUse.cs:185:13:185:18 | access to field Field5 | DefUse.cs:192:13:192:18 | access to field Field5 |
-| DefUse.cs:167:23:167:23 | i | DefUse.cs:177:21:177:21 | access to parameter i | DefUse.cs:178:21:178:21 | access to parameter i |
-| Example.cs:4:9:4:13 | Field | Example.cs:9:13:9:22 | access to field Field | Example.cs:14:13:14:22 | access to field Field |
-| Example.cs:4:9:4:13 | Field | Example.cs:14:13:14:22 | access to field Field | Example.cs:15:13:15:22 | access to field Field |
-| Example.cs:6:23:6:23 | i | Example.cs:8:22:8:22 | access to parameter i | Example.cs:10:13:10:13 | access to parameter i |
-| Example.cs:6:23:6:23 | i | Example.cs:10:13:10:13 | access to parameter i | Example.cs:11:26:11:26 | access to parameter i |
-| Example.cs:6:23:6:23 | i | Example.cs:10:13:10:13 | access to parameter i | Example.cs:12:18:12:18 | access to parameter i |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:18:19:18:20 | access to field xs | Fields.cs:20:13:20:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:20:13:20:14 | access to field xs | Fields.cs:23:13:23:19 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:31:19:31:22 | access to field xs | Fields.cs:35:13:35:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:32:19:32:20 | access to field xs | Fields.cs:36:13:36:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:35:13:35:16 | access to field xs | Fields.cs:39:13:39:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:36:13:36:14 | access to field xs | Fields.cs:40:13:40:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:39:13:39:16 | access to field xs | Fields.cs:43:13:43:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:44:13:44:14 | access to field xs | Fields.cs:47:13:47:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:46:13:46:16 | access to field xs | Fields.cs:50:13:50:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:47:13:47:14 | access to field xs | Fields.cs:53:13:53:14 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:50:13:50:16 | access to field xs | Fields.cs:52:13:52:16 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:85:19:85:22 | access to field xs | Fields.cs:87:19:87:22 | access to field xs |
-| Fields.cs:5:18:5:19 | xs | Fields.cs:116:21:116:39 | access to field xs | Fields.cs:117:17:117:35 | access to field xs |
-| Fields.cs:6:25:6:28 | stat | Fields.cs:33:19:33:22 | access to field stat | Fields.cs:37:13:37:16 | access to field stat |
-| Fields.cs:6:25:6:28 | stat | Fields.cs:37:13:37:16 | access to field stat | Fields.cs:41:13:41:16 | access to field stat |
-| Fields.cs:6:25:6:28 | stat | Fields.cs:41:13:41:16 | access to field stat | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:30:13:30:13 | f | Fields.cs:31:19:31:19 | access to local variable f | Fields.cs:35:13:35:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:35:13:35:13 | access to local variable f | Fields.cs:38:9:38:9 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:38:9:38:9 | access to local variable f | Fields.cs:39:13:39:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:39:13:39:13 | access to local variable f | Fields.cs:43:13:43:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:43:13:43:13 | access to local variable f | Fields.cs:45:9:45:9 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:45:9:45:9 | access to local variable f | Fields.cs:46:13:46:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:46:13:46:13 | access to local variable f | Fields.cs:50:13:50:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:50:13:50:13 | access to local variable f | Fields.cs:52:13:52:13 | access to local variable f |
-| Fields.cs:57:9:57:17 | LoopField | Fields.cs:65:24:65:32 | access to field LoopField | Fields.cs:65:24:65:32 | access to field LoopField |
-| Fields.cs:77:13:77:13 | f | Fields.cs:80:9:80:9 | access to local variable f | Fields.cs:82:19:82:19 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:82:19:82:19 | access to local variable f | Fields.cs:83:9:83:9 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:83:9:83:9 | access to local variable f | Fields.cs:85:19:85:19 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:85:19:85:19 | access to local variable f | Fields.cs:87:19:87:19 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:87:19:87:19 | access to local variable f | Fields.cs:88:9:88:9 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:88:9:88:9 | access to local variable f | Fields.cs:90:19:90:19 | access to local variable f |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:98:20:98:26 | access to field Field | Fields.cs:99:16:99:22 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:98:20:98:32 | access to field Field | Fields.cs:99:16:99:28 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:99:16:99:22 | access to field Field | Fields.cs:100:16:100:22 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:99:16:99:28 | access to field Field | Fields.cs:100:16:100:28 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:99:16:99:34 | access to field Field | Fields.cs:100:16:100:34 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:100:16:100:22 | access to field Field | Fields.cs:101:16:101:22 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:100:16:100:28 | access to field Field | Fields.cs:101:16:101:28 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:100:16:100:34 | access to field Field | Fields.cs:101:16:101:34 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:100:16:100:40 | access to field Field | Fields.cs:101:16:101:40 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:101:16:101:22 | access to field Field | Fields.cs:102:22:102:28 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:115:20:115:29 | access to field Field | Fields.cs:116:21:116:30 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:115:20:115:35 | access to field Field | Fields.cs:116:21:116:36 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:116:21:116:30 | access to field Field | Fields.cs:117:17:117:26 | access to field Field |
-| Fields.cs:93:19:93:23 | Field | Fields.cs:116:21:116:36 | access to field Field | Fields.cs:117:17:117:32 | access to field Field |
-| Fields.cs:95:19:95:19 | f | Fields.cs:97:9:97:9 | access to parameter f | Fields.cs:98:20:98:20 | access to parameter f |
-| Fields.cs:95:19:95:19 | f | Fields.cs:98:20:98:20 | access to parameter f | Fields.cs:99:16:99:16 | access to parameter f |
-| Fields.cs:95:19:95:19 | f | Fields.cs:99:16:99:16 | access to parameter f | Fields.cs:100:16:100:16 | access to parameter f |
-| Fields.cs:95:19:95:19 | f | Fields.cs:100:16:100:16 | access to parameter f | Fields.cs:101:16:101:16 | access to parameter f |
-| Fields.cs:95:19:95:19 | f | Fields.cs:101:16:101:16 | access to parameter f | Fields.cs:102:22:102:22 | access to parameter f |
-| OutRef.cs:5:9:5:13 | Field | OutRef.cs:15:13:15:17 | access to field Field | OutRef.cs:16:32:16:36 | access to field Field |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:12:13:12:13 | access to local variable j | OutRef.cs:22:29:22:29 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:23:13:23:13 | access to local variable j | OutRef.cs:24:29:24:29 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | access to local variable j | OutRef.cs:25:13:25:13 | access to local variable j |
-| OutRef.cs:18:13:18:13 | t | OutRef.cs:19:32:19:32 | access to local variable t | OutRef.cs:21:13:21:13 | access to local variable t |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:12:18:12:18 | access to local variable o |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:20:17:20:17 | access to local variable o |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:16:18:16:18 | access to local variable o |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:20:17:20:17 | access to local variable o |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:20:17:20:17 | access to local variable o |
-| Patterns.cs:24:22:24:23 | i2 | Patterns.cs:24:30:24:31 | access to local variable i2 | Patterns.cs:25:47:25:48 | access to local variable i2 |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:18:19:18:20 | access to property xs | Properties.cs:20:13:20:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:20:13:20:14 | access to property xs | Properties.cs:23:13:23:19 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:31:19:31:22 | access to property xs | Properties.cs:35:13:35:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:32:19:32:20 | access to property xs | Properties.cs:36:13:36:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:35:13:35:16 | access to property xs | Properties.cs:39:13:39:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:36:13:36:14 | access to property xs | Properties.cs:40:13:40:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:39:13:39:16 | access to property xs | Properties.cs:43:13:43:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:44:13:44:14 | access to property xs | Properties.cs:47:13:47:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:46:13:46:16 | access to property xs | Properties.cs:50:13:50:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:47:13:47:14 | access to property xs | Properties.cs:53:13:53:14 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:50:13:50:16 | access to property xs | Properties.cs:52:13:52:16 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:81:19:81:22 | access to property xs | Properties.cs:83:19:83:22 | access to property xs |
-| Properties.cs:5:18:5:19 | xs | Properties.cs:115:21:115:39 | access to property xs | Properties.cs:116:17:116:35 | access to property xs |
-| Properties.cs:6:25:6:28 | stat | Properties.cs:33:19:33:22 | access to property stat | Properties.cs:37:13:37:16 | access to property stat |
-| Properties.cs:6:25:6:28 | stat | Properties.cs:37:13:37:16 | access to property stat | Properties.cs:41:13:41:16 | access to property stat |
-| Properties.cs:6:25:6:28 | stat | Properties.cs:41:13:41:16 | access to property stat | Properties.cs:54:13:54:16 | access to property stat |
-| Properties.cs:30:13:30:13 | f | Properties.cs:31:19:31:19 | access to local variable f | Properties.cs:35:13:35:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:35:13:35:13 | access to local variable f | Properties.cs:38:9:38:9 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:38:9:38:9 | access to local variable f | Properties.cs:39:13:39:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:39:13:39:13 | access to local variable f | Properties.cs:43:13:43:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:43:13:43:13 | access to local variable f | Properties.cs:45:9:45:9 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:45:9:45:9 | access to local variable f | Properties.cs:46:13:46:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:46:13:46:13 | access to local variable f | Properties.cs:50:13:50:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:50:13:50:13 | access to local variable f | Properties.cs:52:13:52:13 | access to local variable f |
-| Properties.cs:57:16:57:23 | LoopProp | Properties.cs:65:24:65:31 | access to property LoopProp | Properties.cs:65:24:65:31 | access to property LoopProp |
-| Properties.cs:73:13:73:13 | f | Properties.cs:76:9:76:9 | access to local variable f | Properties.cs:78:19:78:19 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:78:19:78:19 | access to local variable f | Properties.cs:79:9:79:9 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:79:9:79:9 | access to local variable f | Properties.cs:81:19:81:19 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:81:19:81:19 | access to local variable f | Properties.cs:83:19:83:19 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:83:19:83:19 | access to local variable f | Properties.cs:84:9:84:9 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:84:9:84:9 | access to local variable f | Properties.cs:86:19:86:19 | access to local variable f |
-| Properties.cs:104:16:104:20 | Props | Properties.cs:114:20:114:29 | access to field Props | Properties.cs:115:21:115:30 | access to field Props |
-| Properties.cs:104:16:104:20 | Props | Properties.cs:114:20:114:35 | access to field Props | Properties.cs:115:21:115:36 | access to field Props |
-| Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:30 | access to field Props | Properties.cs:116:17:116:26 | access to field Props |
-| Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:36 | access to field Props | Properties.cs:116:17:116:32 | access to field Props |
-| Test.cs:5:15:5:20 | param1 | Test.cs:11:13:11:18 | access to parameter param1 | Test.cs:27:17:27:22 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:11:13:11:18 | access to parameter param1 | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:8:13:8:13 | x | Test.cs:25:16:25:16 | access to local variable x | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:25:16:25:16 | access to local variable x | Test.cs:36:13:36:13 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:25:16:25:16 | access to local variable x | Test.cs:43:16:43:16 | access to local variable x |
-| Test.cs:9:13:9:13 | y | Test.cs:25:20:25:20 | access to local variable y | Test.cs:31:13:31:13 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:25:20:25:20 | access to local variable y | Test.cs:43:20:43:20 | access to local variable y |
-| Test.cs:34:18:34:18 | i | Test.cs:34:25:34:25 | access to local variable i | Test.cs:36:18:36:18 | access to local variable i |
-| Test.cs:34:18:34:18 | i | Test.cs:36:18:36:18 | access to local variable i | Test.cs:34:33:34:33 | access to local variable i |
-| Tuples.cs:25:13:25:13 | t | Tuples.cs:26:17:26:17 | access to local variable t | Tuples.cs:28:13:28:13 | access to local variable t |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.ql b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.ql
deleted file mode 100644
index 2e3040dbf57e..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentUncertainRead.ql
+++ /dev/null
@@ -1,5 +0,0 @@
-import csharp
-
-from AssignableRead read1, AssignableRead read2
-where read2 = read1.getANextUncertainRead()
-select read1.getTarget(), read1, read2
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.expected
deleted file mode 100644
index 0a37dac36d27..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.expected
+++ /dev/null
@@ -1,334 +0,0 @@
-WARNING: Predicate getAFirstUncertainRead has been deprecated and may be removed in future (SsaAdjacentUncertainRead.ql:4,18-40)
-| Capture.cs:6:16:6:16 | SSA param(i) | Capture.cs:8:17:8:17 | access to parameter i |
-| Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:34:13:34:13 | access to local variable x |
-| Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:38:9:38:9 | access to local variable a |
-| Capture.cs:10:20:27:9 | SSA capture def(i) | Capture.cs:12:17:12:17 | access to parameter i |
-| Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:14:17:14:17 | access to parameter i |
-| Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:16:17:16:17 | access to local variable x |
-| Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:26:17:26:17 | access to local variable y |
-| Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:25:13:25:13 | access to local variable b |
-| Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:21:21:21:21 | access to local variable x |
-| Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:22:21:22:21 | access to local variable y |
-| Capture.cs:29:13:29:17 | SSA def(z) | Capture.cs:35:13:35:13 | access to local variable z |
-| Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:32:9:32:9 | access to local variable c |
-| Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:35:13:35:13 | access to local variable z |
-| Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:41:13:41:13 | access to local variable z |
-| Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:39:13:39:13 | access to parameter i |
-| Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:40:13:40:13 | access to local variable x |
-| Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:44:11:44:11 | access to local variable x |
-| Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:45:13:45:13 | access to local variable x |
-| Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:54:9:54:9 | access to parameter a |
-| Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:53:9:53:9 | access to local variable b |
-| Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:54:9:54:9 | access to parameter a |
-| Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:61:9:61:15 | access to parameter strings |
-| Capture.cs:59:13:59:17 | SSA def(i) | Capture.cs:62:13:62:13 | access to local variable i |
-| Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:61:24:61:24 | access to local variable e |
-| Capture.cs:60:31:60:38 | SSA capture def(i) | Capture.cs:60:36:60:36 | access to local variable i |
-| Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:62:13:62:13 | access to local variable i |
-| Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:68:18:68:24 | access to parameter strings |
-| Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:37:68:37 | access to parameter s |
-| Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:48:68:48 | access to local variable c |
-| Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:69:48:69:48 | access to local variable c |
-| Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:59:69:59 | access to parameter s |
-| Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:77:9:77:15 | access to parameter strings |
-| Capture.cs:75:13:75:17 | SSA def(i) | Capture.cs:78:13:78:13 | access to local variable i |
-| Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:77:24:77:24 | access to local variable e |
-| Capture.cs:76:67:76:81 | SSA capture def(i) | Capture.cs:76:80:76:80 | access to local variable i |
-| Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:78:13:78:13 | access to local variable i |
-| Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:34:81:34 | access to parameter i |
-| Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:87:9:87:15 | access to parameter strings |
-| Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:87:23:87:23 | access to local variable e |
-| Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:86:73:86:73 | access to local variable b |
-| Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:24:92:24 | access to parameter d |
-| Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:98:21:98:21 | access to local variable y |
-| Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:99:20:99:20 | access to local variable x |
-| Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:106:20:106:20 | access to local variable z |
-| Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:117:21:117:21 | access to local variable a |
-| Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:118:17:118:17 | access to local variable x |
-| Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:126:17:126:17 | access to local variable b |
-| Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:137:13:137:13 | access to local variable c |
-| Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:134:17:134:17 | access to local variable c |
-| Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:137:13:137:13 | access to local variable c |
-| Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:145:13:145:13 | access to local variable d |
-| Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:145:13:145:13 | access to local variable d |
-| Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:150:17:150:17 | access to local variable e |
-| Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:155:13:155:13 | access to local variable f |
-| Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:165:17:165:17 | access to local variable g |
-| Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:177:17:177:17 | access to local variable h |
-| Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:177:17:177:17 | access to local variable h |
-| Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:185:21:185:21 | access to local variable i |
-| Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:199:27:199:28 | access to local variable eh |
-| Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:43:198:43 | access to local variable i |
-| Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:204:27:204:29 | access to local variable eh2 |
-| Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:44:203:44 | access to local variable i |
-| Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:213:17:213:17 | access to local variable p |
-| Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:213:29:213:34 | access to local variable exited |
-| Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:70:212:70 | access to local variable i |
-| Capture.cs:231:9:231:49 | SSA capture def(i) | Capture.cs:231:47:231:47 | access to local variable i |
-| Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:237:34:237:34 | access to local variable i |
-| Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:237:34:237:34 | access to local variable i |
-| Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:11:17:11:17 | access to parameter b |
-| Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i |
-| Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i |
-| Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:26:13:26:13 | access to local variable c |
-| Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:26:13:26:19 | access to field Field |
-| Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:33:9:33:9 | access to parameter c |
-| Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:39:39:39 | access to local variable i |
-| Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:45:9:45:9 | access to local variable s |
-| Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:47:49:47 | access to parameter a |
-| Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:49:49:49 | access to parameter i |
-| Consistency.cs:51:20:51:20 | SSA param(a) | Consistency.cs:53:28:53:28 | access to parameter a |
-| DefUse.cs:3:26:3:26 | SSA param(w) | DefUse.cs:9:13:9:13 | access to parameter w |
-| DefUse.cs:5:13:5:17 | SSA def(x) | DefUse.cs:11:13:11:13 | access to local variable x |
-| DefUse.cs:6:14:6:19 | SSA def(y) | DefUse.cs:8:13:8:13 | access to local variable y |
-| DefUse.cs:13:13:13:18 | SSA def(y) | DefUse.cs:14:17:14:17 | access to local variable y |
-| DefUse.cs:18:13:18:18 | SSA def(y) | DefUse.cs:23:13:23:13 | access to local variable y |
-| DefUse.cs:19:13:19:18 | SSA def(w) | DefUse.cs:20:17:20:17 | access to parameter w |
-| DefUse.cs:23:9:23:15 | SSA phi(w) | DefUse.cs:24:13:24:13 | access to parameter w |
-| DefUse.cs:23:9:23:15 | SSA phi(y) | DefUse.cs:23:13:23:13 | access to local variable y |
-| DefUse.cs:28:13:28:18 | SSA def(y) | DefUse.cs:34:13:34:13 | access to local variable y |
-| DefUse.cs:29:13:29:18 | SSA def(w) | DefUse.cs:35:13:35:13 | access to parameter w |
-| DefUse.cs:39:13:39:18 | SSA def(y) | DefUse.cs:42:13:42:13 | access to local variable y |
-| DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:42:13:42:13 | access to local variable y |
-| DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:45:13:45:13 | access to local variable z |
-| DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:48:13:48:13 | access to local variable z |
-| DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z |
-| DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:54:13:54:17 | access to field Field |
-| DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:57:13:57:16 | access to property Prop |
-| DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:61:13:61:13 | access to local variable i |
-| DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:64:13:64:18 | access to field Field2 |
-| DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:69:13:69:18 | access to field Field3 |
-| DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:68:9:68:10 | access to local variable tc |
-| DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:72:9:72:9 | access to local variable i |
-| DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:73:13:73:13 | access to local variable i |
-| DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:76:9:76:9 | access to local variable i |
-| DefUse.cs:76:9:76:11 | SSA def(i) | DefUse.cs:77:13:77:13 | access to local variable i |
-| DefUse.cs:79:13:79:18 | SSA def(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:80:16:80:46 | SSA phi(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:81:13:81:14 | access to local variable x1 |
-| DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:85:15:85:16 | access to local variable x2 |
-| DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:87:13:87:14 | access to local variable x2 |
-| DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:92:15:92:16 | access to local variable x3 |
-| DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:94:13:94:14 | access to local variable x3 |
-| DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:95:13:95:14 | access to local variable x4 |
-| DefUse.cs:97:13:97:18 | SSA def(x5) | DefUse.cs:98:16:98:17 | access to local variable x5 |
-| DefUse.cs:98:16:98:17 | SSA phi(x5) | DefUse.cs:98:16:98:17 | access to local variable x5 |
-| DefUse.cs:101:13:101:23 | SSA def(x5) | DefUse.cs:98:16:98:17 | access to local variable x5 |
-| DefUse.cs:104:9:104:15 | SSA def(x5) | DefUse.cs:105:13:105:14 | access to local variable x5 |
-| DefUse.cs:118:45:118:45 | SSA param(i) | DefUse.cs:118:65:118:65 | access to parameter i |
-| DefUse.cs:128:19:128:19 | SSA param(i) | DefUse.cs:129:19:129:19 | access to parameter i |
-| DefUse.cs:134:22:134:22 | SSA param(d) | DefUse.cs:135:14:135:14 | access to parameter d |
-| DefUse.cs:142:68:142:69 | SSA param(ie) | DefUse.cs:144:27:144:28 | access to parameter ie |
-| DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:146:17:146:17 | access to local variable x |
-| DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:156:13:156:18 | access to field Field4 |
-| DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:162:13:162:18 | access to field Field4 |
-| DefUse.cs:167:23:167:23 | SSA param(i) | DefUse.cs:169:13:169:13 | access to parameter i |
-| DefUse.cs:170:9:170:13 | SSA def(i) | DefUse.cs:182:13:182:13 | access to parameter i |
-| DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:181:9:181:9 | access to local variable a |
-| DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:174:17:174:17 | access to parameter i |
-| DefUse.cs:175:32:179:13 | SSA capture def(i) | DefUse.cs:177:21:177:21 | access to parameter i |
-| DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:182:13:182:13 | access to parameter i |
-| DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:185:13:185:18 | access to field Field5 |
-| DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:191:9:191:9 | access to local variable a |
-| DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:189:17:189:22 | access to field Field5 |
-| DefUse.cs:191:9:191:11 | SSA call def(this.Field5) | DefUse.cs:192:13:192:18 | access to field Field5 |
-| Example.cs:6:23:6:23 | SSA param(i) | Example.cs:8:22:8:22 | access to parameter i |
-| Example.cs:8:9:8:22 | SSA def(this.Field) | Example.cs:9:13:9:22 | access to field Field |
-| Example.cs:11:13:11:30 | SSA def(this.Field) | Example.cs:14:13:14:22 | access to field Field |
-| Example.cs:13:13:13:23 | SSA call def(this.Field) | Example.cs:14:13:14:22 | access to field Field |
-| Example.cs:14:9:14:24 | SSA phi(this.Field) | Example.cs:14:13:14:22 | access to field Field |
-| Example.cs:18:16:18:16 | SSA param(p) | Example.cs:22:17:22:17 | access to parameter p |
-| Example.cs:18:16:18:16 | SSA param(p) | Example.cs:25:13:25:13 | access to parameter p |
-| Example.cs:18:24:18:24 | SSA param(b) | Example.cs:20:13:20:13 | access to parameter b |
-| Example.cs:23:13:23:17 | SSA def(p) | Example.cs:25:13:25:13 | access to parameter p |
-| Example.cs:25:9:25:15 | SSA phi(p) | Example.cs:25:13:25:13 | access to parameter p |
-| Fields.cs:16:17:16:17 | SSA entry def(this.xs) | Fields.cs:18:19:18:20 | access to field xs |
-| Fields.cs:19:9:19:13 | SSA call def(this.xs) | Fields.cs:20:13:20:14 | access to field xs |
-| Fields.cs:20:9:20:14 | SSA def(x) | Fields.cs:21:13:21:13 | access to local variable x |
-| Fields.cs:22:13:22:17 | SSA call def(this.xs) | Fields.cs:23:13:23:19 | access to field xs |
-| Fields.cs:23:9:23:20 | SSA phi(this.xs) | Fields.cs:23:13:23:19 | access to field xs |
-| Fields.cs:24:9:24:23 | SSA def(this.xs) | Fields.cs:25:13:25:14 | access to field xs |
-| Fields.cs:28:17:28:17 | SSA entry def(Fields.stat) | Fields.cs:33:19:33:22 | access to field stat |
-| Fields.cs:28:17:28:17 | SSA entry def(this.xs) | Fields.cs:32:19:32:20 | access to field xs |
-| Fields.cs:30:13:30:28 | SSA def(f) | Fields.cs:31:19:31:19 | access to local variable f |
-| Fields.cs:30:13:30:28 | SSA qualifier def(f.xs) | Fields.cs:31:19:31:22 | access to field xs |
-| Fields.cs:30:17:30:28 | SSA call def(Fields.stat) | Fields.cs:33:19:33:22 | access to field stat |
-| Fields.cs:34:9:34:16 | SSA call def(Fields.stat) | Fields.cs:37:13:37:16 | access to field stat |
-| Fields.cs:34:9:34:16 | SSA call def(f.xs) | Fields.cs:35:13:35:16 | access to field xs |
-| Fields.cs:34:9:34:16 | SSA call def(this.xs) | Fields.cs:36:13:36:14 | access to field xs |
-| Fields.cs:38:9:38:13 | SSA call def(Fields.stat) | Fields.cs:41:13:41:16 | access to field stat |
-| Fields.cs:38:9:38:13 | SSA call def(f.xs) | Fields.cs:39:13:39:16 | access to field xs |
-| Fields.cs:38:9:38:13 | SSA call def(this.xs) | Fields.cs:40:13:40:14 | access to field xs |
-| Fields.cs:42:9:42:23 | SSA def(this.xs) | Fields.cs:44:13:44:14 | access to field xs |
-| Fields.cs:45:9:45:25 | SSA def(f.xs) | Fields.cs:46:13:46:16 | access to field xs |
-| Fields.cs:47:9:47:14 | SSA def(z) | Fields.cs:48:13:48:13 | access to local variable z |
-| Fields.cs:49:13:49:28 | SSA def(f) | Fields.cs:50:13:50:13 | access to local variable f |
-| Fields.cs:49:13:49:28 | SSA qualifier def(f.xs) | Fields.cs:50:13:50:16 | access to field xs |
-| Fields.cs:49:17:49:28 | SSA call def(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:50:9:50:17 | SSA phi(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:50:9:50:17 | SSA phi(f) | Fields.cs:50:13:50:13 | access to local variable f |
-| Fields.cs:50:9:50:17 | SSA phi(f.xs) | Fields.cs:50:13:50:16 | access to field xs |
-| Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:65:24:65:32 | access to field LoopField |
-| Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) | Fields.cs:63:16:63:28 | access to field VolatileField |
-| Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) | Fields.cs:69:21:69:33 | access to field VolatileField |
-| Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | access to field SingleAccessedField |
-| Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | access to field SingleAccessedField |
-| Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:80:9:80:9 | access to local variable f |
-| Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:81:9:81:9 | access to local variable a |
-| Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:35:78:35 | access to local variable f |
-| Fields.cs:79:23:79:35 | SSA def(b) | Fields.cs:84:9:84:9 | access to local variable b |
-| Fields.cs:80:9:80:25 | SSA def(f.xs) | Fields.cs:82:19:82:22 | access to field xs |
-| Fields.cs:81:9:81:11 | SSA call def(f.xs) | Fields.cs:82:19:82:22 | access to field xs |
-| Fields.cs:83:9:83:25 | SSA def(f.xs) | Fields.cs:85:19:85:22 | access to field xs |
-| Fields.cs:85:9:85:22 | SSA def(this.xs) | Fields.cs:86:9:86:15 | access to field xs |
-| Fields.cs:86:9:86:47 | SSA call def(f.xs) | Fields.cs:87:19:87:22 | access to field xs |
-| Fields.cs:86:24:86:46 | SSA capture def(a) | Fields.cs:86:31:86:31 | access to local variable a |
-| Fields.cs:87:9:87:22 | SSA def(this.xs) | Fields.cs:89:9:89:15 | access to field xs |
-| Fields.cs:88:9:88:25 | SSA def(f.xs) | Fields.cs:90:19:90:22 | access to field xs |
-| Fields.cs:89:24:89:46 | SSA capture def(b) | Fields.cs:89:31:89:31 | access to local variable b |
-| Fields.cs:95:19:95:19 | SSA param(f) | Fields.cs:97:9:97:9 | access to parameter f |
-| Fields.cs:97:9:97:30 | SSA def(f.Field) | Fields.cs:98:20:98:26 | access to field Field |
-| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) | Fields.cs:98:20:98:32 | access to field Field |
-| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) | Fields.cs:99:16:99:34 | access to field Field |
-| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field.Field) | Fields.cs:100:16:100:40 | access to field Field |
-| Fields.cs:102:9:102:28 | SSA def(this.Field) | Fields.cs:104:16:104:25 | access to field Field |
-| Fields.cs:107:33:107:33 | SSA param(f) | Fields.cs:107:38:107:38 | access to parameter f |
-| Fields.cs:109:10:109:10 | SSA entry def(this.Field) | Fields.cs:115:20:115:29 | access to field Field |
-| Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) | Fields.cs:115:20:115:35 | access to field Field |
-| Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) | Fields.cs:116:21:116:39 | access to field xs |
-| Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:115:20:115:29 | access to field Field |
-| Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:115:20:115:35 | access to field Field |
-| Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:116:21:116:39 | access to field xs |
-| OutRef.cs:7:10:7:10 | SSA entry def(this.Field) | OutRef.cs:13:28:13:32 | access to field Field |
-| OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:10:32:10:32 | access to local variable j |
-| OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:11:13:11:13 | access to local variable i |
-| OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:12:13:12:13 | access to local variable j |
-| OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:14:13:14:13 | access to local variable i |
-| OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:15:13:15:17 | access to field Field |
-| OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:17:13:17:17 | access to field Field |
-| OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:19:32:19:32 | access to local variable t |
-| OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:19:32:19:38 | access to field Field |
-| OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:20:13:20:17 | access to field Field |
-| OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:21:13:21:19 | access to field Field |
-| OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:23:13:23:13 | access to local variable j |
-| OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:25:13:25:13 | access to local variable j |
-| OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:30:13:30:13 | access to parameter j |
-| OutRef.cs:34:38:34:38 | SSA param(j) | OutRef.cs:36:13:36:13 | access to parameter j |
-| OutRef.cs:39:24:39:24 | SSA param(b) | OutRef.cs:41:13:41:13 | access to parameter b |
-| Patterns.cs:7:16:7:23 | SSA def(o) | Patterns.cs:8:13:8:13 | access to local variable o |
-| Patterns.cs:8:18:8:23 | SSA def(i1) | Patterns.cs:10:38:10:39 | access to local variable i1 |
-| Patterns.cs:12:23:12:31 | SSA def(s1) | Patterns.cs:14:41:14:42 | access to local variable s1 |
-| Patterns.cs:24:18:24:23 | SSA def(i2) | Patterns.cs:24:30:24:31 | access to local variable i2 |
-| Patterns.cs:27:18:27:23 | SSA def(i3) | Patterns.cs:28:42:28:43 | access to local variable i3 |
-| Patterns.cs:30:18:30:26 | SSA def(s2) | Patterns.cs:31:45:31:46 | access to local variable s2 |
-| Properties.cs:16:17:16:17 | SSA entry def(this.xs) | Properties.cs:18:19:18:20 | access to property xs |
-| Properties.cs:19:9:19:13 | SSA call def(this.xs) | Properties.cs:20:13:20:14 | access to property xs |
-| Properties.cs:20:9:20:14 | SSA def(x) | Properties.cs:21:13:21:13 | access to local variable x |
-| Properties.cs:22:13:22:17 | SSA call def(this.xs) | Properties.cs:23:13:23:19 | access to property xs |
-| Properties.cs:23:9:23:20 | SSA phi(this.xs) | Properties.cs:23:13:23:19 | access to property xs |
-| Properties.cs:24:9:24:23 | SSA def(this.xs) | Properties.cs:25:13:25:14 | access to property xs |
-| Properties.cs:28:17:28:17 | SSA entry def(Properties.stat) | Properties.cs:33:19:33:22 | access to property stat |
-| Properties.cs:28:17:28:17 | SSA entry def(this.xs) | Properties.cs:32:19:32:20 | access to property xs |
-| Properties.cs:30:13:30:32 | SSA def(f) | Properties.cs:31:19:31:19 | access to local variable f |
-| Properties.cs:30:13:30:32 | SSA qualifier def(f.xs) | Properties.cs:31:19:31:22 | access to property xs |
-| Properties.cs:30:17:30:32 | SSA call def(Properties.stat) | Properties.cs:33:19:33:22 | access to property stat |
-| Properties.cs:34:9:34:16 | SSA call def(Properties.stat) | Properties.cs:37:13:37:16 | access to property stat |
-| Properties.cs:34:9:34:16 | SSA call def(f.xs) | Properties.cs:35:13:35:16 | access to property xs |
-| Properties.cs:34:9:34:16 | SSA call def(this.xs) | Properties.cs:36:13:36:14 | access to property xs |
-| Properties.cs:38:9:38:13 | SSA call def(Properties.stat) | Properties.cs:41:13:41:16 | access to property stat |
-| Properties.cs:38:9:38:13 | SSA call def(f.xs) | Properties.cs:39:13:39:16 | access to property xs |
-| Properties.cs:38:9:38:13 | SSA call def(this.xs) | Properties.cs:40:13:40:14 | access to property xs |
-| Properties.cs:42:9:42:23 | SSA def(this.xs) | Properties.cs:44:13:44:14 | access to property xs |
-| Properties.cs:45:9:45:25 | SSA def(f.xs) | Properties.cs:46:13:46:16 | access to property xs |
-| Properties.cs:47:9:47:14 | SSA def(z) | Properties.cs:48:13:48:13 | access to local variable z |
-| Properties.cs:49:13:49:32 | SSA def(f) | Properties.cs:50:13:50:13 | access to local variable f |
-| Properties.cs:49:13:49:32 | SSA qualifier def(f.xs) | Properties.cs:50:13:50:16 | access to property xs |
-| Properties.cs:49:17:49:32 | SSA call def(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
-| Properties.cs:50:9:50:17 | SSA phi(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
-| Properties.cs:50:9:50:17 | SSA phi(f) | Properties.cs:50:13:50:13 | access to local variable f |
-| Properties.cs:50:9:50:17 | SSA phi(f.xs) | Properties.cs:50:13:50:16 | access to property xs |
-| Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
-| Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:65:24:65:31 | access to property LoopProp |
-| Properties.cs:61:23:61:23 | SSA param(i) | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:63:16:63:18 | SSA def(i) | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | access to property SingleAccessedProp |
-| Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | access to property SingleAccessedProp |
-| Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:76:9:76:9 | access to local variable f |
-| Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:77:9:77:9 | access to local variable a |
-| Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:35:74:35 | access to local variable f |
-| Properties.cs:75:23:75:35 | SSA def(b) | Properties.cs:80:9:80:9 | access to local variable b |
-| Properties.cs:76:9:76:25 | SSA def(f.xs) | Properties.cs:78:19:78:22 | access to property xs |
-| Properties.cs:77:9:77:11 | SSA call def(f.xs) | Properties.cs:78:19:78:22 | access to property xs |
-| Properties.cs:79:9:79:25 | SSA def(f.xs) | Properties.cs:81:19:81:22 | access to property xs |
-| Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:82:9:82:15 | access to property xs |
-| Properties.cs:82:9:82:47 | SSA call def(f.xs) | Properties.cs:83:19:83:22 | access to property xs |
-| Properties.cs:82:24:82:46 | SSA capture def(a) | Properties.cs:82:31:82:31 | access to local variable a |
-| Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:85:9:85:15 | access to property xs |
-| Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:86:19:86:22 | access to property xs |
-| Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:31:85:31 | access to local variable b |
-| Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) | Properties.cs:95:20:95:38 | access to property NonTrivialProp |
-| Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) | Properties.cs:98:16:98:31 | access to property VirtualProp |
-| Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) | Properties.cs:100:9:100:26 | access to field VolatileField |
-| Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) | Properties.cs:101:21:101:38 | access to field VolatileField |
-| Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) | Properties.cs:101:21:101:41 | access to property xs |
-| Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:42:106:42 | access to parameter p |
-| Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:114:20:114:29 | access to field Props |
-| Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) | Properties.cs:114:20:114:35 | access to field Props |
-| Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) | Properties.cs:115:21:115:39 | access to property xs |
-| Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:114:20:114:29 | access to field Props |
-| Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:114:20:114:35 | access to field Props |
-| Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:115:21:115:39 | access to property xs |
-| Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:11:13:11:18 | access to parameter param1 |
-| Test.cs:5:67:5:72 | SSA param(param2) | Test.cs:39:27:39:32 | access to parameter param2 |
-| Test.cs:7:9:7:17 | SSA def(this.field) | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:8:13:8:17 | SSA def(x) | Test.cs:13:13:13:13 | access to local variable x |
-| Test.cs:8:13:8:17 | SSA def(x) | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:13:13:13:15 | SSA def(x) | Test.cs:14:19:14:19 | access to local variable x |
-| Test.cs:14:13:14:19 | SSA def(y) | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:14:17:14:19 | SSA def(x) | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:15:13:15:17 | SSA def(z) | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:19:13:19:17 | SSA def(y) | Test.cs:20:13:20:13 | access to local variable y |
-| Test.cs:20:13:20:18 | SSA def(y) | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:21:13:21:22 | SSA def(this.field) | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:22:13:22:17 | SSA def(z) | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:24:9:24:15 | SSA phi(this.field) | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:24:9:24:15 | SSA phi(x) | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:24:9:24:15 | SSA phi(y) | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:24:9:24:15 | SSA phi(z) | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:22 | access to parameter param1 |
-| Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:25:16:25:16 | SSA phi(y) | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:27:17:27:24 | SSA def(param1) | Test.cs:27:17:27:22 | access to parameter param1 |
-| Test.cs:27:17:27:24 | SSA def(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:31:13:31:18 | SSA def(y) | Test.cs:25:20:25:20 | access to local variable y |
-| Test.cs:33:9:33:19 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:34:18:34:22 | SSA def(i) | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:34:25:34:25 | SSA phi(i) | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:34:25:34:25 | SSA phi(x) | Test.cs:36:13:36:13 | access to local variable x |
-| Test.cs:34:25:34:25 | SSA phi(x) | Test.cs:43:16:43:16 | access to local variable x |
-| Test.cs:34:33:34:35 | SSA def(i) | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:36:13:36:18 | SSA def(x) | Test.cs:36:13:36:13 | access to local variable x |
-| Test.cs:36:13:36:18 | SSA def(x) | Test.cs:43:16:43:16 | access to local variable x |
-| Test.cs:39:9:42:9 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:39:22:39:22 | SSA def(w) | Test.cs:41:23:41:23 | access to local variable w |
-| Test.cs:41:13:41:23 | SSA def(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:46:10:46:10 | SSA entry def(this.field) | Test.cs:56:13:56:17 | access to field field |
-| Test.cs:46:16:46:18 | SSA param(in) | Test.cs:48:13:48:15 | access to parameter in |
-| Test.cs:57:9:57:17 | SSA def(this.field) | Test.cs:58:13:58:17 | access to field field |
-| Test.cs:68:45:68:45 | [exception: DivideByZeroException] SSA def(e) | Test.cs:70:17:70:17 | access to local variable e |
-| Tuples.cs:10:9:10:54 | SSA def(b) | Tuples.cs:12:13:12:13 | access to local variable b |
-| Tuples.cs:10:9:10:54 | SSA def(s) | Tuples.cs:13:13:13:13 | access to local variable s |
-| Tuples.cs:10:9:10:54 | SSA def(x) | Tuples.cs:11:13:11:13 | access to local variable x |
-| Tuples.cs:14:9:14:32 | SSA def(b) | Tuples.cs:16:13:16:13 | access to local variable b |
-| Tuples.cs:14:9:14:32 | SSA def(s) | Tuples.cs:17:13:17:13 | access to local variable s |
-| Tuples.cs:14:9:14:32 | SSA def(x) | Tuples.cs:15:13:15:13 | access to local variable x |
-| Tuples.cs:18:40:18:57 | SSA def(tuple) | Tuples.cs:19:13:19:17 | access to local variable tuple |
-| Tuples.cs:20:9:20:34 | SSA def(this.Field) | Tuples.cs:22:13:22:17 | access to field Field |
-| Tuples.cs:20:9:20:34 | SSA def(this.Property) | Tuples.cs:21:13:21:20 | access to property Property |
-| Tuples.cs:23:9:23:37 | SSA def(x) | Tuples.cs:24:13:24:13 | access to local variable x |
-| Tuples.cs:25:13:25:28 | SSA def(t) | Tuples.cs:26:17:26:17 | access to local variable t |
-| Tuples.cs:26:9:26:33 | SSA def(t.Field) | Tuples.cs:28:13:28:19 | access to field Field |
-| Tuples.cs:26:9:26:33 | SSA def(this.Field) | Tuples.cs:27:13:27:17 | access to field Field |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.ql b/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.ql
deleted file mode 100644
index ebbd1561b1d0..000000000000
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaAdjacentUncertainRead.ql
+++ /dev/null
@@ -1,5 +0,0 @@
-import csharp
-
-from Ssa::Definition def, AssignableRead read
-where read = def.getAFirstUncertainRead()
-select def, read

From c17eca90a164f29f619ec6c24364a4a741aab0cc Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 18 Dec 2018 12:29:31 +0000
Subject: [PATCH 35/69] JS: add test case for $(location)

---
 .../Security/CWE-079/StoredXss.expected       | 18 +++++++++++++
 .../query-tests/Security/CWE-079/Xss.expected | 27 +++++++++++++++++++
 .../test/query-tests/Security/CWE-079/tst.js  | 12 +++++++++
 3 files changed, 57 insertions(+)

diff --git a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
index c4813758503c..6832a9b88b98 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
@@ -214,6 +214,18 @@ nodes
 | tst.js:256:7:256:17 | window.name |
 | tst.js:257:7:257:10 | name |
 | tst.js:261:11:261:21 | window.name |
+| tst.js:267:7:267:14 | location |
+| tst.js:268:7:268:21 | window.location |
+| tst.js:269:7:269:23 | document.location |
+| tst.js:270:9:270:23 | loc1 |
+| tst.js:270:16:270:23 | location |
+| tst.js:271:9:271:30 | loc2 |
+| tst.js:271:16:271:30 | window.location |
+| tst.js:272:9:272:32 | loc3 |
+| tst.js:272:16:272:32 | document.location |
+| tst.js:273:7:273:10 | loc1 |
+| tst.js:274:7:274:10 | loc2 |
+| tst.js:275:7:275:10 | loc3 |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
 | winjs.js:2:17:2:40 | documen ... .search |
@@ -396,6 +408,12 @@ edges
 | tst.js:238:23:238:29 | tainted | tst.js:228:32:228:49 | prevProps.tainted4 |
 | tst.js:244:39:244:55 | props.propTainted | tst.js:248:60:248:82 | this.st ... Tainted |
 | tst.js:252:23:252:29 | tainted | tst.js:244:39:244:55 | props.propTainted |
+| tst.js:270:9:270:23 | loc1 | tst.js:273:7:273:10 | loc1 |
+| tst.js:270:16:270:23 | location | tst.js:270:9:270:23 | loc1 |
+| tst.js:271:9:271:30 | loc2 | tst.js:274:7:274:10 | loc2 |
+| tst.js:271:16:271:30 | window.location | tst.js:271:9:271:30 | loc2 |
+| tst.js:272:9:272:32 | loc3 | tst.js:275:7:275:10 | loc3 |
+| tst.js:272:16:272:32 | document.location | tst.js:272:9:272:32 | loc3 |
 | winjs.js:2:7:2:53 | tainted | winjs.js:3:43:3:49 | tainted |
 | winjs.js:2:7:2:53 | tainted | winjs.js:4:43:4:49 | tainted |
 | winjs.js:2:17:2:33 | document.location | winjs.js:2:17:2:40 | documen ... .search |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
index 36771ee86ac2..01293c7daf0a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
@@ -171,6 +171,18 @@ nodes
 | tst.js:256:7:256:17 | window.name |
 | tst.js:257:7:257:10 | name |
 | tst.js:261:11:261:21 | window.name |
+| tst.js:267:7:267:14 | location |
+| tst.js:268:7:268:21 | window.location |
+| tst.js:269:7:269:23 | document.location |
+| tst.js:270:9:270:23 | loc1 |
+| tst.js:270:16:270:23 | location |
+| tst.js:271:9:271:30 | loc2 |
+| tst.js:271:16:271:30 | window.location |
+| tst.js:272:9:272:32 | loc3 |
+| tst.js:272:16:272:32 | document.location |
+| tst.js:273:7:273:10 | loc1 |
+| tst.js:274:7:274:10 | loc2 |
+| tst.js:275:7:275:10 | loc3 |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
 | winjs.js:2:17:2:40 | documen ... .search |
@@ -307,6 +319,12 @@ edges
 | tst.js:238:23:238:29 | tainted | tst.js:228:32:228:49 | prevProps.tainted4 |
 | tst.js:244:39:244:55 | props.propTainted | tst.js:248:60:248:82 | this.st ... Tainted |
 | tst.js:252:23:252:29 | tainted | tst.js:244:39:244:55 | props.propTainted |
+| tst.js:270:9:270:23 | loc1 | tst.js:273:7:273:10 | loc1 |
+| tst.js:270:16:270:23 | location | tst.js:270:9:270:23 | loc1 |
+| tst.js:271:9:271:30 | loc2 | tst.js:274:7:274:10 | loc2 |
+| tst.js:271:16:271:30 | window.location | tst.js:271:9:271:30 | loc2 |
+| tst.js:272:9:272:32 | loc3 | tst.js:275:7:275:10 | loc3 |
+| tst.js:272:16:272:32 | document.location | tst.js:272:9:272:32 | loc3 |
 | winjs.js:2:7:2:53 | tainted | winjs.js:3:43:3:49 | tainted |
 | winjs.js:2:7:2:53 | tainted | winjs.js:4:43:4:49 | tainted |
 | winjs.js:2:17:2:33 | document.location | winjs.js:2:17:2:40 | documen ... .search |
@@ -378,5 +396,14 @@ edges
 | tst.js:256:7:256:17 | window.name | tst.js:256:7:256:17 | window.name | tst.js:256:7:256:17 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:256:7:256:17 | window.name | user-provided value |
 | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | Cross-site scripting vulnerability due to $@. | tst.js:257:7:257:10 | name | user-provided value |
 | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:261:11:261:21 | window.name | user-provided value |
+| tst.js:267:7:267:14 | location | tst.js:267:7:267:14 | location | tst.js:267:7:267:14 | location | Cross-site scripting vulnerability due to $@. | tst.js:267:7:267:14 | location | user-provided value |
+| tst.js:268:7:268:21 | window.location | tst.js:268:7:268:21 | window.location | tst.js:268:7:268:21 | window.location | Cross-site scripting vulnerability due to $@. | tst.js:268:7:268:21 | window.location | user-provided value |
+| tst.js:269:7:269:23 | document.location | tst.js:269:7:269:23 | document.location | tst.js:269:7:269:23 | document.location | Cross-site scripting vulnerability due to $@. | tst.js:269:7:269:23 | document.location | user-provided value |
+| tst.js:273:7:273:10 | loc1 | tst.js:270:16:270:23 | location | tst.js:273:7:273:10 | loc1 | Cross-site scripting vulnerability due to $@. | tst.js:270:16:270:23 | location | user-provided value |
+| tst.js:273:7:273:10 | loc1 | tst.js:273:7:273:10 | loc1 | tst.js:273:7:273:10 | loc1 | Cross-site scripting vulnerability due to $@. | tst.js:273:7:273:10 | loc1 | user-provided value |
+| tst.js:274:7:274:10 | loc2 | tst.js:271:16:271:30 | window.location | tst.js:274:7:274:10 | loc2 | Cross-site scripting vulnerability due to $@. | tst.js:271:16:271:30 | window.location | user-provided value |
+| tst.js:274:7:274:10 | loc2 | tst.js:274:7:274:10 | loc2 | tst.js:274:7:274:10 | loc2 | Cross-site scripting vulnerability due to $@. | tst.js:274:7:274:10 | loc2 | user-provided value |
+| tst.js:275:7:275:10 | loc3 | tst.js:272:16:272:32 | document.location | tst.js:275:7:275:10 | loc3 | Cross-site scripting vulnerability due to $@. | tst.js:272:16:272:32 | document.location | user-provided value |
+| tst.js:275:7:275:10 | loc3 | tst.js:275:7:275:10 | loc3 | tst.js:275:7:275:10 | loc3 | Cross-site scripting vulnerability due to $@. | tst.js:275:7:275:10 | loc3 | user-provided value |
 | winjs.js:3:43:3:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:3:43:3:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
 | winjs.js:4:43:4:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:4:43:4:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/tst.js b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
index cab08a0d925e..e91fcb278e5d 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
@@ -262,3 +262,15 @@ function windowNameAssigned() {
         $(name); // OK
     }
 }
+
+function jqueryLocation() {
+    $(location); // OK
+    $(window.location); // OK
+    $(document.location); // OK
+    var loc1 = location;
+    var loc2 = window.location;
+    var loc3 = document.location;
+    $(loc1); // OK
+    $(loc2); // OK
+    $(loc3); // OK
+}

From 02978c97f1784958bba5518fe3cfaeabe3bc60d3 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 18 Dec 2018 13:01:22 +0000
Subject: [PATCH 36/69] JS: whitelist $(location) in simple cases

---
 .../security/dataflow/DomBasedXss.qll         |  3 ++-
 .../Security/CWE-079/StoredXss.expected       | 13 ------------
 .../query-tests/Security/CWE-079/Xss.expected | 21 -------------------
 .../test/query-tests/Security/CWE-079/tst.js  |  2 +-
 4 files changed, 3 insertions(+), 36 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/DomBasedXss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/DomBasedXss.qll
index 7a935196ce0b..6e7635821ccd 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/DomBasedXss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/DomBasedXss.qll
@@ -91,7 +91,8 @@ module DomBasedXss {
           isPrefixOfJQueryHtmlString(astNode, prefix) and
           strval = prefix.asExpr().getStringValue() and
           not strval.regexpMatch("\\s*<.*")
-        )
+        ) and
+        not isDocumentURL(astNode)
       )
       or
       // call to an Angular method that interprets its argument as HTML
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
index 6832a9b88b98..ed5dfaa34a86 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
@@ -214,17 +214,8 @@ nodes
 | tst.js:256:7:256:17 | window.name |
 | tst.js:257:7:257:10 | name |
 | tst.js:261:11:261:21 | window.name |
-| tst.js:267:7:267:14 | location |
-| tst.js:268:7:268:21 | window.location |
-| tst.js:269:7:269:23 | document.location |
-| tst.js:270:9:270:23 | loc1 |
-| tst.js:270:16:270:23 | location |
-| tst.js:271:9:271:30 | loc2 |
-| tst.js:271:16:271:30 | window.location |
 | tst.js:272:9:272:32 | loc3 |
 | tst.js:272:16:272:32 | document.location |
-| tst.js:273:7:273:10 | loc1 |
-| tst.js:274:7:274:10 | loc2 |
 | tst.js:275:7:275:10 | loc3 |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
@@ -408,10 +399,6 @@ edges
 | tst.js:238:23:238:29 | tainted | tst.js:228:32:228:49 | prevProps.tainted4 |
 | tst.js:244:39:244:55 | props.propTainted | tst.js:248:60:248:82 | this.st ... Tainted |
 | tst.js:252:23:252:29 | tainted | tst.js:244:39:244:55 | props.propTainted |
-| tst.js:270:9:270:23 | loc1 | tst.js:273:7:273:10 | loc1 |
-| tst.js:270:16:270:23 | location | tst.js:270:9:270:23 | loc1 |
-| tst.js:271:9:271:30 | loc2 | tst.js:274:7:274:10 | loc2 |
-| tst.js:271:16:271:30 | window.location | tst.js:271:9:271:30 | loc2 |
 | tst.js:272:9:272:32 | loc3 | tst.js:275:7:275:10 | loc3 |
 | tst.js:272:16:272:32 | document.location | tst.js:272:9:272:32 | loc3 |
 | winjs.js:2:7:2:53 | tainted | winjs.js:3:43:3:49 | tainted |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
index 01293c7daf0a..37800a8962a0 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
@@ -171,17 +171,8 @@ nodes
 | tst.js:256:7:256:17 | window.name |
 | tst.js:257:7:257:10 | name |
 | tst.js:261:11:261:21 | window.name |
-| tst.js:267:7:267:14 | location |
-| tst.js:268:7:268:21 | window.location |
-| tst.js:269:7:269:23 | document.location |
-| tst.js:270:9:270:23 | loc1 |
-| tst.js:270:16:270:23 | location |
-| tst.js:271:9:271:30 | loc2 |
-| tst.js:271:16:271:30 | window.location |
 | tst.js:272:9:272:32 | loc3 |
 | tst.js:272:16:272:32 | document.location |
-| tst.js:273:7:273:10 | loc1 |
-| tst.js:274:7:274:10 | loc2 |
 | tst.js:275:7:275:10 | loc3 |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
@@ -319,10 +310,6 @@ edges
 | tst.js:238:23:238:29 | tainted | tst.js:228:32:228:49 | prevProps.tainted4 |
 | tst.js:244:39:244:55 | props.propTainted | tst.js:248:60:248:82 | this.st ... Tainted |
 | tst.js:252:23:252:29 | tainted | tst.js:244:39:244:55 | props.propTainted |
-| tst.js:270:9:270:23 | loc1 | tst.js:273:7:273:10 | loc1 |
-| tst.js:270:16:270:23 | location | tst.js:270:9:270:23 | loc1 |
-| tst.js:271:9:271:30 | loc2 | tst.js:274:7:274:10 | loc2 |
-| tst.js:271:16:271:30 | window.location | tst.js:271:9:271:30 | loc2 |
 | tst.js:272:9:272:32 | loc3 | tst.js:275:7:275:10 | loc3 |
 | tst.js:272:16:272:32 | document.location | tst.js:272:9:272:32 | loc3 |
 | winjs.js:2:7:2:53 | tainted | winjs.js:3:43:3:49 | tainted |
@@ -396,14 +383,6 @@ edges
 | tst.js:256:7:256:17 | window.name | tst.js:256:7:256:17 | window.name | tst.js:256:7:256:17 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:256:7:256:17 | window.name | user-provided value |
 | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | Cross-site scripting vulnerability due to $@. | tst.js:257:7:257:10 | name | user-provided value |
 | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:261:11:261:21 | window.name | user-provided value |
-| tst.js:267:7:267:14 | location | tst.js:267:7:267:14 | location | tst.js:267:7:267:14 | location | Cross-site scripting vulnerability due to $@. | tst.js:267:7:267:14 | location | user-provided value |
-| tst.js:268:7:268:21 | window.location | tst.js:268:7:268:21 | window.location | tst.js:268:7:268:21 | window.location | Cross-site scripting vulnerability due to $@. | tst.js:268:7:268:21 | window.location | user-provided value |
-| tst.js:269:7:269:23 | document.location | tst.js:269:7:269:23 | document.location | tst.js:269:7:269:23 | document.location | Cross-site scripting vulnerability due to $@. | tst.js:269:7:269:23 | document.location | user-provided value |
-| tst.js:273:7:273:10 | loc1 | tst.js:270:16:270:23 | location | tst.js:273:7:273:10 | loc1 | Cross-site scripting vulnerability due to $@. | tst.js:270:16:270:23 | location | user-provided value |
-| tst.js:273:7:273:10 | loc1 | tst.js:273:7:273:10 | loc1 | tst.js:273:7:273:10 | loc1 | Cross-site scripting vulnerability due to $@. | tst.js:273:7:273:10 | loc1 | user-provided value |
-| tst.js:274:7:274:10 | loc2 | tst.js:271:16:271:30 | window.location | tst.js:274:7:274:10 | loc2 | Cross-site scripting vulnerability due to $@. | tst.js:271:16:271:30 | window.location | user-provided value |
-| tst.js:274:7:274:10 | loc2 | tst.js:274:7:274:10 | loc2 | tst.js:274:7:274:10 | loc2 | Cross-site scripting vulnerability due to $@. | tst.js:274:7:274:10 | loc2 | user-provided value |
 | tst.js:275:7:275:10 | loc3 | tst.js:272:16:272:32 | document.location | tst.js:275:7:275:10 | loc3 | Cross-site scripting vulnerability due to $@. | tst.js:272:16:272:32 | document.location | user-provided value |
-| tst.js:275:7:275:10 | loc3 | tst.js:275:7:275:10 | loc3 | tst.js:275:7:275:10 | loc3 | Cross-site scripting vulnerability due to $@. | tst.js:275:7:275:10 | loc3 | user-provided value |
 | winjs.js:3:43:3:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:3:43:3:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
 | winjs.js:4:43:4:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:4:43:4:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/tst.js b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
index e91fcb278e5d..6a945d6ab20d 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
@@ -272,5 +272,5 @@ function jqueryLocation() {
     var loc3 = document.location;
     $(loc1); // OK
     $(loc2); // OK
-    $(loc3); // OK
+    $(loc3); // OK - but still flagged
 }

From 7f538e82c09d54dc2f3a35c70a34c6c31752ad7f Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 18 Dec 2018 13:55:05 +0000
Subject: [PATCH 37/69] JS: add test case for non-whitelisted use of location

---
 .../ql/test/query-tests/Security/CWE-079/StoredXss.expected     | 1 +
 javascript/ql/test/query-tests/Security/CWE-079/Xss.expected    | 2 ++
 javascript/ql/test/query-tests/Security/CWE-079/tst.js          | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
index ed5dfaa34a86..50fcbbca5efd 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected
@@ -217,6 +217,7 @@ nodes
 | tst.js:272:9:272:32 | loc3 |
 | tst.js:272:16:272:32 | document.location |
 | tst.js:275:7:275:10 | loc3 |
+| tst.js:277:22:277:29 | location |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
 | winjs.js:2:17:2:40 | documen ... .search |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
index 37800a8962a0..34ab0b8a16dc 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected
@@ -174,6 +174,7 @@ nodes
 | tst.js:272:9:272:32 | loc3 |
 | tst.js:272:16:272:32 | document.location |
 | tst.js:275:7:275:10 | loc3 |
+| tst.js:277:22:277:29 | location |
 | winjs.js:2:7:2:53 | tainted |
 | winjs.js:2:17:2:33 | document.location |
 | winjs.js:2:17:2:40 | documen ... .search |
@@ -384,5 +385,6 @@ edges
 | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | tst.js:257:7:257:10 | name | Cross-site scripting vulnerability due to $@. | tst.js:257:7:257:10 | name | user-provided value |
 | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | tst.js:261:11:261:21 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:261:11:261:21 | window.name | user-provided value |
 | tst.js:275:7:275:10 | loc3 | tst.js:272:16:272:32 | document.location | tst.js:275:7:275:10 | loc3 | Cross-site scripting vulnerability due to $@. | tst.js:272:16:272:32 | document.location | user-provided value |
+| tst.js:277:22:277:29 | location | tst.js:277:22:277:29 | location | tst.js:277:22:277:29 | location | Cross-site scripting vulnerability due to $@. | tst.js:277:22:277:29 | location | user-provided value |
 | winjs.js:3:43:3:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:3:43:3:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
 | winjs.js:4:43:4:49 | tainted | winjs.js:2:17:2:33 | document.location | winjs.js:4:43:4:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.location | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/tst.js b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
index 6a945d6ab20d..b10da36c190b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/tst.js
@@ -273,4 +273,6 @@ function jqueryLocation() {
     $(loc1); // OK
     $(loc2); // OK
     $(loc3); // OK - but still flagged
+
+    $("body").append(location); // NOT OK
 }

From 1246de466a9f1058a57ef05afea4050ea0c62ee0 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 18 Dec 2018 13:58:03 +0000
Subject: [PATCH 38/69] JS: add change note

---
 change-notes/1.20/analysis-javascript.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index af8bb984ae8a..10cef9b56734 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -24,7 +24,7 @@
 
 | **Query**                                  | **Expected impact**          | **Change**                                                                   |
 |--------------------------------------------|------------------------------|------------------------------------------------------------------------------|
-| Client-side cross-site scripting           | More results                 | This rule now recognizes WinJS functions that are vulnerable to HTML injection. |
+| Client-side cross-site scripting           | More true-positive results, fewer false-positive results.                 | This rule now recognizes WinJS functions that are vulnerable to HTML injection, and no longer flags certain safe uses of jQuery. |
 | Insecure randomness | More results | This rule now flags insecure uses of `crypto.pseudoRandomBytes`. |
 | Unused parameter                           | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
 | Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |

From f57454951bc491d3335f7f6b426cadf583dd6ccc Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 18 Dec 2018 14:15:12 +0000
Subject: [PATCH 39/69] JS: move <ul> outside of <p> element

---
 .../MissingIndexAdjustmentAfterConcurrentModification.qhelp    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
index 20bf93105d3e..3340b919ce2d 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
@@ -15,6 +15,8 @@
 
 <p>
 Determine what the loop is supposed to do:
+</p>
+
 <ul>
   <li>
     If the intention is to remove <em>every occurence</em> of a certain value, decrement the loop counter after removing an element, to counterbalance
@@ -28,7 +30,6 @@ Determine what the loop is supposed to do:
     so it is clear that the loop is not a trivial array iteration loop.
   </li>
 </ul>
-</p>
 
 </recommendation>
 <example>

From f9d7f8ba11be7cd9fac14eefa67c4831a5408c0d Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 19 Dec 2018 10:10:56 +0000
Subject: [PATCH 40/69] JS: fix links in qhelp

---
 .../MissingIndexAdjustmentAfterConcurrentModification.qhelp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
index 3340b919ce2d..b682eab0688e 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
@@ -38,7 +38,7 @@ Determine what the loop is supposed to do:
 In this example, a function is intended to remove "<code>..</code>" parts from a path:
 </p>
 
-<sample src="examples/MisleadingIndentationAfterControlStmt.js" />
+<sample src="examples/MissingIndexAdjustmentAfterConcurrentModification.js" />
 
 <p>
 However, whenever the input contain two "<code>..</code>" parts right after one another, only the first will be removed.
@@ -51,13 +51,13 @@ index 0 and will therefore be skipped.
 One way to avoid this is to decrement the loop counter after removing an element from the array:
 </p>
 
-<sample src="examples/MisleadingIndentationAfterControlStmtGood.js" />
+<sample src="examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js" />
 
 <p>
 Alternatively, use the <code>filter</code> method:
 </p>
 
-<sample src="examples/MisleadingIndentationAfterControlStmtGoodFilter.js" />
+<sample src="examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js" />
 
 </example>
 <references>

From f84301e4769682df9264fa26258b33edd2328269 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 14 Dec 2018 10:59:55 +0000
Subject: [PATCH 41/69] JS: add tests with res.sendFile root option

---
 .../query-tests/Security/CWE-022/TaintedPath.expected     | 6 ++++++
 .../test/query-tests/Security/CWE-022/tainted-sendFile.js | 8 ++++++++
 2 files changed, 14 insertions(+)

diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
index 7a73a250542c..f3da2d2d8f9a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
@@ -84,6 +84,9 @@ nodes
 | tainted-require.js:7:19:7:37 | req.param("module") |
 | tainted-sendFile.js:7:16:7:33 | req.param("gimme") |
 | tainted-sendFile.js:9:16:9:33 | req.param("gimme") |
+| tainted-sendFile.js:12:16:12:33 | req.param("gimme") |
+| tainted-sendFile.js:14:16:14:33 | req.param("gimme") |
+| tainted-sendFile.js:17:16:17:32 | req.param("file") |
 | views.js:1:43:1:55 | req.params[0] |
 edges
 | TaintedPath-es6.js:7:7:7:44 | path | TaintedPath-es6.js:10:41:10:44 | path |
@@ -188,4 +191,7 @@ edges
 | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
 | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | a user-provided value |
 | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | a user-provided value |
+| tainted-sendFile.js:12:16:12:33 | req.param("gimme") | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | a user-provided value |
+| tainted-sendFile.js:14:16:14:33 | req.param("gimme") | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | a user-provided value |
+| tainted-sendFile.js:17:16:17:32 | req.param("file") | tainted-sendFile.js:17:16:17:32 | req.param("file") | tainted-sendFile.js:17:16:17:32 | req.param("file") | This path depends on $@. | tainted-sendFile.js:17:16:17:32 | req.param("file") | a user-provided value |
 | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | This path depends on $@. | views.js:1:43:1:55 | req.params[0] | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/tainted-sendFile.js b/javascript/ql/test/query-tests/Security/CWE-022/tainted-sendFile.js
index e925f6c566b3..21f385f44ada 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/tainted-sendFile.js
+++ b/javascript/ql/test/query-tests/Security/CWE-022/tainted-sendFile.js
@@ -7,4 +7,12 @@ app.get('/some/path', function(req, res) {
   res.sendFile(req.param("gimme"));
   // BAD: same as above
   res.sendfile(req.param("gimme"));
+
+  // GOOD: ensures files cannot be accessed outside of root folder
+  res.sendFile(req.param("gimme"), { root: process.cwd() });
+  // GOOD: ensures files cannot be accessed outside of root folder
+  res.sendfile(req.param("gimme"), { root: process.cwd() });
+
+  // BAD: doesn't help if user controls root
+  res.sendFile(req.param("file"), { root: req.param("dir") });
 });

From 0e40717358dfb11387a467425e4d37d492ae638c Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 14 Dec 2018 11:12:16 +0000
Subject: [PATCH 42/69] JS: recognize res.sendfile root option

---
 javascript/ql/src/semmle/javascript/Concepts.qll       | 10 +++++++++-
 .../ql/src/semmle/javascript/frameworks/Express.qll    |  4 ++++
 .../javascript/security/dataflow/TaintedPath.qll       |  6 +++++-
 .../query-tests/Security/CWE-022/TaintedPath.expected  |  8 ++------
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Concepts.qll b/javascript/ql/src/semmle/javascript/Concepts.qll
index 53220a149789..0aff9a5904ed 100644
--- a/javascript/ql/src/semmle/javascript/Concepts.qll
+++ b/javascript/ql/src/semmle/javascript/Concepts.qll
@@ -28,7 +28,15 @@ abstract class FileSystemAccess extends DataFlow::Node {
 
   /** Gets an argument to this file system access that is interpreted as a path. */
   abstract DataFlow::Node getAPathArgument();
-  
+
+  /**
+   * Gets an argument to this file system access that is interpreted as a root folder
+   * in which the path arguments are constrained.
+   *
+   * In other words, if a root argument is provided, the underlying file access does its own
+   * sanitization to prevent the path arguments from traversing outside the root folder.
+   */
+  DataFlow::Node getRootPathArgument() { none() }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index 09ac3cdce2ef..0185849d3996 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -866,6 +866,10 @@ module Express {
     override DataFlow::Node getAPathArgument() {
       result = DataFlow::valueNode(astNode.getArgument(0))
     }
+
+    override DataFlow::Node getRootPathArgument() {
+      result = this.(DataFlow::CallNode).getOptionArgument(1, "root")
+    }
   }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
index a7d842281818..55e3455fdd5a 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
@@ -71,7 +71,11 @@ module TaintedPath {
    */
   class FsPathSink extends Sink, DataFlow::ValueNode {
     FsPathSink() {
-      this = any(FileSystemAccess fs).getAPathArgument()
+      exists (FileSystemAccess fs |
+        this = fs.getAPathArgument() and
+        not exists(fs.getRootPathArgument())
+        or
+        this = fs.getRootPathArgument())
     }
   }
 
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
index f3da2d2d8f9a..e7ea1b87af77 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
@@ -84,9 +84,7 @@ nodes
 | tainted-require.js:7:19:7:37 | req.param("module") |
 | tainted-sendFile.js:7:16:7:33 | req.param("gimme") |
 | tainted-sendFile.js:9:16:9:33 | req.param("gimme") |
-| tainted-sendFile.js:12:16:12:33 | req.param("gimme") |
-| tainted-sendFile.js:14:16:14:33 | req.param("gimme") |
-| tainted-sendFile.js:17:16:17:32 | req.param("file") |
+| tainted-sendFile.js:17:43:17:58 | req.param("dir") |
 | views.js:1:43:1:55 | req.params[0] |
 edges
 | TaintedPath-es6.js:7:7:7:44 | path | TaintedPath-es6.js:10:41:10:44 | path |
@@ -191,7 +189,5 @@ edges
 | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
 | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:7:16:7:33 | req.param("gimme") | a user-provided value |
 | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:9:16:9:33 | req.param("gimme") | a user-provided value |
-| tainted-sendFile.js:12:16:12:33 | req.param("gimme") | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:12:16:12:33 | req.param("gimme") | a user-provided value |
-| tainted-sendFile.js:14:16:14:33 | req.param("gimme") | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:14:16:14:33 | req.param("gimme") | a user-provided value |
-| tainted-sendFile.js:17:16:17:32 | req.param("file") | tainted-sendFile.js:17:16:17:32 | req.param("file") | tainted-sendFile.js:17:16:17:32 | req.param("file") | This path depends on $@. | tainted-sendFile.js:17:16:17:32 | req.param("file") | a user-provided value |
+| tainted-sendFile.js:17:43:17:58 | req.param("dir") | tainted-sendFile.js:17:43:17:58 | req.param("dir") | tainted-sendFile.js:17:43:17:58 | req.param("dir") | This path depends on $@. | tainted-sendFile.js:17:43:17:58 | req.param("dir") | a user-provided value |
 | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | This path depends on $@. | views.js:1:43:1:55 | req.params[0] | a user-provided value |

From f9da1dc03e8f12619fddb5425424bbd9515d2d21 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 14 Dec 2018 11:38:38 +0000
Subject: [PATCH 43/69] JS: add change note

---
 change-notes/1.20/analysis-javascript.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index af8bb984ae8a..99601bae9fba 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -28,5 +28,6 @@
 | Insecure randomness | More results | This rule now flags insecure uses of `crypto.pseudoRandomBytes`. |
 | Unused parameter                           | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
 | Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |
+| Uncontrolled data used in path expression | Fewer false-positive results | This rule now recognizes the Express `root` option, which prevents path traversal. |
 
 ## Changes to QL libraries

From e5cbac5c13ed0c4bbbe7b6d02bd9208c70d3a869 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 19 Dec 2018 11:37:22 +0100
Subject: [PATCH 44/69] C#: Replace a use of `boundedFastTC` with `fastTC`

---
 .../semmle/code/csharp/dispatch/Dispatch.qll  | 47 ++++++-------------
 1 file changed, 15 insertions(+), 32 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
index b043cdb56304..80c03685e353 100644
--- a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
+++ b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
@@ -269,13 +269,6 @@ private module Internal {
    * types for a given expression.
    */
   private module SimpleTypeDataFlow {
-    // A temporary workaround to get the right join-order in `Sink::getASource()`
-    private newtype ExprWrapper = TExprWrapper(Expr e)
-
-    private Expr unwrap(ExprWrapper ew) { ew = TExprWrapper(result) }
-
-    private ExprWrapper wrap(Expr e) { result = TExprWrapper(e) }
-
     /**
      * Holds if type `t` may be imprecise, that is, an expression of type `t` may
      * in fact have a more precise type.
@@ -321,34 +314,27 @@ private module Internal {
       typeMayBeImprecise(succ.getType())
     }
 
-    private predicate step(ExprWrapper succ, ExprWrapper pred) {
-      stepExpr(unwrap(succ), unwrap(pred))
-    }
-
-    private predicate isSink(ExprWrapper ew) {
-      exists(Expr e |
-        e = unwrap(ew) |
-        e = any(DynamicMemberAccess dma | isSink(wrap(dma))).getQualifier() or
-        e = any(AccessorCall ac).getAnArgument() or
-        e = any(DispatchReflectionOrDynamicCall c).getArgument(_) or
-        e = any(MethodCall mc | mc.getTarget() = any(SystemObjectClass c).getGetTypeMethod()).getQualifier() or
-        e = any(DispatchCallImpl c).getQualifier()
-      )
-    }
-
-    private predicate stepTC(ExprWrapper succ, ExprWrapper pred) =
-      boundedFastTC(step/2, isSink/1)(succ, pred)
+    private predicate stepTC(Expr succ, Expr pred) =
+      fastTC(stepExpr/2)(succ, pred)
 
     private class Source extends Expr {
       Source() { not stepExpr(this, _) }
     }
 
     private class Sink extends Expr {
-      Sink() { isSink(wrap(this)) }
-
-      Source getASource() {
-        stepTC(wrap(this), wrap(result))
+      Sink() {
+        this = any(DynamicMemberAccess dma | dma instanceof Sink).getQualifier()
+        or
+        this = any(AccessorCall ac).getAnArgument()
+        or
+        this = any(DispatchReflectionOrDynamicCall c).getArgument(_)
+        or
+        this = any(MethodCall mc | mc.getTarget() = any(SystemObjectClass c).getGetTypeMethod()).getQualifier()
+        or
+        this = any(DispatchCallImpl c).getQualifier()
       }
+
+      Source getASource() { stepTC(this, result) }
     }
 
     /** Holds if the expression `e` has an exact type. */
@@ -357,10 +343,7 @@ private module Internal {
       e instanceof BaseAccess
     }
 
-    /**
-     * Gets a source type for expression `e`, using simple data flow. The
-     * expression must be a member of the predicate `isSink()` above.
-     */
+    /** Gets a source type for expression `e`, using simple data flow. */
     Type getASourceType(Sink e, boolean isExact) {
       exists(Source s |
         s = e.getASource() or

From a7cdf528dd616f8311c404467f74f5048216a59d Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Tue, 4 Dec 2018 14:51:10 +0000
Subject: [PATCH 45/69] C#: Improve performance by mapping directly from
 entities to labels.

---
 csharp/extractor/Semmle.Extraction/Context.cs | 48 ++++++++-----------
 1 file changed, 19 insertions(+), 29 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index b2b3c42765f8..51593bb1a1f9 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -50,20 +50,30 @@ public SemanticModel Model(SyntaxNode node)
         /// <returns><code>true</code> iff the label already existed.</returns>
         public bool GetOrAddCachedLabel(ICachedEntity entity)
         {
-            var id = GetId(entity);
+            // Look up the label in the entityLabelCache
+            if (entityLabelCache.TryGetValue(entity, out Label label))
+            {
+                entity.Label = label;
+                return true;
+            }
+
+            var id = entity.Id;
+
             if (id == null)
                 throw new InternalError("Attempt to create a null entity for {0}", entity.GetType());
 
-            Label existingLabel;
-            if (labelCache.TryGetValue(id, out existingLabel))
+            // Look up the Id in the idLabelCache
+            if (idLabelCache.TryGetValue(id, out label))
             {
-                entity.Label = existingLabel;
+                entity.Label = label;
+                entityLabelCache[entity] = label;
                 return true;
             }
 
-            entity.Label = new Label(NewId());
-            DefineLabel(entity.Label, id);
-            labelCache[id] = entity.Label;
+            entity.Label = label = new Label(NewId());
+            DefineLabel(label, id);
+            entityLabelCache[entity] = label;
+            idLabelCache[id] = label;
             return false;
         }
 
@@ -90,25 +100,6 @@ public bool ExtractGenerics(ICachedEntity entity)
             }
         }
 
-        /// <summary>
-        /// Gets the ID belonging to cached entity <paramref name="entity"/>.
-        ///
-        /// The ID itself is also cached, but unlike the label cache (which is used
-        /// to prevent reextraction/infinite loops), this is a pure performance
-        /// optimization. Moreover, the label cache is injective, which the ID cache
-        /// need not be.
-        /// </summary>
-        IId GetId(ICachedEntity entity)
-        {
-            IId id;
-            if (!idCache.TryGetValue(entity, out id))
-            {
-                id = entity.Id;
-                idCache[entity] = id;
-            }
-            return id;
-        }
-
         /// <summary>
         /// Creates a fresh label with ID "*", and set it on the
         /// supplied <paramref name="entity"/> object.
@@ -120,7 +111,8 @@ public void AddFreshLabel(IEntity entity)
             entity.Label = label;
         }
 
-        readonly Dictionary<IId, Label> labelCache = new Dictionary<IId, Label>();
+        readonly Dictionary<IId, Label> idLabelCache = new Dictionary<IId, Label>();
+        readonly Dictionary<ICachedEntity, Label> entityLabelCache = new Dictionary<ICachedEntity, Label>();
         readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
 
         public void DefineLabel(IEntity entity)
@@ -134,8 +126,6 @@ void DefineLabel(Label label, IId id)
             TrapWriter.Emit(new DefineLabelEmitter(label, id));
         }
 
-        readonly Dictionary<object, IId> idCache = new Dictionary<object, IId>();
-
         /// <summary>
         /// Queue of items to populate later.
         /// The only reason for this is so that the call stack does not

From 88734f1f8ae360389309045e1cbcca22ecafafb4 Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Tue, 18 Dec 2018 11:34:56 +0000
Subject: [PATCH 46/69] C#: Fix label conflicts.

C#: Remove unnecessary code from Property.
---
 .../Entities/Accessor.cs                      |  2 +-
 .../Entities/Constructor.cs                   |  2 +-
 .../Entities/Event.cs                         |  7 ++--
 .../Entities/Indexer.cs                       | 34 +++----------------
 .../Entities/Method.cs                        | 13 +++++--
 .../Entities/Namespace.cs                     | 11 +++++-
 .../Entities/Property.cs                      | 18 +++++-----
 .../Entities/Types/Type.cs                    |  2 +-
 csharp/extractor/Semmle.Extraction/Context.cs | 27 +++++++--------
 .../Semmle.Extraction/Entities/Assembly.cs    |  4 +--
 .../Semmle.Extraction/Entities/Folder.cs      |  9 ++++-
 csharp/extractor/Semmle.Extraction/Entity.cs  |  2 ++
 csharp/extractor/Semmle.Extraction/Symbol.cs  |  2 ++
 13 files changed, 68 insertions(+), 65 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
index b70ab6ce0862..05339d66cdeb 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
@@ -58,7 +58,7 @@ public override void Populate()
             }
             else
             {
-                Context.ModelError(symbol, "Undhandled accessor kind");
+                Context.ModelError(symbol, "Unhandled accessor kind");
                 return;
             }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
index d96db4b46246..420364d13a19 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
@@ -118,7 +118,7 @@ public override IId Id
                     if (symbol.IsStatic) tb.Append("static");
                     tb.Append(ContainingType);
                     AddParametersToId(Context, tb, symbol);
-                    tb.Append("; constructor");
+                    tb.Append(";constructor");
                 });
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
index 86a22c704a7f..80482d9e6e87 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
@@ -30,11 +30,12 @@ public override void Populate()
             Context.Emit(Tuples.events(this, symbol.GetName(), ContainingType, type.TypeRef, Create(Context, symbol.OriginalDefinition)));
 
             var adder = symbol.AddMethod;
-            if (adder != null)
+            var remover = symbol.RemoveMethod;
+
+            if (!(adder is null))
                 EventAccessor.Create(Context, adder);
 
-            var remover = symbol.RemoveMethod;
-            if (remover != null)
+            if (!(remover is null))
                 EventAccessor.Create(Context, remover);
 
             ExtractModifiers();
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
index 8fc7e20ccafc..a133bd978859 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
@@ -21,18 +21,14 @@ public override void Populate()
             var getter = symbol.GetMethod;
             var setter = symbol.SetMethod;
 
-            if (getter == null && setter == null)
+            if (getter is null && setter is null)
                 Context.ModelError(symbol, "No indexer accessor defined");
 
-            if (getter != null)
-            {
-                Getter = Accessor.Create(Context, getter);
-            }
+            if (!(getter is null))
+                Method.Create(Context, getter);
 
-            if (setter != null)
-            {
-                Setter = Accessor.Create(Context, setter);
-            }
+            if (!(setter is null))
+                Method.Create(Context, setter);
 
             for (var i = 0; i < symbol.Parameters.Length; ++i)
             {
@@ -40,26 +36,6 @@ public override void Populate()
                 Parameter.Create(Context, symbol.Parameters[i], this, original);
             }
 
-            if (getter != null)
-            {
-                Getter = Accessor.Create(Context, getter);
-                Context.Emit(Tuples.accessors(Getter, 1, getter.Name, this, Getter.OriginalDefinition));
-
-                Context.Emit(Tuples.accessor_location(Getter, Getter.Location));
-                Getter.Overrides();
-                Getter.ExtractModifiers();
-            }
-
-            if (setter != null)
-            {
-                Setter = Accessor.Create(Context, setter);
-                Context.Emit(Tuples.accessors(Setter, 2, setter.Name, this, Setter.OriginalDefinition));
-
-                Context.Emit(Tuples.accessor_location(Setter, Setter.Location));
-                Setter.Overrides();
-                Setter.ExtractModifiers();
-            }
-
             if (IsSourceDeclaration)
             {
                 var expressionBody = ExpressionBody;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
index 513cb52565da..b2ff15c59277 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
@@ -256,7 +256,15 @@ public static Method Create(Context cx, IMethodSymbol methodDecl)
         {
             if (methodDecl == null) return null;
 
-            switch (methodDecl.MethodKind)
+            var methodKind = methodDecl.MethodKind;
+
+            if(methodKind == MethodKind.ExplicitInterfaceImplementation)
+            {
+                // Retrieve the original method kind
+                methodKind = methodDecl.ExplicitInterfaceImplementations.Select(m => m.MethodKind).FirstOrDefault();
+            }
+
+            switch (methodKind)
             {
                 case MethodKind.StaticConstructor:
                 case MethodKind.Constructor:
@@ -264,13 +272,12 @@ public static Method Create(Context cx, IMethodSymbol methodDecl)
                 case MethodKind.ReducedExtension:
                 case MethodKind.Ordinary:
                 case MethodKind.DelegateInvoke:
-                case MethodKind.ExplicitInterfaceImplementation:
                     return OrdinaryMethod.Create(cx, methodDecl);
                 case MethodKind.Destructor:
                     return Destructor.Create(cx, methodDecl);
                 case MethodKind.PropertyGet:
                 case MethodKind.PropertySet:
-                    return Accessor.Create(cx, methodDecl);
+                    return methodDecl.AssociatedSymbol is null ? OrdinaryMethod.Create(cx, methodDecl) : (Method)Accessor.Create(cx, methodDecl);
                 case MethodKind.EventAdd:
                 case MethodKind.EventRemove:
                     return EventAccessor.Create(cx, methodDecl);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
index f66ac8e6d605..a7b744b11911 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
@@ -2,7 +2,7 @@
 
 namespace Semmle.Extraction.CSharp.Entities
 {
-    class Namespace : CachedEntity<INamespaceSymbol>
+    sealed class Namespace : CachedEntity<INamespaceSymbol>
     {
         Namespace(Context cx, INamespaceSymbol init)
             : base(cx, init) { }
@@ -41,5 +41,14 @@ class NamespaceFactory : ICachedEntityFactory<INamespaceSymbol, Namespace>
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+
+        public override int GetHashCode() => QualifiedName.GetHashCode();
+
+        string QualifiedName => symbol.ToDisplayString();
+
+        public override bool Equals(object obj)
+        {
+            return obj is Namespace ns && QualifiedName == ns.QualifiedName;
+        }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
index a75fc809d727..2f597625790c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
@@ -24,9 +24,6 @@ public override IId Id
             }
         }
 
-        protected Accessor Getter { get; set; }
-        protected Accessor Setter { get; set; }
-
         public override void Populate()
         {
             ExtractAttributes();
@@ -37,12 +34,13 @@ public override void Populate()
             Context.Emit(Tuples.properties(this, symbol.GetName(), ContainingType, type.TypeRef, Create(Context, symbol.OriginalDefinition)));
 
             var getter = symbol.GetMethod;
-            if (getter != null)
-                Getter = Accessor.Create(Context, getter);
-
             var setter = symbol.SetMethod;
-            if (setter != null)
-                Setter = Accessor.Create(Context, setter);
+
+            if (!(getter is null))
+                Method.Create(Context, getter);
+
+            if (!(setter is null))
+                Method.Create(Context, setter);
 
             var declSyntaxReferences = IsSourceDeclaration ?
                 symbol.DeclaringSyntaxReferences.
@@ -100,7 +98,9 @@ public override Microsoft.CodeAnalysis.Location FullLocation
 
         public static Property Create(Context cx, IPropertySymbol prop)
         {
-            return prop.IsIndexer ? Indexer.Create(cx, prop) : PropertyFactory.Instance.CreateEntity(cx, prop);
+            bool isIndexer = prop.IsIndexer || prop.ExplicitInterfaceImplementations.Any(e => e.IsIndexer);
+
+            return isIndexer ? Indexer.Create(cx, prop) : PropertyFactory.Instance.CreateEntity(cx, prop);
         }
 
         public void VisitDeclaration(Context cx, PropertyDeclarationSyntax p)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
index ac1a7e7f10eb..7198aee520d4 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
@@ -157,7 +157,7 @@ protected void ExtractType()
                     var param = invokeMethod.Parameters[i];
                     var originalParam = invokeMethod.OriginalDefinition.Parameters[i];
                     var originalParamEntity = Equals(param, originalParam) ? null :
-                        DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)symbol).ConstructedFrom));
+                        DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)symbol).OriginalDefinition));
                     DelegateTypeParameter.Create(Context, param, this, originalParamEntity);
                 }
 
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index 51593bb1a1f9..d49d592bda7b 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -57,23 +57,22 @@ public bool GetOrAddCachedLabel(ICachedEntity entity)
                 return true;
             }
 
-            var id = entity.Id;
+            entity.Label = label = new Label(NewId());
+            entityLabelCache[entity] = label;
 
-            if (id == null)
-                throw new InternalError("Attempt to create a null entity for {0}", entity.GetType());
+            var id = entity.Id;
+            DefineLabel(label, id);
 
-            // Look up the Id in the idLabelCache
-            if (idLabelCache.TryGetValue(id, out label))
+#if DEBUG_LABELS
+            if (idLabelCache.TryGetValue(id, out var originalEntity))
             {
-                entity.Label = label;
-                entityLabelCache[entity] = label;
-                return true;
+                Extractor.Message(new Message { message = "Label collision for " + id.ToString(), severity = Severity.Warning });
             }
-
-            entity.Label = label = new Label(NewId());
-            DefineLabel(label, id);
-            entityLabelCache[entity] = label;
-            idLabelCache[id] = label;
+            else
+            {
+                idLabelCache[id] = entity;
+            }
+#endif
             return false;
         }
 
@@ -111,7 +110,7 @@ public void AddFreshLabel(IEntity entity)
             entity.Label = label;
         }
 
-        readonly Dictionary<IId, Label> idLabelCache = new Dictionary<IId, Label>();
+        readonly Dictionary<IId, ICachedEntity> idLabelCache = new Dictionary<IId, ICachedEntity>();
         readonly Dictionary<ICachedEntity, Label> entityLabelCache = new Dictionary<ICachedEntity, Label>();
         readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
 
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index 473ffbcdde56..89cb68528e26 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -69,8 +69,8 @@ public override IId Id
             get
             {
                 return assemblyPath == null
-                    ? new Key(assembly, ";assembly")
-                    : new Key(assembly, "#file:///", assemblyPath.Replace("\\", "/"), ";assembly");
+                    ? new Key(assembly, ";sourcefile")
+                    : new Key(assembly, "#file:///", assemblyPath.Replace("\\", "/"), ";sourcefile");
             }
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
index 4b2f32048295..193100941fe0 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
@@ -2,7 +2,7 @@
 
 namespace Semmle.Extraction.Entities
 {
-    class Folder : CachedEntity<DirectoryInfo>
+    sealed class Folder : CachedEntity<DirectoryInfo>
     {
         Folder(Context cx, DirectoryInfo init)
             : base(cx, init)
@@ -51,5 +51,12 @@ class FolderFactory : ICachedEntityFactory<DirectoryInfo, Folder>
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+
+        public override int GetHashCode() => Path.GetHashCode();
+
+        public override bool Equals(object obj)
+        {
+            return obj is Folder folder && folder.Path == Path;
+        }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Entity.cs b/csharp/extractor/Semmle.Extraction/Entity.cs
index d2656c73483e..709dfb02ee31 100644
--- a/csharp/extractor/Semmle.Extraction/Entity.cs
+++ b/csharp/extractor/Semmle.Extraction/Entity.cs
@@ -79,6 +79,8 @@ public interface ICachedEntity : IEntity
         void Populate();
 
         bool NeedsPopulation { get; }
+
+        object UnderlyingObject { get; }
     }
 
     /// <summary>
diff --git a/csharp/extractor/Semmle.Extraction/Symbol.cs b/csharp/extractor/Semmle.Extraction/Symbol.cs
index f90c7f816fb6..0687c07a29b6 100644
--- a/csharp/extractor/Semmle.Extraction/Symbol.cs
+++ b/csharp/extractor/Semmle.Extraction/Symbol.cs
@@ -30,6 +30,8 @@ public Initializer symbol
             get; private set;
         }
 
+        object ICachedEntity.UnderlyingObject => symbol;
+
         public abstract IId Id
         {
             get;

From 93ce34ad58921e7443b5a8b53d774065ddf0964a Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Wed, 19 Dec 2018 10:10:22 +0000
Subject: [PATCH 47/69] C#: Add a new object->entity cache.

---
 .../Entities/Types/NamedType.cs               |  2 +-
 csharp/extractor/Semmle.Extraction/Context.cs | 89 ++++++++++++++-----
 csharp/extractor/Semmle.Extraction/Entity.cs  | 50 ++++-------
 3 files changed, 87 insertions(+), 54 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
index a5dba66c9342..45dcef696dd7 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
@@ -174,7 +174,7 @@ public NamedTypeRef(Context cx, INamedTypeSymbol symbol) : base(cx, symbol)
             referencedType = Type.Create(cx, symbol);
         }
 
-        public static NamedTypeRef Create(Context cx, INamedTypeSymbol type) => NamedTypeRefFactory.Instance.CreateEntity(cx, type);
+        public static NamedTypeRef Create(Context cx, INamedTypeSymbol type) => NamedTypeRefFactory.Instance.CreateEntity2(cx, type);
 
         class NamedTypeRefFactory : ICachedEntityFactory<INamedTypeSymbol, NamedTypeRef>
         {
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index d49d592bda7b..0d0d967b1db1 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -43,37 +43,81 @@ public SemanticModel Model(SyntaxNode node)
         int NewId() => TrapWriter.IdCounter++;
 
         /// <summary>
-        /// Gets the cached label for the given entity, or creates a new
-        /// (cached) label if it hasn't already been created. The label
-        /// is set on the supplied <paramref name="entity"/> object.
+        /// Creates a new entity using the factory.
         /// </summary>
-        /// <returns><code>true</code> iff the label already existed.</returns>
-        public bool GetOrAddCachedLabel(ICachedEntity entity)
+        /// <param name="factory">The entity factory.</param>
+        /// <param name="init">The initializer for the entity.</param>
+        /// <returns>The new/existing entity.</returns>
+        public Entity CreateEntity<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type init) where Entity : ICachedEntity
         {
-            // Look up the label in the entityLabelCache
-            if (entityLabelCache.TryGetValue(entity, out Label label))
+            return init == null ? CreateEntity2(factory, init) : CreateNonNullEntity(factory, init);
+        }
+
+        /// <summary>
+        /// Creates a new entity using the factory.
+        /// Uses a different cache to <see cref="CreateEntity{Type, Entity}(ICachedEntityFactory{Type, Entity}, Type)"/>,
+        /// and can store null values.
+        /// </summary>
+        /// <param name="factory">The entity factory.</param>
+        /// <param name="init">The initializer for the entity.</param>
+        /// <returns>The new/existing entity.</returns>
+        public Entity CreateEntity2<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type type) where Entity : ICachedEntity
+        {
+            using (StackGuard)
             {
-                entity.Label = label;
-                return true;
+                var entity = factory.Create(this, type);
+
+                if(entityLabelCache.TryGetValue(entity, out var label))
+                {
+                    entity.Label = label;
+                    return entity;
+                }
+                else
+                {
+                    var id = entity.Id;
+                    label = new Label(NewId());
+                    entity.Label = label;
+                    entityLabelCache[entity] = label;
+                    DefineLabel(label, id);
+                    if (entity.NeedsPopulation)
+                        Populate(null, entity);
+                    return entity;
+                }
             }
+        }
+
+        private Entity CreateNonNullEntity<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type init) where Entity : ICachedEntity
+        {
+            if (objectEntityCache.TryGetValue(init, out var cached))
+                return (Entity)cached;
 
-            entity.Label = label = new Label(NewId());
-            entityLabelCache[entity] = label;
+            using (StackGuard)
+            {
+                var label = new Label(NewId());
+                var entity = factory.Create(this, init);
+                entity.Label = label;
 
-            var id = entity.Id;
-            DefineLabel(label, id);
+                objectEntityCache[init] = entity;
+
+                var id = entity.Id;
+                DefineLabel(label, id);
 
 #if DEBUG_LABELS
-            if (idLabelCache.TryGetValue(id, out var originalEntity))
-            {
-                Extractor.Message(new Message { message = "Label collision for " + id.ToString(), severity = Severity.Warning });
-            }
-            else
-            {
-                idLabelCache[id] = entity;
-            }
+                if (idLabelCache.TryGetValue(id, out var originalEntity))
+                {
+                    Extractor.Message(new Message { message = "Label collision for " + id.ToString(), severity = Severity.Warning });
+                }
+                else
+                {
+                    idLabelCache[id] = entity;
+                }
 #endif
-            return false;
+
+                if (entity.NeedsPopulation)
+                    Populate(init as ISymbol, entity);
+
+                return entity;
+            }
         }
 
         /// <summary>
@@ -111,6 +155,7 @@ public void AddFreshLabel(IEntity entity)
         }
 
         readonly Dictionary<IId, ICachedEntity> idLabelCache = new Dictionary<IId, ICachedEntity>();
+        readonly Dictionary<object, ICachedEntity> objectEntityCache = new Dictionary<object, ICachedEntity>();
         readonly Dictionary<ICachedEntity, Label> entityLabelCache = new Dictionary<ICachedEntity, Label>();
         readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
 
diff --git a/csharp/extractor/Semmle.Extraction/Entity.cs b/csharp/extractor/Semmle.Extraction/Entity.cs
index 709dfb02ee31..a74113e5d86e 100644
--- a/csharp/extractor/Semmle.Extraction/Entity.cs
+++ b/csharp/extractor/Semmle.Extraction/Entity.cs
@@ -98,48 +98,36 @@ public interface ICachedEntityFactory<Initializer, Entity> where Entity : ICache
     public static class ICachedEntityFactoryExtensions
     {
         public static Entity CreateEntity<Entity, T1, T2>(this ICachedEntityFactory<(T1, T2), Entity> factory, Context cx, T1 t1, T2 t2)
-            where Entity : ICachedEntity
-        {
-            return factory.CreateEntity(cx, (t1, t2));
-        }
+            where Entity : ICachedEntity => factory.CreateEntity2(cx, (t1, t2));
 
         public static Entity CreateEntity<Entity, T1, T2, T3>(this ICachedEntityFactory<(T1, T2, T3), Entity> factory, Context cx, T1 t1, T2 t2, T3 t3)
-            where Entity : ICachedEntity
-        {
-            return factory.CreateEntity(cx, (t1, t2, t3));
-        }
+            where Entity : ICachedEntity => factory.CreateEntity2(cx, (t1, t2, t3));
 
         public static Entity CreateEntity<Entity, T1, T2, T3, T4>(this ICachedEntityFactory<(T1, T2, T3, T4), Entity> factory, Context cx, T1 t1, T2 t2, T3 t3, T4 t4)
-            where Entity : ICachedEntity
-        {
-            return factory.CreateEntity(cx, (t1, t2, t3, t4));
-        }
+            where Entity : ICachedEntity => factory.CreateEntity2(cx, (t1, t2, t3, t4));
 
         /// <summary>
-        /// Creates a new entity or returns the existing one from the cache.
+        /// Creates and populates a new entity, or returns the existing one from the cache.
         /// </summary>
         /// <typeparam name="Type">The symbol type used to construct the entity.</typeparam>
         /// <typeparam name="Entity">The type of the entity to create.</typeparam>
         /// <param name="cx">The extractor context.</param>
         /// <param name="factory">The factory used to construct the entity.</param>
-        /// <param name="t">The initializer for the entity.</param>
-        /// <returns></returns>
+        /// <param name="init">The initializer for the entity, which may not be null.</param>
+        /// <returns>The entity.</returns>
         public static Entity CreateEntity<Type, Entity>(this ICachedEntityFactory<Type, Entity> factory, Context cx, Type init)
-            where Entity : ICachedEntity
-        {
-            using (cx.StackGuard)
-            {
-                var entity = factory.Create(cx, init);
-                if (cx.GetOrAddCachedLabel(entity))
-                    return entity;
-
-                if (!entity.NeedsPopulation)
-                    return entity;
-
-                cx.Populate(init as ISymbol, entity);
-
-                return entity;
-            }
-        }
+            where Entity : ICachedEntity => cx.CreateEntity(factory, init);
+
+        /// <summary>
+        /// Creates and populates a new entity, but uses a different cache.
+        /// </summary>
+        /// <typeparam name="Type">The symbol type used to construct the entity.</typeparam>
+        /// <typeparam name="Entity">The type of the entity to create.</typeparam>
+        /// <param name="cx">The extractor context.</param>
+        /// <param name="factory">The factory used to construct the entity.</param>
+        /// <param name="init">The initializer for the entity, which may be null.</param>
+        /// <returns>The entity.</returns>
+        public static Entity CreateEntity2<Type, Entity>(this ICachedEntityFactory<Type, Entity> factory, Context cx, Type init)
+            where Entity : ICachedEntity => cx.CreateEntity2(factory, init);
     }
 }

From 6a54a6d3e5f105969bb4f8a76d6be35fa73dab65 Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Wed, 19 Dec 2018 11:03:05 +0000
Subject: [PATCH 48/69] C#: Fix changed unit tests.

---
 .../standalone/errorrecovery/ErrorTypes.expected             | 5 +++++
 .../library-tests/standalone/errorrecovery/Methods.expected  | 3 +++
 .../ql/test/library-tests/standalone/errorrecovery/errors.cs | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorTypes.expected b/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorTypes.expected
index 8d7f67084276..ab4a757a1ce8 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorTypes.expected
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorTypes.expected
@@ -1,3 +1,4 @@
+| errors.cs:37:21:37:21 | p | Int32 |
 | errors.cs:43:16:43:17 | c1 | C1 |
 | errors.cs:52:12:52:13 | c1 | C1 |
 | errors.cs:53:12:53:13 | c2 | C2 |
@@ -9,6 +10,10 @@
 | errors.cs:76:17:76:17 | x | Int32 |
 | errors.cs:77:17:77:17 | x | Int32 |
 | errors.cs:84:13:84:13 | F | Int32 |
+| errors.cs:91:13:91:13 | F | Int32 |
 | errors.cs:93:29:93:29 | a | Func<Int32,Int32,Int32> |
 | errors.cs:93:34:93:35 | x1 | Int32 |
 | errors.cs:93:38:93:39 | x2 | Int32 |
+| errors.cs:94:29:94:29 | a | Func<Int32,Int32,Int32> |
+| errors.cs:94:34:94:35 | y1 | Int32 |
+| errors.cs:94:38:94:39 | y2 | Int32 |
diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.expected b/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.expected
index 720f573f0727..44ffa9d3e19f 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.expected
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.expected
@@ -1,8 +1,11 @@
 | errors.cs:20:21:20:22 | m1 | 1 |
+| errors.cs:37:14:37:15 | m1 | 0 |
 | errors.cs:41:14:41:15 | m2 | 1 |
 | errors.cs:55:19:55:19 | f | 0 |
 | errors.cs:61:13:61:14 | f2 | 0 |
 | errors.cs:69:22:69:22 | M | 0 |
 | errors.cs:74:22:74:22 | M | 0 |
 | errors.cs:83:18:83:22 | get_P | 0 |
+| errors.cs:90:18:90:22 | get_P | 0 |
 | errors.cs:93:33:93:45 | (...) => ... | 0 |
+| errors.cs:94:33:94:45 | (...) => ... | 0 |
diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/errors.cs b/csharp/ql/test/library-tests/standalone/errorrecovery/errors.cs
index 2970ba1ec76a..90f8b50f018b 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/errors.cs
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/errors.cs
@@ -34,7 +34,7 @@ public void m1()
   // Error: Duplicate class
   class C1
     {
-        void m1()
+        void m1(int p)
         {
         }
 

From 78334af3540dfd776ba4fdb561692161c515ca66 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 13 Dec 2018 17:07:12 +0000
Subject: [PATCH 49/69] JS: remove cookie source; rely on persistent flow steps
 instead

---
 .../security/dataflow/RemoteFlowSources.qll        | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
index 964f9e988ef3..17fdbe228897 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
@@ -16,17 +16,3 @@ abstract class RemoteFlowSource extends DataFlow::Node {
    */
   predicate isUserControlledObject() { none() }
 }
-
-/**
- * An access to `document.cookie`, viewed as a source of remote user input.
- */
-private class DocumentCookieSource extends RemoteFlowSource, DataFlow::ValueNode {
-  DocumentCookieSource() {
-    isDocument(astNode.(PropAccess).getBase()) and
-    astNode.(PropAccess).getPropertyName() = "cookie"
-  }
-
-  override string getSourceType() {
-    result = "document.cookie"
-  }
-}

From 60ae3e58b8e8725c072fa9e8ce8f9d59bcd68585 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 19 Dec 2018 10:22:24 +0000
Subject: [PATCH 50/69] JS: update change note

---
 change-notes/1.20/analysis-javascript.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index af8bb984ae8a..f7282d3cd2cf 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -2,7 +2,7 @@
 
 ## General improvements
 
-* Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
+* Support for popular libraries has been improved. Consequently, queries may produce better results on code bases that use the following features:
   - client-side code, for example [React](https://reactjs.org/)
   - cookies and webstorage, for example [js-cookie](https://github.com/js-cookie/js-cookie)
   - server-side code, for example [hapi](https://hapijs.com/)

From ce18aca62bd9d049966c88d86574f7f11cca1919 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 19 Dec 2018 10:16:13 +0000
Subject: [PATCH 51/69] JS: update expected output

---
 .../Security/CWE-022/TaintedPath.expected     | 10 +-
 .../Security/CWE-022/TaintedPath.js           |  6 +-
 .../Security/CWE-094/CodeInjection.expected   | 94 ++++++++++++-------
 .../query-tests/Security/CWE-094/angularjs.js | 38 ++++----
 .../test/query-tests/Security/CWE-094/tst.js  |  2 +-
 5 files changed, 95 insertions(+), 55 deletions(-)

diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
index 7a73a250542c..c843ca6cca2d 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
@@ -53,7 +53,7 @@ nodes
 | TaintedPath.js:65:54:65:57 | path |
 | TaintedPath.js:67:29:67:61 | pathMod ... h(path) |
 | TaintedPath.js:67:57:67:60 | path |
-| TaintedPath.js:78:26:78:40 | document.cookie |
+| TaintedPath.js:78:26:78:45 | Cookie.get("unsafe") |
 | TaintedPath.js:84:31:84:70 | require ... eq.url) |
 | TaintedPath.js:84:31:84:76 | require ... ).query |
 | TaintedPath.js:84:63:84:69 | req.url |
@@ -64,6 +64,9 @@ nodes
 | TaintedPath.js:86:31:86:73 | require ... ).query |
 | TaintedPath.js:86:60:86:66 | req.url |
 | TaintedPath.js:94:48:94:60 | req.params[0] |
+| TaintedPath.js:102:30:102:31 | ev |
+| TaintedPath.js:103:24:103:25 | ev |
+| TaintedPath.js:103:24:103:30 | ev.data |
 | tainted-array-steps.js:9:7:9:48 | path |
 | tainted-array-steps.js:9:14:9:37 | url.par ... , true) |
 | tainted-array-steps.js:9:14:9:43 | url.par ... ).query |
@@ -143,6 +146,9 @@ edges
 | TaintedPath.js:85:61:85:67 | req.url | TaintedPath.js:85:31:85:68 | require ... eq.url) |
 | TaintedPath.js:86:31:86:67 | require ... eq.url) | TaintedPath.js:86:31:86:73 | require ... ).query |
 | TaintedPath.js:86:60:86:66 | req.url | TaintedPath.js:86:31:86:67 | require ... eq.url) |
+| TaintedPath.js:102:30:102:31 | ev | TaintedPath.js:103:24:103:25 | ev |
+| TaintedPath.js:103:24:103:25 | ev | TaintedPath.js:103:24:103:30 | ev.data |
+| TaintedPath.js:103:24:103:30 | ev.data | TaintedPath.js:78:26:78:45 | Cookie.get("unsafe") |
 | tainted-array-steps.js:9:7:9:48 | path | tainted-array-steps.js:11:40:11:43 | path |
 | tainted-array-steps.js:9:7:9:48 | path | tainted-array-steps.js:13:26:13:29 | path |
 | tainted-array-steps.js:9:14:9:37 | url.par ... , true) | tainted-array-steps.js:9:14:9:43 | url.par ... ).query |
@@ -178,7 +184,7 @@ edges
 | TaintedPath.js:63:29:63:52 | pathMod ... e(path) | TaintedPath.js:45:20:45:26 | req.url | TaintedPath.js:63:29:63:52 | pathMod ... e(path) | This path depends on $@. | TaintedPath.js:45:20:45:26 | req.url | a user-provided value |
 | TaintedPath.js:65:29:65:61 | pathMod ... ath, z) | TaintedPath.js:45:20:45:26 | req.url | TaintedPath.js:65:29:65:61 | pathMod ... ath, z) | This path depends on $@. | TaintedPath.js:45:20:45:26 | req.url | a user-provided value |
 | TaintedPath.js:67:29:67:61 | pathMod ... h(path) | TaintedPath.js:45:20:45:26 | req.url | TaintedPath.js:67:29:67:61 | pathMod ... h(path) | This path depends on $@. | TaintedPath.js:45:20:45:26 | req.url | a user-provided value |
-| TaintedPath.js:78:26:78:40 | document.cookie | TaintedPath.js:78:26:78:40 | document.cookie | TaintedPath.js:78:26:78:40 | document.cookie | This path depends on $@. | TaintedPath.js:78:26:78:40 | document.cookie | a user-provided value |
+| TaintedPath.js:78:26:78:45 | Cookie.get("unsafe") | TaintedPath.js:102:30:102:31 | ev | TaintedPath.js:78:26:78:45 | Cookie.get("unsafe") | This path depends on $@. | TaintedPath.js:102:30:102:31 | ev | a user-provided value |
 | TaintedPath.js:84:31:84:76 | require ... ).query | TaintedPath.js:84:63:84:69 | req.url | TaintedPath.js:84:31:84:76 | require ... ).query | This path depends on $@. | TaintedPath.js:84:63:84:69 | req.url | a user-provided value |
 | TaintedPath.js:85:31:85:74 | require ... ).query | TaintedPath.js:85:61:85:67 | req.url | TaintedPath.js:85:31:85:74 | require ... ).query | This path depends on $@. | TaintedPath.js:85:61:85:67 | req.url | a user-provided value |
 | TaintedPath.js:86:31:86:73 | require ... ).query | TaintedPath.js:86:60:86:66 | req.url | TaintedPath.js:86:31:86:73 | require ... ).query | This path depends on $@. | TaintedPath.js:86:60:86:66 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.js b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.js
index 2938a655b0f4..f1baffc2448c 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.js
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath.js
@@ -75,7 +75,7 @@ angular.module('myApp', [])
     })
     .directive('myCustomer', function() {
         return {
-            templateUrl: document.cookie // NOT OK
+            templateUrl: Cookie.get("unsafe") // NOT OK
         }
     })
 
@@ -98,3 +98,7 @@ var server = http.createServer(function(req, res) {
     application.get('/views/*', views_imported);
 
 })();
+
+addEventListener('message', (ev) => {
+  Cookie.set("unsafe", ev.data);
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection.expected b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
index 3abab2036520..7bcc540ca4b1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
@@ -1,18 +1,32 @@
 nodes
-| angularjs.js:10:22:10:36 | document.cookie |
-| angularjs.js:13:23:13:37 | document.cookie |
-| angularjs.js:16:28:16:42 | document.cookie |
-| angularjs.js:19:22:19:36 | document.cookie |
-| angularjs.js:22:27:22:41 | document.cookie |
-| angularjs.js:25:23:25:37 | document.cookie |
-| angularjs.js:28:33:28:47 | document.cookie |
-| angularjs.js:31:28:31:42 | document.cookie |
-| angularjs.js:34:18:34:32 | document.cookie |
-| angularjs.js:40:18:40:32 | document.cookie |
-| angularjs.js:44:17:44:31 | document.cookie |
-| angularjs.js:47:16:47:30 | document.cookie |
-| angularjs.js:50:22:50:36 | document.cookie |
-| angularjs.js:53:32:53:46 | document.cookie |
+| angularjs.js:10:22:10:29 | location |
+| angularjs.js:10:22:10:36 | location.search |
+| angularjs.js:13:23:13:30 | location |
+| angularjs.js:13:23:13:37 | location.search |
+| angularjs.js:16:28:16:35 | location |
+| angularjs.js:16:28:16:42 | location.search |
+| angularjs.js:19:22:19:29 | location |
+| angularjs.js:19:22:19:36 | location.search |
+| angularjs.js:22:27:22:34 | location |
+| angularjs.js:22:27:22:41 | location.search |
+| angularjs.js:25:23:25:30 | location |
+| angularjs.js:25:23:25:37 | location.search |
+| angularjs.js:28:33:28:40 | location |
+| angularjs.js:28:33:28:47 | location.search |
+| angularjs.js:31:28:31:35 | location |
+| angularjs.js:31:28:31:42 | location.search |
+| angularjs.js:34:18:34:25 | location |
+| angularjs.js:34:18:34:32 | location.search |
+| angularjs.js:40:18:40:25 | location |
+| angularjs.js:40:18:40:32 | location.search |
+| angularjs.js:44:17:44:24 | location |
+| angularjs.js:44:17:44:31 | location.search |
+| angularjs.js:47:16:47:23 | location |
+| angularjs.js:47:16:47:30 | location.search |
+| angularjs.js:50:22:50:29 | location |
+| angularjs.js:50:22:50:36 | location.search |
+| angularjs.js:53:32:53:39 | location |
+| angularjs.js:53:32:53:46 | location.search |
 | eslint-escope-build.js:20:22:20:22 | c |
 | eslint-escope-build.js:21:16:21:16 | c |
 | express.js:7:24:7:62 | "return ... obble") |
@@ -33,13 +47,28 @@ nodes
 | tst.js:2:6:2:83 | documen ... t=")+8) |
 | tst.js:5:12:5:28 | document.location |
 | tst.js:5:12:5:33 | documen ... on.hash |
-| tst.js:14:10:14:24 | document.cookie |
-| tst.js:14:10:14:65 | documen ... , "$1") |
+| tst.js:14:10:14:26 | document.location |
+| tst.js:14:10:14:33 | documen ... .search |
+| tst.js:14:10:14:74 | documen ... , "$1") |
 | tst.js:17:21:17:37 | document.location |
 | tst.js:17:21:17:42 | documen ... on.hash |
 | tst.js:20:30:20:46 | document.location |
 | tst.js:20:30:20:51 | documen ... on.hash |
 edges
+| angularjs.js:10:22:10:29 | location | angularjs.js:10:22:10:36 | location.search |
+| angularjs.js:13:23:13:30 | location | angularjs.js:13:23:13:37 | location.search |
+| angularjs.js:16:28:16:35 | location | angularjs.js:16:28:16:42 | location.search |
+| angularjs.js:19:22:19:29 | location | angularjs.js:19:22:19:36 | location.search |
+| angularjs.js:22:27:22:34 | location | angularjs.js:22:27:22:41 | location.search |
+| angularjs.js:25:23:25:30 | location | angularjs.js:25:23:25:37 | location.search |
+| angularjs.js:28:33:28:40 | location | angularjs.js:28:33:28:47 | location.search |
+| angularjs.js:31:28:31:35 | location | angularjs.js:31:28:31:42 | location.search |
+| angularjs.js:34:18:34:25 | location | angularjs.js:34:18:34:32 | location.search |
+| angularjs.js:40:18:40:25 | location | angularjs.js:40:18:40:32 | location.search |
+| angularjs.js:44:17:44:24 | location | angularjs.js:44:17:44:31 | location.search |
+| angularjs.js:47:16:47:23 | location | angularjs.js:47:16:47:30 | location.search |
+| angularjs.js:50:22:50:29 | location | angularjs.js:50:22:50:36 | location.search |
+| angularjs.js:53:32:53:39 | location | angularjs.js:53:32:53:46 | location.search |
 | eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c |
 | express.js:7:24:7:62 | "return ... obble") | express.js:7:24:7:69 | "return ...  + "];" |
 | express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:62 | "return ... obble") |
@@ -53,24 +82,25 @@ edges
 | tst.js:2:6:2:22 | document.location | tst.js:2:6:2:27 | documen ... on.href |
 | tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
 | tst.js:5:12:5:28 | document.location | tst.js:5:12:5:33 | documen ... on.hash |
-| tst.js:14:10:14:24 | document.cookie | tst.js:14:10:14:65 | documen ... , "$1") |
+| tst.js:14:10:14:26 | document.location | tst.js:14:10:14:33 | documen ... .search |
+| tst.js:14:10:14:33 | documen ... .search | tst.js:14:10:14:74 | documen ... , "$1") |
 | tst.js:17:21:17:37 | document.location | tst.js:17:21:17:42 | documen ... on.hash |
 | tst.js:20:30:20:46 | document.location | tst.js:20:30:20:51 | documen ... on.hash |
 #select
-| angularjs.js:10:22:10:36 | document.cookie | angularjs.js:10:22:10:36 | document.cookie | angularjs.js:10:22:10:36 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:10:22:10:36 | document.cookie | User-provided value |
-| angularjs.js:13:23:13:37 | document.cookie | angularjs.js:13:23:13:37 | document.cookie | angularjs.js:13:23:13:37 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:13:23:13:37 | document.cookie | User-provided value |
-| angularjs.js:16:28:16:42 | document.cookie | angularjs.js:16:28:16:42 | document.cookie | angularjs.js:16:28:16:42 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:16:28:16:42 | document.cookie | User-provided value |
-| angularjs.js:19:22:19:36 | document.cookie | angularjs.js:19:22:19:36 | document.cookie | angularjs.js:19:22:19:36 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:19:22:19:36 | document.cookie | User-provided value |
-| angularjs.js:22:27:22:41 | document.cookie | angularjs.js:22:27:22:41 | document.cookie | angularjs.js:22:27:22:41 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:22:27:22:41 | document.cookie | User-provided value |
-| angularjs.js:25:23:25:37 | document.cookie | angularjs.js:25:23:25:37 | document.cookie | angularjs.js:25:23:25:37 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:25:23:25:37 | document.cookie | User-provided value |
-| angularjs.js:28:33:28:47 | document.cookie | angularjs.js:28:33:28:47 | document.cookie | angularjs.js:28:33:28:47 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:28:33:28:47 | document.cookie | User-provided value |
-| angularjs.js:31:28:31:42 | document.cookie | angularjs.js:31:28:31:42 | document.cookie | angularjs.js:31:28:31:42 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:31:28:31:42 | document.cookie | User-provided value |
-| angularjs.js:34:18:34:32 | document.cookie | angularjs.js:34:18:34:32 | document.cookie | angularjs.js:34:18:34:32 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:34:18:34:32 | document.cookie | User-provided value |
-| angularjs.js:40:18:40:32 | document.cookie | angularjs.js:40:18:40:32 | document.cookie | angularjs.js:40:18:40:32 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:40:18:40:32 | document.cookie | User-provided value |
-| angularjs.js:44:17:44:31 | document.cookie | angularjs.js:44:17:44:31 | document.cookie | angularjs.js:44:17:44:31 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:44:17:44:31 | document.cookie | User-provided value |
-| angularjs.js:47:16:47:30 | document.cookie | angularjs.js:47:16:47:30 | document.cookie | angularjs.js:47:16:47:30 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:47:16:47:30 | document.cookie | User-provided value |
-| angularjs.js:50:22:50:36 | document.cookie | angularjs.js:50:22:50:36 | document.cookie | angularjs.js:50:22:50:36 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:50:22:50:36 | document.cookie | User-provided value |
-| angularjs.js:53:32:53:46 | document.cookie | angularjs.js:53:32:53:46 | document.cookie | angularjs.js:53:32:53:46 | document.cookie | $@ flows to here and is interpreted as code. | angularjs.js:53:32:53:46 | document.cookie | User-provided value |
+| angularjs.js:10:22:10:36 | location.search | angularjs.js:10:22:10:29 | location | angularjs.js:10:22:10:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:10:22:10:29 | location | User-provided value |
+| angularjs.js:13:23:13:37 | location.search | angularjs.js:13:23:13:30 | location | angularjs.js:13:23:13:37 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:13:23:13:30 | location | User-provided value |
+| angularjs.js:16:28:16:42 | location.search | angularjs.js:16:28:16:35 | location | angularjs.js:16:28:16:42 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:16:28:16:35 | location | User-provided value |
+| angularjs.js:19:22:19:36 | location.search | angularjs.js:19:22:19:29 | location | angularjs.js:19:22:19:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:19:22:19:29 | location | User-provided value |
+| angularjs.js:22:27:22:41 | location.search | angularjs.js:22:27:22:34 | location | angularjs.js:22:27:22:41 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:22:27:22:34 | location | User-provided value |
+| angularjs.js:25:23:25:37 | location.search | angularjs.js:25:23:25:30 | location | angularjs.js:25:23:25:37 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:25:23:25:30 | location | User-provided value |
+| angularjs.js:28:33:28:47 | location.search | angularjs.js:28:33:28:40 | location | angularjs.js:28:33:28:47 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:28:33:28:40 | location | User-provided value |
+| angularjs.js:31:28:31:42 | location.search | angularjs.js:31:28:31:35 | location | angularjs.js:31:28:31:42 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:31:28:31:35 | location | User-provided value |
+| angularjs.js:34:18:34:32 | location.search | angularjs.js:34:18:34:25 | location | angularjs.js:34:18:34:32 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:34:18:34:25 | location | User-provided value |
+| angularjs.js:40:18:40:32 | location.search | angularjs.js:40:18:40:25 | location | angularjs.js:40:18:40:32 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:40:18:40:25 | location | User-provided value |
+| angularjs.js:44:17:44:31 | location.search | angularjs.js:44:17:44:24 | location | angularjs.js:44:17:44:31 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:44:17:44:24 | location | User-provided value |
+| angularjs.js:47:16:47:30 | location.search | angularjs.js:47:16:47:23 | location | angularjs.js:47:16:47:30 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:47:16:47:23 | location | User-provided value |
+| angularjs.js:50:22:50:36 | location.search | angularjs.js:50:22:50:29 | location | angularjs.js:50:22:50:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:50:22:50:29 | location | User-provided value |
+| angularjs.js:53:32:53:46 | location.search | angularjs.js:53:32:53:39 | location | angularjs.js:53:32:53:46 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:53:32:53:39 | location | User-provided value |
 | eslint-escope-build.js:21:16:21:16 | c | eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c | $@ flows to here and is interpreted as code. | eslint-escope-build.js:20:22:20:22 | c | User-provided value |
 | express.js:7:24:7:69 | "return ...  + "];" | express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:69 | "return ...  + "];" | $@ flows to here and is interpreted as code. | express.js:7:44:7:62 | req.param("wobble") | User-provided value |
 | express.js:9:34:9:79 | "return ...  + "];" | express.js:9:54:9:72 | req.param("wobble") | express.js:9:34:9:79 | "return ...  + "];" | $@ flows to here and is interpreted as code. | express.js:9:54:9:72 | req.param("wobble") | User-provided value |
@@ -79,6 +109,6 @@ edges
 | react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
 | tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:22 | document.location | tst.js:2:6:2:83 | documen ... t=")+8) | $@ flows to here and is interpreted as code. | tst.js:2:6:2:22 | document.location | User-provided value |
 | tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:28 | document.location | tst.js:5:12:5:33 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:5:12:5:28 | document.location | User-provided value |
-| tst.js:14:10:14:65 | documen ... , "$1") | tst.js:14:10:14:24 | document.cookie | tst.js:14:10:14:65 | documen ... , "$1") | $@ flows to here and is interpreted as code. | tst.js:14:10:14:24 | document.cookie | User-provided value |
+| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:26 | document.location | tst.js:14:10:14:74 | documen ... , "$1") | $@ flows to here and is interpreted as code. | tst.js:14:10:14:26 | document.location | User-provided value |
 | tst.js:17:21:17:42 | documen ... on.hash | tst.js:17:21:17:37 | document.location | tst.js:17:21:17:42 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:17:21:17:37 | document.location | User-provided value |
 | tst.js:20:30:20:51 | documen ... on.hash | tst.js:20:30:20:46 | document.location | tst.js:20:30:20:51 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:20:30:20:46 | document.location | User-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/angularjs.js b/javascript/ql/test/query-tests/Security/CWE-094/angularjs.js
index 67932c540650..658d71e4c879 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/angularjs.js
+++ b/javascript/ql/test/query-tests/Security/CWE-094/angularjs.js
@@ -1,66 +1,66 @@
 angular.module('myModule', [])
     .controller('MyController', function($scope) {
-        $scope.$on(document.cookie); // OK
+        $scope.$on(location.search); // OK
     })
     .controller('MyController', function($scope) {
         $scope.$apply('hello'); // OK
     })
     .controller('MyController', function($scope) {
         var scope = $scope;
-        scope.$apply(document.cookie); // BAD
+        scope.$apply(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$apply(document.cookie); // BAD
+        $scope.$apply(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$applyAsync(document.cookie); // BAD
+        $scope.$applyAsync(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$eval(document.cookie); // BAD
+        $scope.$eval(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$evalAsync(document.cookie); // BAD
+        $scope.$evalAsync(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$watch(document.cookie); // BAD
+        $scope.$watch(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$watchCollection(document.cookie); // BAD
+        $scope.$watchCollection(location.search); // BAD
     })
     .controller('MyController', function($scope) {
-        $scope.$watchGroup(document.cookie); // BAD
+        $scope.$watchGroup(location.search); // BAD
     })
     .controller('MyController', function($compile) {
-        $compile(document.cookie); // BAD
+        $compile(location.search); // BAD
     })
     .controller('MyController', function($compile) {
         $compile('hello'); // OK
     })
     .controller('MyController', function($compile) {
-        $compile(document.cookie); // BAD
+        $compile(location.search); // BAD
     })
     .controller('MyController', function($compile) {
         var compile = $compile;
-        compile(document.cookie); // BAD
+        compile(location.search); // BAD
     })
     .controller('MyController', function($parse) {
-        $parse(document.cookie); // BAD
+        $parse(location.search); // BAD
     })
     .controller('MyController', function($interpolate) {
-        $interpolate(document.cookie); // BAD
+        $interpolate(location.search); // BAD
     })
     .controller('MyController', function($filter) {
-        $filter('orderBy')([], document.cookie); // BAD
+        $filter('orderBy')([], location.search); // BAD
     })
     .controller('MyController', function($filter) {
         $filter('orderBy')([], 'hello'); // OK
     })
     .controller('MyController', function($filter) {
-        $filter('random')([], document.cookie); // OK
+        $filter('random')([], location.search); // OK
     })
     .controller('MyController', function($someService) {
-        $someService('orderBy')([], document.cookie); // OK
+        $someService('orderBy')([], location.search); // OK
     })
     .controller('MyController', function($someService) {
-        $someService(document.cookie); // OK
-    })
+        $someService(location.search); // OK
+    });
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/tst.js b/javascript/ql/test/query-tests/Security/CWE-094/tst.js
index 7275275cc381..fa2b795897ba 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-094/tst.js
@@ -11,7 +11,7 @@ setTimeout(document.location.protocol);
 $('. ' + document.location.hostname);
 
 // NOT OK
-Function(document.cookie.replace(/.*\bfoo\s*=\s*([^;]*).*/, "$1"));
+Function(document.location.search.replace(/.*\bfoo\s*=\s*([^;]*).*/, "$1"));
 
 // NOT OK
 WebAssembly.compile(document.location.hash);

From 10627738d0e6ef86a8392a42a8a104bd43d97667 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 19 Dec 2018 14:56:56 +0100
Subject: [PATCH 52/69] C#: Introduce `Ssa::Definition::getElement()` and
 `AssignableDefinition::getElement()`

---
 csharp/ql/src/semmle/code/csharp/Assignable.qll  |  8 ++++++++
 .../src/semmle/code/csharp/dataflow/Nullness.qll |  6 +++---
 .../ql/src/semmle/code/csharp/dataflow/SSA.qll   | 16 ++++++++++++++++
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Assignable.qll b/csharp/ql/src/semmle/code/csharp/Assignable.qll
index 822a9daa17b0..1418f33e8379 100644
--- a/csharp/ql/src/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Assignable.qll
@@ -484,6 +484,12 @@ class AssignableDefinition extends TAssignableDefinition {
    */
   Expr getExpr() { none() }
 
+  /**
+   * Gets the underlying element associated with this definition. This is either
+   * an expression or a parameter.
+   */
+  Element getElement() { result = this.getExpr() }
+
   /** DEPRECATED: Use `getAControlFlowNode()` instead. */
   deprecated
   ControlFlow::Node getControlFlowNode() { result = this.getAControlFlowNode() }
@@ -800,6 +806,8 @@ module AssignableDefinitions {
       result = p.getCallable().getEntryPoint()
     }
 
+    override Parameter getElement() { result = p }
+
     override Callable getEnclosingCallable() {
       result = p.getCallable()
     }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index c5a662ccb56f..26c8fb44e119 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -163,9 +163,9 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
     de = def.getARead() |
     reason = de.getANullCheck(_, true) and
     msg = "as suggested by $@ null check" and
-    not def instanceof Ssa::PseudoDefinition and
-    strictcount(Location l |
-      l = any(Ssa::Definition def0 | de = def0.getARead()).getLocation()
+    not de = any(Ssa::PseudoDefinition pdef).getARead() and
+    strictcount(Element e |
+      e = any(Ssa::Definition def0 | de = def0.getARead()).getElement()
     ) = 1 and
     not nonNullDef(def) and
     // Don't use a check as reason if there is a `null` assignment
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 7cb75b63dcb9..b8d371774d51 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -2252,6 +2252,18 @@ module Ssa {
     /** Gets the basic block to which this SSA definition belongs. */
     BasicBlock getBasicBlock() { this.definesAt(result, _) }
 
+    /**
+     * Gets the syntax element associated with this SSA definition, if any.
+     * This is either an expression, for example `x = 0`, a parameter, or a
+     * callable. Pseudo nodes have no associated syntax element.
+     */
+    Element getElement() {
+      exists(BasicBlock bb, int i |
+        this.definesAt(bb, i) |
+        result = bb.getNode(i).getElement()
+      )
+    }
+
     /**
      * Holds if this SSA definition assigns to `out`/`ref` parameter `p`, and the
      * parameter may remain unchanged throughout the rest of the enclosing callable.
@@ -2341,6 +2353,8 @@ module Ssa {
       isCapturedVariableDefinitionFlowOut(this, cdef)
     }
 
+    override Element getElement() { result = ad.getElement() }
+
     override string toString() {
       if this.getADefinition() instanceof AssignableDefinitions::ImplicitParameterDefinition then
         result = getToStringPrefix(this) + "SSA param(" + this.getSourceVariable() + ")"
@@ -2384,6 +2398,8 @@ module Ssa {
       )
     }
 
+    override Callable getElement() { result = this.getCallable() }
+
     override string toString() {
       if this.getSourceVariable().getAssignable() instanceof LocalScopeVariable then
         result = getToStringPrefix(this) + "SSA capture def(" + this.getSourceVariable() + ")"

From 546d75004578e8b9d422182c43ee1087db5c8672 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 19 Dec 2018 10:27:49 +0100
Subject: [PATCH 53/69] C#: Reintroduce `getURL()`

It turns out that we still need `getURL()` to account for cases where there is no
`getLocation()`. Not having `getURL()` for entities without a `getLocation()` results
in a `file://0:0:0:0` URL, which is not rendered in QL4E, unlike a `""` URL.
---
 csharp/ql/src/Useless code/DefaultToString.ql | 35 ++++++-
 csharp/ql/src/semmle/code/csharp/Element.qll  |  5 +-
 .../ql/src/semmle/code/csharp/Enclosing.qll   |  4 +-
 .../semmle/code/csharp/ExprOrStmtParent.qll   | 23 +++--
 csharp/ql/src/semmle/code/csharp/Type.qll     | 10 +-
 .../csharp/controlflow/ControlFlowElement.qll |  4 +-
 .../csharp/controlflow/ControlFlowGraph.qll   |  4 +-
 .../semmle/code/csharp/frameworks/Format.qll  | 14 +--
 .../test/library-tests/async/Async.expected   | 28 +++---
 .../AnonymousObjectCreation3.expected         |  4 +-
 .../expressions/AnonymousObjectCreation3.ql   |  2 +-
 .../modifiers/Modifiers.expected              | 92 +++++++++----------
 .../namespaces/Namespaces6.expected           |  2 +-
 .../test/library-tests/types/Types27.expected |  2 +-
 csharp/ql/test/library-tests/types/Types27.ql |  4 -
 .../test/library-tests/types/Types34.expected |  2 +-
 csharp/ql/test/library-tests/types/Types34.ql |  4 -
 .../DefaultToString/DefaultToString.expected  | 14 +--
 18 files changed, 142 insertions(+), 111 deletions(-)

diff --git a/csharp/ql/src/Useless code/DefaultToString.ql b/csharp/ql/src/Useless code/DefaultToString.ql
index 0f88221d5431..4ee55ee588ae 100644
--- a/csharp/ql/src/Useless code/DefaultToString.ql	
+++ b/csharp/ql/src/Useless code/DefaultToString.ql	
@@ -58,7 +58,34 @@ predicate alwaysDefaultToString(ValueOrRefType t) {
   )
 }
 
-from Expr e, ValueOrRefType t
-where invokesToString(e, t)
-  and alwaysDefaultToString(t)
-select e, "Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing.", t, t.getName()
+newtype TDefaultToStringType =
+  TDefaultToStringType0(ValueOrRefType t) { alwaysDefaultToString(t) }
+
+class DefaultToStringType extends TDefaultToStringType {
+  ValueOrRefType t;
+
+  DefaultToStringType() { this = TDefaultToStringType0(t) }
+
+  ValueOrRefType getType() { result = t }
+
+  string toString() { result = t.toString() }
+
+  // A workaround for generating empty URLs for non-source locations, because qltest
+  // does not support non-source locations
+  string getURL() {
+    exists(Location l |
+      l = t.getLocation() |
+      if l instanceof SourceLocation then
+        exists(string path, int a, int b, int c, int d |
+          l.hasLocationInfo(path, a, b, c, d) |
+          toUrl(path, a, b, c, d, result)
+        )
+      else
+        result = ""
+    )
+  }
+}
+
+from Expr e, DefaultToStringType t
+where invokesToString(e, t.getType())
+select e, "Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing.", t, t.getType().getName()
diff --git a/csharp/ql/src/semmle/code/csharp/Element.qll b/csharp/ql/src/semmle/code/csharp/Element.qll
index aabac171c965..361319098898 100644
--- a/csharp/ql/src/semmle/code/csharp/Element.qll
+++ b/csharp/ql/src/semmle/code/csharp/Element.qll
@@ -22,7 +22,10 @@ class Element extends DotNet::Element, @element {
    * Where an element has multiple locations (for example a source file and an assembly),
    * gets only the source location.
    */
-  override Location getLocation() { result = bestLocation(this) }
+  override Location getLocation() { result = Internal::bestLocation(this) }
+
+  /** Gets the URL of this element. */
+  string getURL() { result = Internal::getURL(this) }
 
   /** Gets a location of this element, including sources and assemblies. */
   override Location getALocation() { none() }
diff --git a/csharp/ql/src/semmle/code/csharp/Enclosing.qll b/csharp/ql/src/semmle/code/csharp/Enclosing.qll
index c7bb6c34f3c0..c91f4ebcd0e0 100644
--- a/csharp/ql/src/semmle/code/csharp/Enclosing.qll
+++ b/csharp/ql/src/semmle/code/csharp/Enclosing.qll
@@ -13,7 +13,7 @@
  */
 
 import Stmt
-private import semmle.code.csharp.ExprOrStmtParent
+private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
 
 /**
  * INTERNAL: Do not use.
@@ -35,7 +35,7 @@ cached module Internal {
     c.getAChildStmt+() = s
   }
 
-  private Expr getAChildExpr(ExprOrStmtParent p) {
+  private Expr getAChildExpr(ExprOrStmtParent::ExprOrStmtParent p) {
     result = p.getAChildExpr() or
     result = p.(AssignOperation).getExpandedAssignment()
   }
diff --git a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
index d65dd80f59e9..b663abe981b7 100644
--- a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
+++ b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
@@ -346,7 +346,7 @@ private int getImplementationSize(ValueOrRefType t, File f) {
     result = getImplementationSize1(t, f)
 }
 
-private cached module Cached {
+cached module Internal {
   cached
   ControlFlowElement getTopLevelChild(ExprOrStmtParent p, int i) {
     result = p.(MultiImplementationsParent).getBestChild(i)
@@ -363,7 +363,7 @@ private cached module Cached {
    * in `f`.
    */
   cached
-  predicate mustHaveLocationInFileCached(Declaration d, File f) {
+  predicate mustHaveLocationInFile(Declaration d, File f) {
     exists(MultiImplementationsParent p, ValueOrRefType t |
       t = getTopLevelDeclaringType(p) and
       f = p.getBestFile() |
@@ -381,7 +381,7 @@ private cached module Cached {
    * locations, choose only one.
    */
   cached
-  Location bestLocationCached(Element e) {
+  Location bestLocation(Element e) {
     result = e.getALocation().(SourceLocation) and
     (mustHaveLocationInFile(e, _) implies mustHaveLocationInFile(e, result.getFile()))
     or
@@ -391,8 +391,17 @@ private cached module Cached {
       result = min(Location l | l = e.getALocation() | l order by l.getFile().toString())
     )
   }
-}
-private import Cached
 
-predicate mustHaveLocationInFile = mustHaveLocationInFileCached/2;
-predicate bestLocation = bestLocationCached/1;
+  cached
+  string getURL(Element e) {
+    exists(Location l, string path, int a, int b, int c, int d |
+      l = bestLocation(e) |
+      l.hasLocationInfo(path, a, b, c, d) and
+      toUrl(path, a, b, c, d, result)
+    )
+    or
+    not exists(bestLocation(e)) and
+    result = ""
+  }
+}
+private import Internal
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index d1da7ddf1811..9a9bed2932e0 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -808,8 +808,7 @@ class DelegateType extends RefType, Parameterizable, @delegate_type {
 /**
  * The `null` type. The type of the `null` literal.
  */
-class NullType extends RefType, @null_type {
-}
+class NullType extends RefType, @null_type { }
 
 /**
  * A nullable type, for example `int?`.
@@ -890,6 +889,13 @@ class ArrayType extends DotNet::ArrayType, RefType, @array_type {
   }
 
   override Type getChild(int n) { result = getElementType() and n = 0 }
+
+  override Location getALocation() {
+    type_location(this, result)
+    or
+    not type_location(this, _) and
+    result = this.getElementType().getALocation()
+  }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
index fcd0f61aa059..d34ea7992598 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
@@ -1,7 +1,7 @@
 /** Provides the class `ControlFlowElement`. */
 
 import csharp
-private import semmle.code.csharp.ExprOrStmtParent
+private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
 private import ControlFlow
 private import ControlFlow::BasicBlocks
 private import SuccessorTypes
@@ -15,7 +15,7 @@ private import SuccessorTypes
  * control flow elements and control flow nodes. This allows control flow
  * splitting, for example modeling the control flow through `finally` blocks.
  */
-class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
+class ControlFlowElement extends ExprOrStmtParent::ExprOrStmtParent, @control_flow_element {
   /** Gets the enclosing callable of this element, if any. */
   Callable getEnclosingCallable() { none() }
 
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
index 943c6632f6a2..d64be61d5e77 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
@@ -1769,7 +1769,7 @@ module ControlFlow {
        * not return.
        */
       private module NonReturning {
-        private import semmle.code.csharp.ExprOrStmtParent
+        private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
         private import semmle.code.csharp.commons.Assertions
         private import semmle.code.csharp.frameworks.System
 
@@ -1810,7 +1810,7 @@ module ControlFlow {
         private abstract class NonReturningCallable extends Callable {
           NonReturningCallable() {
             not exists(ReturnStmt ret | ret.getEnclosingCallable() = this) and
-            not hasAccessorAutoImplementation(this, _) and
+            not ExprOrStmtParent::hasAccessorAutoImplementation(this, _) and
             not exists(Virtualizable v |
               v.isOverridableOrImplementable() |
               v = this or
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/Format.qll b/csharp/ql/src/semmle/code/csharp/frameworks/Format.qll
index 3679cdbd1bbf..ec9d745918cd 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/Format.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/Format.qll
@@ -159,17 +159,11 @@ class InvalidFormatString extends StringLiteral {
     result = this.getValue().regexpFind(getValidFormatRegex(),0,0).length()
   }
 
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [LGTM locations](https://lgtm.com/help/ql/locations).
-   */
-  predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) {
-    exists(int oldstartcolumn, int padding |
+  override string getURL() {
+    exists(string filepath, int startline, int startcolumn, int endline, int endcolumn, int oldstartcolumn, int padding |
       this.getLocation().hasLocationInfo(filepath, startline, oldstartcolumn, endline, endcolumn) and
-      startcolumn = padding + oldstartcolumn + getInvalidOffset() |
+      startcolumn = padding + oldstartcolumn + getInvalidOffset() and
+      toUrl(filepath, startline, startcolumn, endline, endcolumn, result) |
       // Single-line string literal beginning " or @"
       // Figure out the correct indent.
       startline = endline and
diff --git a/csharp/ql/test/library-tests/async/Async.expected b/csharp/ql/test/library-tests/async/Async.expected
index 765014b99fc2..b4fc0f3c5b2f 100644
--- a/csharp/ql/test/library-tests/async/Async.expected
+++ b/csharp/ql/test/library-tests/async/Async.expected
@@ -1,14 +1,14 @@
-| async.cs:11:29:11:32 | Main | file://:0:0:0:0 | private |
-| async.cs:11:29:11:32 | Main | file://:0:0:0:0 | static |
-| async.cs:22:35:22:57 | PrintContentLengthAsync | file://:0:0:0:0 | async |
-| async.cs:22:35:22:57 | PrintContentLengthAsync | file://:0:0:0:0 | private |
-| async.cs:22:35:22:57 | PrintContentLengthAsync | file://:0:0:0:0 | static |
-| async.cs:28:40:28:57 | ContentLengthAsync | file://:0:0:0:0 | async |
-| async.cs:28:40:28:57 | ContentLengthAsync | file://:0:0:0:0 | private |
-| async.cs:28:40:28:57 | ContentLengthAsync | file://:0:0:0:0 | static |
-| async.cs:38:35:38:47 | AsyncIterator | file://:0:0:0:0 | async |
-| async.cs:38:35:38:47 | AsyncIterator | file://:0:0:0:0 | private |
-| async.cs:38:35:38:47 | AsyncIterator | file://:0:0:0:0 | static |
-| async.cs:50:49:50:57 | OpenAsync | file://:0:0:0:0 | async |
-| async.cs:50:49:50:57 | OpenAsync | file://:0:0:0:0 | private |
-| async.cs:50:49:50:57 | OpenAsync | file://:0:0:0:0 | static |
+| async.cs:11:29:11:32 | Main |  | private |
+| async.cs:11:29:11:32 | Main |  | static |
+| async.cs:22:35:22:57 | PrintContentLengthAsync |  | async |
+| async.cs:22:35:22:57 | PrintContentLengthAsync |  | private |
+| async.cs:22:35:22:57 | PrintContentLengthAsync |  | static |
+| async.cs:28:40:28:57 | ContentLengthAsync |  | async |
+| async.cs:28:40:28:57 | ContentLengthAsync |  | private |
+| async.cs:28:40:28:57 | ContentLengthAsync |  | static |
+| async.cs:38:35:38:47 | AsyncIterator |  | async |
+| async.cs:38:35:38:47 | AsyncIterator |  | private |
+| async.cs:38:35:38:47 | AsyncIterator |  | static |
+| async.cs:50:49:50:57 | OpenAsync |  | async |
+| async.cs:50:49:50:57 | OpenAsync |  | private |
+| async.cs:50:49:50:57 | OpenAsync |  | static |
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
index e16c51b69cb4..abf7b77ea491 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.expected
@@ -1,2 +1,2 @@
-| expressions.cs:417:9:420:9 | object creation of type <>__AnonType0<String,String[]> | file://:0:0:0:0 | String[] |
-| expressions.cs:421:9:424:9 | object creation of type <>__AnonType0<String,String[]> | file://:0:0:0:0 | String[] |
+| expressions.cs:417:9:420:9 | object creation of type <>__AnonType0<String,String[]> | String[] |
+| expressions.cs:421:9:424:9 | object creation of type <>__AnonType0<String,String[]> | String[] |
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
index 2b0d18e43aab..4fd1288a726d 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
@@ -11,4 +11,4 @@ where assign.getLValue().(VariableAccess).getTarget().hasName("contacts2")
   and p = a.getLValue().(PropertyAccess).getTarget()
   and p.hasName("PhoneNumbers")
   and p.getDeclaringType() = o.getObjectType()
-select o, p.getType()
+select o, p.getType().getName()
diff --git a/csharp/ql/test/library-tests/modifiers/Modifiers.expected b/csharp/ql/test/library-tests/modifiers/Modifiers.expected
index 8f89e302453e..329f75505d8e 100644
--- a/csharp/ql/test/library-tests/modifiers/Modifiers.expected
+++ b/csharp/ql/test/library-tests/modifiers/Modifiers.expected
@@ -1,46 +1,46 @@
-| Modifiers.cs:4:18:4:18 | C | file://:0:0:0:0 | internal |
-| Modifiers.cs:4:18:4:18 | C | file://:0:0:0:0 | unsafe |
-| Modifiers.cs:7:9:7:9 | C | file://:0:0:0:0 | private |
-| Modifiers.cs:9:16:9:16 | C | file://:0:0:0:0 | public |
-| Modifiers.cs:12:14:12:15 | M1 | file://:0:0:0:0 | private |
-| Modifiers.cs:14:22:14:23 | M2 | file://:0:0:0:0 | private |
-| Modifiers.cs:16:24:16:25 | M3 | file://:0:0:0:0 | protected |
-| Modifiers.cs:18:35:18:36 | M4 | file://:0:0:0:0 | extern |
-| Modifiers.cs:18:35:18:36 | M4 | file://:0:0:0:0 | public |
-| Modifiers.cs:18:35:18:36 | M4 | file://:0:0:0:0 | static |
-| Modifiers.cs:21:20:21:21 | M5 | file://:0:0:0:0 | async |
-| Modifiers.cs:21:20:21:21 | M5 | file://:0:0:0:0 | private |
-| Modifiers.cs:24:22:24:23 | C1 | file://:0:0:0:0 | private |
-| Modifiers.cs:24:22:24:23 | C1 | file://:0:0:0:0 | sealed |
-| Modifiers.cs:26:20:26:21 | C1 | file://:0:0:0:0 | public |
-| Modifiers.cs:29:34:29:35 | C2 | file://:0:0:0:0 | abstract |
-| Modifiers.cs:29:34:29:35 | C2 | file://:0:0:0:0 | protected |
-| Modifiers.cs:31:23:31:24 | C2 | file://:0:0:0:0 | protected |
-| Modifiers.cs:33:22:33:23 | M2 | file://:0:0:0:0 | new |
-| Modifiers.cs:33:22:33:23 | M2 | file://:0:0:0:0 | private |
-| Modifiers.cs:35:34:35:35 | M6 | file://:0:0:0:0 | abstract |
-| Modifiers.cs:35:34:35:35 | M6 | file://:0:0:0:0 | public |
-| Modifiers.cs:38:32:38:33 | C3 | file://:0:0:0:0 | internal |
-| Modifiers.cs:38:32:38:33 | C3 | file://:0:0:0:0 | partial |
-| Modifiers.cs:41:20:41:21 | F1 | file://:0:0:0:0 | private |
-| Modifiers.cs:41:20:41:21 | F1 | file://:0:0:0:0 | static |
-| Modifiers.cs:43:26:43:27 | F2 | file://:0:0:0:0 | const |
-| Modifiers.cs:43:26:43:27 | F2 | file://:0:0:0:0 | public |
-| Modifiers.cs:43:26:43:27 | F2 | file://:0:0:0:0 | static |
-| Modifiers.cs:45:41:45:42 | F3 | file://:0:0:0:0 | internal |
-| Modifiers.cs:45:41:45:42 | F3 | file://:0:0:0:0 | protected |
-| Modifiers.cs:45:41:45:42 | F3 | file://:0:0:0:0 | readonly |
-| Modifiers.cs:47:30:47:31 | F4 | file://:0:0:0:0 | private |
-| Modifiers.cs:47:30:47:31 | F4 | file://:0:0:0:0 | volatile |
-| Modifiers.cs:50:24:50:24 | I | file://:0:0:0:0 | internal |
-| Modifiers.cs:52:19:52:19 | S | file://:0:0:0:0 | public |
-| Modifiers.cs:52:19:52:19 | S | file://:0:0:0:0 | sealed |
-| Modifiers.cs:54:20:54:21 | P1 | file://:0:0:0:0 | public |
-| Modifiers.cs:54:36:54:38 | get_P1 | file://:0:0:0:0 | public |
-| Modifiers.cs:54:52:54:54 | set_P1 | file://:0:0:0:0 | public |
-| Modifiers.cs:55:20:55:21 | P2 | file://:0:0:0:0 | public |
-| Modifiers.cs:55:36:55:38 | get_P2 | file://:0:0:0:0 | public |
-| Modifiers.cs:55:49:55:51 | set_P2 | file://:0:0:0:0 | private |
-| Modifiers.cs:57:13:57:14 | P3 | file://:0:0:0:0 | private |
-| Modifiers.cs:57:30:57:32 | get_P3 | file://:0:0:0:0 | private |
-| Modifiers.cs:57:47:57:49 | set_P3 | file://:0:0:0:0 | private |
+| Modifiers.cs:4:18:4:18 | C |  | internal |
+| Modifiers.cs:4:18:4:18 | C |  | unsafe |
+| Modifiers.cs:7:9:7:9 | C |  | private |
+| Modifiers.cs:9:16:9:16 | C |  | public |
+| Modifiers.cs:12:14:12:15 | M1 |  | private |
+| Modifiers.cs:14:22:14:23 | M2 |  | private |
+| Modifiers.cs:16:24:16:25 | M3 |  | protected |
+| Modifiers.cs:18:35:18:36 | M4 |  | extern |
+| Modifiers.cs:18:35:18:36 | M4 |  | public |
+| Modifiers.cs:18:35:18:36 | M4 |  | static |
+| Modifiers.cs:21:20:21:21 | M5 |  | async |
+| Modifiers.cs:21:20:21:21 | M5 |  | private |
+| Modifiers.cs:24:22:24:23 | C1 |  | private |
+| Modifiers.cs:24:22:24:23 | C1 |  | sealed |
+| Modifiers.cs:26:20:26:21 | C1 |  | public |
+| Modifiers.cs:29:34:29:35 | C2 |  | abstract |
+| Modifiers.cs:29:34:29:35 | C2 |  | protected |
+| Modifiers.cs:31:23:31:24 | C2 |  | protected |
+| Modifiers.cs:33:22:33:23 | M2 |  | new |
+| Modifiers.cs:33:22:33:23 | M2 |  | private |
+| Modifiers.cs:35:34:35:35 | M6 |  | abstract |
+| Modifiers.cs:35:34:35:35 | M6 |  | public |
+| Modifiers.cs:38:32:38:33 | C3 |  | internal |
+| Modifiers.cs:38:32:38:33 | C3 |  | partial |
+| Modifiers.cs:41:20:41:21 | F1 |  | private |
+| Modifiers.cs:41:20:41:21 | F1 |  | static |
+| Modifiers.cs:43:26:43:27 | F2 |  | const |
+| Modifiers.cs:43:26:43:27 | F2 |  | public |
+| Modifiers.cs:43:26:43:27 | F2 |  | static |
+| Modifiers.cs:45:41:45:42 | F3 |  | internal |
+| Modifiers.cs:45:41:45:42 | F3 |  | protected |
+| Modifiers.cs:45:41:45:42 | F3 |  | readonly |
+| Modifiers.cs:47:30:47:31 | F4 |  | private |
+| Modifiers.cs:47:30:47:31 | F4 |  | volatile |
+| Modifiers.cs:50:24:50:24 | I |  | internal |
+| Modifiers.cs:52:19:52:19 | S |  | public |
+| Modifiers.cs:52:19:52:19 | S |  | sealed |
+| Modifiers.cs:54:20:54:21 | P1 |  | public |
+| Modifiers.cs:54:36:54:38 | get_P1 |  | public |
+| Modifiers.cs:54:52:54:54 | set_P1 |  | public |
+| Modifiers.cs:55:20:55:21 | P2 |  | public |
+| Modifiers.cs:55:36:55:38 | get_P2 |  | public |
+| Modifiers.cs:55:49:55:51 | set_P2 |  | private |
+| Modifiers.cs:57:13:57:14 | P3 |  | private |
+| Modifiers.cs:57:30:57:32 | get_P3 |  | private |
+| Modifiers.cs:57:47:57:49 | set_P3 |  | private |
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces6.expected b/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
index 39fee338b4b9..a44381ceb243 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces6.expected
@@ -1 +1 @@
-| file://:0:0:0:0 | Q1 | namespaces.cs:50:11:50:15 | Q1.Q2 |
+|  | Q1 | namespaces.cs:50:11:50:15 | Q1.Q2 |
diff --git a/csharp/ql/test/library-tests/types/Types27.expected b/csharp/ql/test/library-tests/types/Types27.expected
index 9a4a69374f71..3d7e0b414d6e 100644
--- a/csharp/ql/test/library-tests/types/Types27.expected
+++ b/csharp/ql/test/library-tests/types/Types27.expected
@@ -1 +1 @@
-| file://:0:0:0:0 | null |
+|  | null |
diff --git a/csharp/ql/test/library-tests/types/Types27.ql b/csharp/ql/test/library-tests/types/Types27.ql
index 1a754750a444..2efe19bcb794 100644
--- a/csharp/ql/test/library-tests/types/Types27.ql
+++ b/csharp/ql/test/library-tests/types/Types27.ql
@@ -1,7 +1,3 @@
-/**
- * @name Test for null type
- * @kind table
- */
 import csharp
 
 from NullLiteral l
diff --git a/csharp/ql/test/library-tests/types/Types34.expected b/csharp/ql/test/library-tests/types/Types34.expected
index 37e62f991313..f64fa37583cf 100644
--- a/csharp/ql/test/library-tests/types/Types34.expected
+++ b/csharp/ql/test/library-tests/types/Types34.expected
@@ -1 +1 @@
-| file://:0:0:0:0 | Class[][] | file://:0:0:0:0 | Class[] |
+| types.cs:3:20:3:24 | Class[][] | types.cs:3:20:3:24 | Class[] |
diff --git a/csharp/ql/test/library-tests/types/Types34.ql b/csharp/ql/test/library-tests/types/Types34.ql
index 2de285c35da9..74f21dd36ac3 100644
--- a/csharp/ql/test/library-tests/types/Types34.ql
+++ b/csharp/ql/test/library-tests/types/Types34.ql
@@ -1,7 +1,3 @@
-/**
- * @name Test for binding array types
- * @kind table
- */
 import csharp
 
 from Method m, ArrayType t1, ArrayType t2
diff --git a/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected b/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected
index 3c20ab85d525..8ef2e407766e 100644
--- a/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected	
+++ b/csharp/ql/test/query-tests/Useless Code/DefaultToString/DefaultToString.expected	
@@ -1,10 +1,10 @@
 | DefaultToString.cs:9:27:9:27 | access to local variable d | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToString.cs:4:7:4:21 | DefaultToString | DefaultToString |
 | DefaultToString.cs:10:28:10:28 | access to local variable d | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToString.cs:4:7:4:21 | DefaultToString | DefaultToString |
-| DefaultToString.cs:16:27:16:30 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
-| DefaultToString.cs:19:24:19:27 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
+| DefaultToString.cs:16:27:16:30 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
+| DefaultToString.cs:19:24:19:27 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
 | DefaultToStringBad.cs:8:35:8:35 | access to local variable p | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | DefaultToStringBad.cs:14:11:14:16 | Person | Person |
-| DefaultToStringBad.cs:11:38:11:41 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | Int32[] | Int32[] |
-| WriteLineArray.cs:7:23:7:26 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
-| WriteLineArray.cs:8:27:8:30 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
-| WriteLineArray.cs:10:36:10:39 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
-| WriteLineArray.cs:11:40:11:43 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. | file://:0:0:0:0 | String[] | String[] |
+| DefaultToStringBad.cs:11:38:11:41 | access to local variable ints | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | Int32[] | Int32[] |
+| WriteLineArray.cs:7:23:7:26 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
+| WriteLineArray.cs:8:27:8:30 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
+| WriteLineArray.cs:10:36:10:39 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |
+| WriteLineArray.cs:11:40:11:43 | access to parameter args | Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing. |  | String[] | String[] |

From 231465143d6efc73c421181bd11b29d58dba760a Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Thu, 20 Dec 2018 10:19:59 +0100
Subject: [PATCH 54/69] C#: Autoformat QL tests

---
 .../library-tests/arguments/argumentType.ql   |  2 +-
 .../library-tests/asp/basic/AspDirective.ql   |  1 -
 .../library-tests/asp/basic/AspOpenTag.ql     |  1 -
 .../test/library-tests/asp/basic/comments.ql  |  5 +--
 .../asp/parseError/AspDirective.ql            |  1 -
 .../asp/parseError/AspOpenTag.ql              |  1 -
 .../library-tests/asp/parseError/comments.ql  |  5 +--
 .../assemblies/CompareVersions.ql             |  8 ++--
 .../library-tests/assemblies/ValidVersions.ql | 20 +++++----
 .../library-tests/assemblies/assemblies.ql    | 45 +++++--------------
 .../library-tests/assemblies/locations.ql     |  9 ++--
 .../assemblylocation/AssemblyLocation.ql      |  7 +--
 .../assignables/AssignableAccess.ql           | 11 +++--
 .../assignables/AssignableDefinition.ql       | 39 ++++++----------
 .../assignments/AssignOperationExpanded.ql    | 19 ++++----
 .../library-tests/attributes/Attributes1.ql   |  8 ++--
 .../library-tests/cil/dataflow/DataFlow.ql    |  8 ++--
 .../cil/dataflow/TaintTracking.ql             |  8 ++--
 .../cil/pdbs/InstructionLocations.ql          |  8 ++--
 .../library-tests/cil/pdbs/MethodLocations.ql | 12 ++---
 .../test/library-tests/comments/Comments.ql   |  2 +-
 .../test/library-tests/comments/Generics.ql   | 34 ++++++--------
 .../commons/Disposal/DisposedFields.ql        |  7 +--
 .../commons/Disposal/DisposedParameter.ql     |  7 +--
 .../commons/Disposal/DisposedVariables.ql     |  5 ++-
 .../commons/Disposal/UndisposedParameter.ql   |  7 +--
 .../library-tests/complexity/Complexity.ql    |  5 ++-
 .../constructors/Constructors1.ql             |  2 +-
 .../constructors/Constructors2.ql             |  2 +-
 .../constructors/Constructors3.ql             | 11 ++---
 .../constructors/Constructors4.ql             |  2 +-
 .../constructors/Destructors1.ql              |  7 +--
 .../constructors/Destructors2.ql              |  2 +-
 .../constructors/Destructors3.ql              | 11 ++---
 .../constructors/Destructors4.ql              |  2 +-
 .../constructors/Destructors5.ql              |  8 ++--
 .../controlflow/graph/BasicBlock.ql           |  5 +--
 .../controlflow/graph/Common.qll              | 18 ++------
 .../controlflow/graph/ConditionBlock.ql       |  3 +-
 .../controlflow/graph/ConditionalFlow.ql      | 15 ++++---
 .../controlflow/graph/ElementGraph.ql         |  7 ++-
 .../controlflow/graph/FinallyNode.ql          |  7 ++-
 .../controlflow/graph/NodeGraph.ql            |  7 +--
 .../graph/PreBasicBlockConsistency.ql         |  4 +-
 .../controlflow/guards/MatchingGuardedExpr.ql |  5 ++-
 .../library-tests/conversion/boxing/Boxing.ql | 19 ++++----
 .../conversion/identity/Identity.ql           |  8 ++--
 .../conversion/nullable/Nullable.ql           | 14 +++---
 .../conversion/numeric/Numeric.ql             |  8 ++--
 .../conversion/operator/Operator.ql           | 23 +++++-----
 .../conversion/reftype/RefType.ql             | 38 +++++++++-------
 .../library-tests/csharp6/MemberAccess1.ql    |  6 ++-
 .../library-tests/csharp6/MemberAccess2.ql    |  6 ++-
 .../library-tests/csharp7.2/InParameters.ql   |  5 ++-
 .../csharp7.2/PrivateProtected.ql             |  7 +--
 .../csharp7.2/ReadonlyStructs.ql              |  5 ++-
 .../csharp7.2/RefReadonlyDelegate.ql          |  5 ++-
 .../csharp7.2/RefReadonlyReturns.ql           |  5 ++-
 .../library-tests/csharp7.2/RefStructs.ql     |  5 ++-
 .../ql/test/library-tests/csharp7/Access.ql   |  5 ++-
 .../csharp7/ConstructedLocalFunctions.ql      |  1 -
 .../ql/test/library-tests/csharp7/DefUse.ql   | 10 ++---
 .../ql/test/library-tests/csharp7/ForEach.ql  |  3 +-
 .../test/library-tests/csharp7/GlobalFlow.ql  |  5 +--
 .../csharp7/GlobalTaintTracking.ql            |  5 +--
 .../ql/test/library-tests/csharp7/IsFlow.ql   |  3 +-
 .../test/library-tests/csharp7/IsPatterns.ql  |  5 +--
 .../ql/test/library-tests/csharp7/Literals.ql |  5 ++-
 .../library-tests/csharp7/LocalFunctions.ql   |  3 +-
 .../library-tests/csharp7/RefFunctions.ql     |  5 ++-
 .../library-tests/csharp7/TaintReaches.ql     |  1 -
 .../test/library-tests/csharp7/TupleAccess.ql |  2 +-
 .../test/library-tests/csharp7/TupleTypes.ql  |  3 +-
 .../test/library-tests/csharp7/TypeCase2.ql   |  5 +--
 .../dataflow/callablereturnsarg/Common.qll    |  9 ++--
 .../dataflow/callablereturnsarg/DataFlow.ql   |  6 ++-
 .../callablereturnsarg/TaintTracking.ql       | 14 +++---
 .../dataflow/defuse/defUseEquivalence.ql      | 21 ++++++---
 .../defuse/parameterUseEquivalence.ql         | 25 ++++++++---
 .../dataflow/defuse/useUseEquivalence.ql      | 26 ++++++-----
 .../library-tests/dataflow/global/Common.qll  |  3 +-
 .../library-tests/dataflow/global/DataFlow.ql |  8 ++--
 .../dataflow/global/DataFlowPath.ql           |  9 ++--
 .../dataflow/global/TaintTracking.ql          | 21 ++++-----
 .../dataflow/global/TaintTrackingPath.ql      | 22 ++++-----
 .../dataflow/library/LibraryTypeDataFlow.ql   | 12 +++--
 .../library-tests/dataflow/local/Common.qll   |  6 +--
 .../library-tests/dataflow/local/DataFlow.ql  |  3 +-
 .../dataflow/local/TaintTracking.ql           |  3 +-
 .../dataflow/ssa-large/countssa.ql            |  6 ++-
 .../dataflow/ssa/BaseSsaConsistency.ql        |  5 ++-
 .../ssa/IsLiveOutRefParameterDefinition.ql    |  5 ++-
 .../dataflow/ssa/PreSsaConsistency.ql         | 33 +++++++-------
 .../test/library-tests/dataflow/ssa/SSAPhi.ql |  5 ++-
 .../dataflow/ssa/SsaCapturedVariableDef.ql    | 10 ++++-
 .../library-tests/dataflow/ssa/SsaRead.ql     |  5 ++-
 .../dataflow/ssa/SsaUltimateDef.ql            |  5 ++-
 .../library-tests/delegates/Delegates1.ql     |  6 ++-
 .../library-tests/delegates/Delegates2.ql     | 24 +++++-----
 .../library-tests/delegates/Delegates3.ql     | 14 +++---
 .../test/library-tests/dispatch/CallGraph.ql  |  5 ++-
 .../dispatch/GetADynamicTarget.ql             |  5 ++-
 .../library-tests/dispatch/exactCallable.ql   | 11 ++---
 csharp/ql/test/library-tests/enums/Enums1.ql  |  7 +--
 csharp/ql/test/library-tests/enums/Enums10.ql | 25 ++++++-----
 csharp/ql/test/library-tests/enums/Enums2.ql  | 11 ++---
 csharp/ql/test/library-tests/enums/Enums3.ql  | 11 ++---
 csharp/ql/test/library-tests/enums/Enums4.ql  |  4 +-
 csharp/ql/test/library-tests/enums/Enums5.ql  |  7 +--
 csharp/ql/test/library-tests/enums/Enums6.ql  | 13 +++---
 csharp/ql/test/library-tests/enums/Enums7.ql  | 13 +++---
 csharp/ql/test/library-tests/enums/Enums8.ql  | 15 ++++---
 csharp/ql/test/library-tests/enums/Enums9.ql  | 15 ++++---
 .../ql/test/library-tests/events/Events1.ql   |  9 ++--
 .../ql/test/library-tests/events/Events10.ql  |  2 +-
 .../ql/test/library-tests/events/Events11.ql  | 13 +++---
 .../ql/test/library-tests/events/Events12.ql  | 13 +++---
 .../ql/test/library-tests/events/Events2.ql   |  9 ++--
 .../ql/test/library-tests/events/Events3.ql   |  9 ++--
 .../ql/test/library-tests/events/Events4.ql   | 11 ++---
 .../ql/test/library-tests/events/Events5.ql   | 10 +++--
 .../ql/test/library-tests/events/Events6.ql   |  2 +-
 .../ql/test/library-tests/events/Events7.ql   |  9 ++--
 .../ql/test/library-tests/events/Events8.ql   |  5 +--
 .../ql/test/library-tests/events/Events9.ql   |  7 +--
 .../expressions/AddEventExpr1.ql              | 11 ++---
 .../expressions/AnonymousMethod1.ql           | 12 ++---
 .../expressions/AnonymousMethod2.ql           | 14 +++---
 .../expressions/AnonymousMethod3.ql           | 10 +++--
 .../expressions/AnonymousMethod4.ql           |  8 ++--
 .../expressions/AnonymousMethod5.ql           | 12 ++---
 .../expressions/AnonymousObjectCreation1.ql   | 16 ++++---
 .../expressions/AnonymousObjectCreation2.ql   | 16 ++++---
 .../expressions/AnonymousObjectCreation3.ql   | 16 ++++---
 .../expressions/AnonymousObjectCreation4.ql   | 22 ++++-----
 .../library-tests/expressions/ArrayAccess1.ql | 11 ++---
 .../expressions/ArrayCreation1.ql             | 25 ++++++-----
 .../expressions/ArrayCreation10.ql            | 22 ++++-----
 .../expressions/ArrayCreation2.ql             | 29 ++++++------
 .../expressions/ArrayCreation3.ql             | 21 ++++-----
 .../expressions/ArrayCreation4.ql             | 23 +++++-----
 .../expressions/ArrayCreation5.ql             | 23 +++++-----
 .../expressions/ArrayCreation6.ql             | 21 ++++-----
 .../expressions/ArrayCreation7.ql             | 21 ++++-----
 .../expressions/ArrayCreation8.ql             | 21 ++++-----
 .../expressions/ArrayCreation9.ql             | 20 +++++----
 .../ql/test/library-tests/expressions/As1.ql  | 13 +++---
 .../library-tests/expressions/BaseAccess1.ql  |  7 +--
 .../test/library-tests/expressions/Call1.ql   | 13 +++---
 .../test/library-tests/expressions/Call2.ql   | 13 +++---
 .../test/library-tests/expressions/Call3.ql   | 13 +++---
 .../test/library-tests/expressions/Call4.ql   | 15 ++++---
 .../test/library-tests/expressions/Call5.ql   | 19 ++++----
 .../test/library-tests/expressions/Call6.ql   | 17 +++----
 .../test/library-tests/expressions/Call7.ql   | 15 ++++---
 .../test/library-tests/expressions/Cast1.ql   | 13 +++---
 .../test/library-tests/expressions/Cast2.ql   | 11 ++---
 .../test/library-tests/expressions/Cast3.ql   | 12 ++---
 .../expressions/ConstructorInitializer1.ql    | 17 +++----
 .../expressions/ConstructorInitializer2.ql    | 17 +++----
 .../library-tests/expressions/Default1.ql     | 11 ++---
 .../library-tests/expressions/Default2.ql     | 13 +++---
 .../expressions/DelegateCall1.ql              | 15 ++++---
 .../expressions/DelegateCall2.ql              | 15 ++++---
 .../expressions/DelegateCall3.ql              | 13 +++---
 .../expressions/DelegateCreation1.ql          | 11 ++---
 .../expressions/DelegateCreation2.ql          | 11 ++---
 .../expressions/DelegateCreation3.ql          | 13 +++---
 .../expressions/DelegateCreation4.ql          | 11 ++---
 .../expressions/DelegateCreation5.ql          |  9 ++--
 .../expressions/DelegateCreation6.ql          |  9 ++--
 .../library-tests/expressions/EventAccess1.ql | 13 +++---
 .../library-tests/expressions/EventAccess2.ql | 13 +++---
 .../library-tests/expressions/EventAccess3.ql | 19 ++++----
 .../expressions/ExprsChecked1.ql              |  9 ++--
 .../expressions/ExprsUnchecked1.ql            | 11 ++---
 .../library-tests/expressions/FieldAccess1.ql | 11 ++---
 .../expressions/IndexerAccess1.ql             | 13 +++---
 .../expressions/IndexerAccess2.ql             | 13 +++---
 .../ql/test/library-tests/expressions/Is1.ql  | 11 ++---
 .../test/library-tests/expressions/Lambda1.ql | 12 ++---
 .../test/library-tests/expressions/Lambda2.ql | 12 ++---
 .../test/library-tests/expressions/Lambda3.ql | 14 +++---
 .../test/library-tests/expressions/Lambda4.ql | 14 +++---
 .../test/library-tests/expressions/Lambda5.ql | 18 ++++----
 .../test/library-tests/expressions/Lambda6.ql | 12 ++---
 .../library-tests/expressions/Literals1.ql    | 13 +++---
 .../library-tests/expressions/Literals10.ql   |  9 ++--
 .../library-tests/expressions/Literals11.ql   |  9 ++--
 .../library-tests/expressions/Literals2.ql    |  9 ++--
 .../library-tests/expressions/Literals3.ql    |  9 ++--
 .../library-tests/expressions/Literals4.ql    |  9 ++--
 .../library-tests/expressions/Literals5.ql    |  9 ++--
 .../library-tests/expressions/Literals6.ql    |  9 ++--
 .../library-tests/expressions/Literals7.ql    |  9 ++--
 .../library-tests/expressions/Literals8.ql    |  9 ++--
 .../library-tests/expressions/Literals9.ql    |  9 ++--
 .../expressions/LocalConstAccess1.ql          | 13 +++---
 .../expressions/LocalVarAccess1.ql            | 11 ++---
 .../expressions/LocalVarAccess2.ql            | 11 ++---
 .../expressions/LogicalOperators1.ql          |  7 +--
 .../expressions/ObjectCreation1.ql            | 13 +++---
 .../expressions/ObjectCreation10.ql           |  9 ++--
 .../expressions/ObjectCreation11.ql           |  9 ++--
 .../expressions/ObjectCreation2.ql            | 17 +++----
 .../expressions/ObjectCreation3.ql            | 15 ++++---
 .../expressions/ObjectCreation4.ql            | 32 ++++++-------
 .../expressions/ObjectCreation5.ql            | 34 +++++++-------
 .../expressions/ObjectCreation6.ql            | 34 +++++++-------
 .../expressions/ObjectCreation7.ql            | 34 +++++++-------
 .../expressions/ObjectCreation8.ql            | 22 ++++-----
 .../expressions/ObjectCreation9.ql            | 21 ++++-----
 .../expressions/OperatorCall1.ql              | 15 ++++---
 .../expressions/OperatorCall2.ql              | 11 ++---
 .../expressions/OperatorCall3.ql              | 15 ++++---
 .../expressions/OperatorCall4.ql              | 15 ++++---
 .../expressions/OperatorCall5.ql              | 15 ++++---
 .../expressions/OperatorCall6.ql              | 13 +++---
 .../expressions/OperatorCall7.ql              |  9 ++--
 .../expressions/ParameterAccess1.ql           | 11 ++---
 .../expressions/ParameterAccess2.ql           | 11 ++---
 .../expressions/ParameterAccess3.ql           | 12 ++---
 .../expressions/PropertyAccess1.ql            | 15 ++++---
 .../expressions/PropertyAccess2.ql            | 13 +++---
 .../expressions/PropertyAccess3.ql            | 13 +++---
 .../expressions/PropertyAccess4.ql            | 13 +++---
 .../expressions/RemoveEventExpr1.ql           | 11 ++---
 .../library-tests/expressions/ThisAccess1.ql  |  7 +--
 .../test/library-tests/expressions/Typeof1.ql |  9 ++--
 .../test/library-tests/expressions/Typeof2.ql |  9 ++--
 .../test/library-tests/expressions/Typeof3.ql |  9 ++--
 .../test/library-tests/expressions/Typeof4.ql |  9 ++--
 .../test/library-tests/expressions/Typeof5.ql |  9 ++--
 .../exprorstmtparent/Property.ql              |  6 ++-
 .../test/library-tests/fields/Constants1.ql   | 15 ++++---
 .../test/library-tests/fields/Constants2.ql   | 15 ++++---
 .../test/library-tests/fields/Constants3.ql   | 15 ++++---
 .../test/library-tests/fields/Constants4.ql   |  1 +
 .../test/library-tests/fields/Constants5.ql   |  1 +
 .../ql/test/library-tests/fields/Fields1.ql   | 14 +++---
 .../ql/test/library-tests/fields/Fields10.ql  | 11 ++---
 .../ql/test/library-tests/fields/Fields2.ql   | 14 +++---
 .../ql/test/library-tests/fields/Fields3.ql   | 14 +++---
 .../ql/test/library-tests/fields/Fields4.ql   | 14 +++---
 .../ql/test/library-tests/fields/Fields5.ql   | 14 +++---
 .../ql/test/library-tests/fields/Fields6.ql   | 15 ++++---
 .../ql/test/library-tests/fields/Fields7.ql   | 13 +++---
 .../ql/test/library-tests/fields/Fields8.ql   | 13 +++---
 .../ql/test/library-tests/fields/Fields9.ql   | 15 ++++---
 .../ql/test/library-tests/folding/Folding1.ql |  8 ++--
 .../test/library-tests/frameworks/sql/Sql1.ql |  3 +-
 .../frameworks/system/Dispose/Dispose.ql      |  6 ++-
 .../frameworks/system/Equals/Equals.ql        |  6 ++-
 .../frameworks/system/System/System.ql        |  9 ++--
 .../library-tests/frameworks/test/Test.ql     | 18 +++-----
 .../generatedcode/generatedcode.ql            |  1 -
 .../generics/ConsistencyChecks.ql             |  2 +-
 .../test/library-tests/generics/Generics1.ql  |  8 ++--
 .../test/library-tests/generics/Generics10.ql | 18 +++++---
 .../test/library-tests/generics/Generics11.ql | 10 +++--
 .../test/library-tests/generics/Generics12.ql | 12 ++---
 .../test/library-tests/generics/Generics13.ql |  8 ++--
 .../test/library-tests/generics/Generics14.ql |  8 ++--
 .../test/library-tests/generics/Generics15.ql |  8 ++--
 .../test/library-tests/generics/Generics16.ql |  6 ++-
 .../test/library-tests/generics/Generics17.ql | 15 ++++---
 .../test/library-tests/generics/Generics18.ql |  6 ++-
 .../test/library-tests/generics/Generics19.ql |  9 ++--
 .../test/library-tests/generics/Generics2.ql  |  6 ++-
 .../test/library-tests/generics/Generics20.ql |  2 +-
 .../test/library-tests/generics/Generics21.ql | 22 ++++-----
 .../test/library-tests/generics/Generics22.ql |  5 ++-
 .../test/library-tests/generics/Generics23.ql |  5 ++-
 .../test/library-tests/generics/Generics24.ql |  6 +--
 .../test/library-tests/generics/Generics25.ql | 33 +++++---------
 .../test/library-tests/generics/Generics26.ql |  9 ++--
 .../test/library-tests/generics/Generics27.ql |  9 ++--
 .../test/library-tests/generics/Generics3.ql  | 12 ++---
 .../test/library-tests/generics/Generics4.ql  |  1 +
 .../test/library-tests/generics/Generics5.ql  |  1 +
 .../test/library-tests/generics/Generics6.ql  | 20 +++++----
 .../test/library-tests/generics/Generics7.ql  | 10 +++--
 .../test/library-tests/generics/Generics8.ql  | 12 ++---
 .../test/library-tests/generics/Generics9.ql  | 16 ++++---
 csharp/ql/test/library-tests/goto/Goto1.ql    |  3 +-
 .../test/library-tests/indexers/Indexers1.ql  |  3 +-
 .../test/library-tests/indexers/Indexers10.ql | 11 ++---
 .../test/library-tests/indexers/Indexers11.ql |  2 +-
 .../test/library-tests/indexers/Indexers2.ql  |  9 ++--
 .../test/library-tests/indexers/Indexers3.ql  | 11 ++---
 .../test/library-tests/indexers/Indexers4.ql  |  7 +--
 .../test/library-tests/indexers/Indexers5.ql  | 11 ++---
 .../test/library-tests/indexers/Indexers6.ql  | 11 ++---
 .../test/library-tests/indexers/Indexers7.ql  |  9 ++--
 .../test/library-tests/indexers/Indexers8.ql  | 11 ++---
 .../test/library-tests/indexers/Indexers9.ql  | 11 ++---
 .../initializers/CollectionInitializer.ql     |  2 +-
 csharp/ql/test/library-tests/linq/Linq1.ql    |  1 +
 csharp/ql/test/library-tests/linq/Linq2.ql    |  1 +
 .../library-tests/members/AccessModifiers.ql  |  3 +-
 .../library-tests/methods/ExtensionMethods.ql |  9 +++-
 .../ql/test/library-tests/methods/Methods1.ql |  7 +--
 .../ql/test/library-tests/methods/Methods2.ql | 11 ++---
 .../ql/test/library-tests/methods/Methods3.ql |  9 ++--
 .../ql/test/library-tests/methods/Methods4.ql | 11 ++---
 .../ql/test/library-tests/methods/Methods5.ql |  5 ++-
 .../test/library-tests/methods/Parameters1.ql | 19 ++++----
 .../test/library-tests/methods/Parameters2.ql | 31 ++++++-------
 .../test/library-tests/methods/Parameters3.ql | 19 ++++----
 .../test/library-tests/methods/Parameters4.ql |  2 +-
 .../test/library-tests/methods/Parameters5.ql | 11 ++---
 .../test/library-tests/methods/Parameters6.ql | 11 ++---
 .../test/library-tests/methods/Parameters8.ql |  5 ++-
 .../test/library-tests/methods/Parameters9.ql |  7 +--
 .../library-tests/modifiers/Effectively.ql    | 10 +++--
 .../library-tests/namespaces/Namespaces1.ql   |  9 ++--
 .../library-tests/namespaces/Namespaces10.ql  | 17 +++----
 .../library-tests/namespaces/Namespaces11.ql  |  9 ++--
 .../library-tests/namespaces/Namespaces12.ql  |  8 ++--
 .../library-tests/namespaces/Namespaces2.ql   |  9 ++--
 .../library-tests/namespaces/Namespaces3.ql   | 13 +++---
 .../library-tests/namespaces/Namespaces4.ql   | 17 +++----
 .../library-tests/namespaces/Namespaces5.ql   |  7 +--
 .../library-tests/namespaces/Namespaces6.ql   | 13 +++---
 .../library-tests/namespaces/Namespaces7.ql   | 13 +++---
 .../library-tests/namespaces/Namespaces8.ql   | 13 +++---
 .../library-tests/namespaces/Namespaces9.ql   | 13 +++---
 .../library-tests/nestedtypes/NestedTypes1.ql | 13 +++---
 .../library-tests/nestedtypes/NestedTypes2.ql | 11 ++---
 .../library-tests/nestedtypes/NestedTypes3.ql | 11 ++---
 .../library-tests/nestedtypes/NestedTypes4.ql | 19 ++++----
 .../library-tests/nestedtypes/NestedTypes5.ql | 13 +++---
 .../library-tests/nestedtypes/NestedTypes6.ql |  9 ++--
 .../library-tests/nestedtypes/NestedTypes7.ql | 11 ++---
 .../library-tests/nestedtypes/NestedTypes8.ql | 13 +++---
 .../library-tests/nestedtypes/NestedTypes9.ql | 11 ++---
 .../nullable/NullableExpressions.ql           |  3 +-
 .../library-tests/operators/Operators1.ql     |  9 ++--
 .../library-tests/operators/Operators2.ql     |  7 +--
 .../library-tests/operators/Operators3.ql     |  7 +--
 .../library-tests/operators/Operators4.ql     |  7 +--
 .../library-tests/overrides/Implements.ql     |  7 +--
 .../library-tests/overrides/Overrides1.ql     | 10 +++--
 .../library-tests/overrides/Overrides10.ql    | 10 +++--
 .../library-tests/overrides/Overrides11.ql    | 10 +++--
 .../library-tests/overrides/Overrides12.ql    | 10 +++--
 .../library-tests/overrides/Overrides13.ql    | 10 +++--
 .../library-tests/overrides/Overrides14.ql    | 15 ++++---
 .../library-tests/overrides/Overrides15.ql    | 10 +++--
 .../library-tests/overrides/Overrides16.ql    | 10 +++--
 .../library-tests/overrides/Overrides17.ql    | 10 +++--
 .../library-tests/overrides/Overrides18.ql    |  9 ++--
 .../library-tests/overrides/Overrides19.ql    |  6 ++-
 .../library-tests/overrides/Overrides2.ql     | 10 +++--
 .../library-tests/overrides/Overrides20.ql    |  5 ++-
 .../library-tests/overrides/Overrides21.ql    |  6 ++-
 .../library-tests/overrides/Overrides22.ql    | 11 +++--
 .../library-tests/overrides/Overrides3.ql     | 10 +++--
 .../library-tests/overrides/Overrides4.ql     | 10 +++--
 .../library-tests/overrides/Overrides5.ql     | 10 +++--
 .../library-tests/overrides/Overrides6.ql     | 10 +++--
 .../library-tests/overrides/Overrides7.ql     | 15 ++++---
 .../library-tests/overrides/Overrides8.ql     | 10 +++--
 .../library-tests/overrides/Overrides9.ql     | 10 +++--
 .../library-tests/properties/Properties1.ql   | 19 ++++----
 .../library-tests/properties/Properties10.ql  | 13 +++---
 .../library-tests/properties/Properties11.ql  | 13 +++---
 .../library-tests/properties/Properties12.ql  | 13 +++---
 .../library-tests/properties/Properties13.ql  | 17 ++++---
 .../library-tests/properties/Properties14.ql  | 13 +++---
 .../library-tests/properties/Properties15.ql  | 17 ++++---
 .../library-tests/properties/Properties16.ql  | 10 +++--
 .../library-tests/properties/Properties17.ql  |  4 +-
 .../library-tests/properties/Properties18.ql  |  5 ++-
 .../library-tests/properties/Properties2.ql   |  9 ++--
 .../library-tests/properties/Properties3.ql   | 13 +++---
 .../library-tests/properties/Properties4.ql   | 15 ++++---
 .../library-tests/properties/Properties5.ql   | 19 ++++----
 .../library-tests/properties/Properties6.ql   | 13 +++---
 .../library-tests/properties/Properties7.ql   | 14 +++---
 .../library-tests/properties/Properties8.ql   | 10 +++--
 .../library-tests/properties/Properties9.ql   | 17 ++++---
 .../regressions/CheckExtractionSucceeded.ql   |  3 +-
 .../dataflow/flowsources/StoredFlowSources.ql | 12 ++---
 .../standalone/controlflow/cfg.ql             |  4 +-
 .../standalone/errorrecovery/ErrorCalls.ql    | 13 ++----
 .../standalone/errorrecovery/Methods.ql       |  2 +-
 .../standalone/normalmode/normal.ql           |  7 +--
 .../standalone/regressions/QualifierAccess.ql | 10 +++--
 .../standalone/standalonemode/standalone.ql   |  7 +--
 .../test/library-tests/statements/Block1.ql   | 12 +++--
 .../test/library-tests/statements/Block2.ql   |  7 +--
 .../test/library-tests/statements/Block3.ql   |  6 +--
 .../test/library-tests/statements/Block4.ql   |  6 ++-
 .../test/library-tests/statements/Break1.ql   |  8 ++--
 .../test/library-tests/statements/Checked1.ql |  6 ++-
 .../library-tests/statements/Continue1.ql     |  8 ++--
 .../ql/test/library-tests/statements/Do1.ql   |  1 +
 .../ql/test/library-tests/statements/Do2.ql   |  6 ++-
 .../ql/test/library-tests/statements/Expr1.ql |  6 ++-
 .../test/library-tests/statements/Fixed2.ql   |  2 +-
 .../ql/test/library-tests/statements/For1.ql  |  1 +
 .../ql/test/library-tests/statements/For2.ql  |  6 ++-
 .../ql/test/library-tests/statements/For3.ql  |  8 ++--
 .../ql/test/library-tests/statements/For4.ql  |  8 ++--
 .../test/library-tests/statements/Foreach1.ql |  1 +
 .../test/library-tests/statements/Foreach2.ql | 10 +++--
 .../test/library-tests/statements/Foreach3.ql | 10 +++--
 .../ql/test/library-tests/statements/Goto1.ql |  8 ++--
 .../ql/test/library-tests/statements/Goto2.ql |  8 ++--
 .../ql/test/library-tests/statements/If1.ql   |  1 +
 .../ql/test/library-tests/statements/If2.ql   |  8 ++--
 .../test/library-tests/statements/Labeled1.ql |  6 ++-
 .../statements/LocalConstDecl1.ql             | 16 ++++---
 .../statements/LocalConstDecl2.ql             | 14 +++---
 .../statements/LocalConstDecl3.ql             | 12 ++---
 .../library-tests/statements/LocalVarDecl1.ql | 12 ++---
 .../library-tests/statements/LocalVarDecl2.ql | 12 ++---
 .../library-tests/statements/LocalVarDecl3.ql | 14 +++---
 .../library-tests/statements/LocalVarDecl4.ql | 12 ++---
 .../library-tests/statements/LocalVarDecl5.ql | 14 +++---
 .../ql/test/library-tests/statements/Lock1.ql |  1 +
 .../ql/test/library-tests/statements/Lock2.ql |  6 ++-
 .../test/library-tests/statements/Return1.ql  | 10 +++--
 .../test/library-tests/statements/Return2.ql  |  8 ++--
 .../test/library-tests/statements/Switch1.ql  |  4 +-
 .../test/library-tests/statements/Switch2.ql  |  1 +
 .../test/library-tests/statements/Switch3.ql  |  1 +
 .../test/library-tests/statements/Switch4.ql  |  1 +
 .../test/library-tests/statements/Throw1.ql   |  6 ++-
 .../library-tests/statements/TryCatch1.ql     |  8 +++-
 .../library-tests/statements/TryCatch2.ql     |  8 ++--
 .../library-tests/statements/TryCatch3.ql     | 14 +++---
 .../library-tests/statements/TryCatch4.ql     | 10 +++--
 .../library-tests/statements/TryCatch5.ql     | 14 +++---
 .../library-tests/statements/TryCatch6.ql     | 16 ++++---
 .../library-tests/statements/TryCatch7.ql     | 10 +++--
 .../library-tests/statements/TryCatch8.ql     | 10 +++--
 .../library-tests/statements/TryFinally1.ql   |  6 ++-
 .../library-tests/statements/Unchecked1.ql    |  6 ++-
 .../test/library-tests/statements/Using1.ql   |  8 +++-
 .../test/library-tests/statements/Using2.ql   | 10 +++--
 .../test/library-tests/statements/Using3.ql   | 12 ++---
 .../test/library-tests/statements/While1.ql   |  1 +
 .../test/library-tests/statements/While2.ql   |  6 ++-
 .../library-tests/statements/YieldBreak1.ql   |  6 ++-
 .../library-tests/statements/YieldReturn1.ql  |  1 +
 .../library-tests/statements/YieldReturn2.ql  |  6 ++-
 .../library-tests/statements/YieldReturn3.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types1.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types10.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types11.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types12.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types13.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types14.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types15.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types16.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types17.ql |  1 +
 csharp/ql/test/library-tests/types/Types18.ql |  1 +
 csharp/ql/test/library-tests/types/Types19.ql |  1 +
 csharp/ql/test/library-tests/types/Types2.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types20.ql |  1 +
 csharp/ql/test/library-tests/types/Types21.ql |  1 +
 csharp/ql/test/library-tests/types/Types22.ql |  1 +
 csharp/ql/test/library-tests/types/Types23.ql |  1 +
 csharp/ql/test/library-tests/types/Types24.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types25.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types26.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types27.ql |  1 +
 csharp/ql/test/library-tests/types/Types28.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types29.ql |  6 ++-
 csharp/ql/test/library-tests/types/Types3.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types30.ql | 12 ++---
 csharp/ql/test/library-tests/types/Types31.ql | 14 +++---
 csharp/ql/test/library-tests/types/Types32.ql |  8 ++--
 csharp/ql/test/library-tests/types/Types33.ql | 10 +++--
 csharp/ql/test/library-tests/types/Types34.ql | 12 +++--
 csharp/ql/test/library-tests/types/Types35.ql | 10 +++--
 csharp/ql/test/library-tests/types/Types36.ql |  1 -
 csharp/ql/test/library-tests/types/Types4.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types5.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types6.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types7.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types8.ql  |  6 ++-
 csharp/ql/test/library-tests/types/Types9.ql  |  6 ++-
 485 files changed, 2748 insertions(+), 2181 deletions(-)

diff --git a/csharp/ql/test/library-tests/arguments/argumentType.ql b/csharp/ql/test/library-tests/arguments/argumentType.ql
index 952a175d2f58..968139ecaddd 100644
--- a/csharp/ql/test/library-tests/arguments/argumentType.ql
+++ b/csharp/ql/test/library-tests/arguments/argumentType.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from Expr e, int m
-where expr_argument(e,m)
+where expr_argument(e, m)
 select e, m
diff --git a/csharp/ql/test/library-tests/asp/basic/AspDirective.ql b/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
index 41fac184e126..a23fa466b996 100644
--- a/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
+++ b/csharp/ql/test/library-tests/asp/basic/AspDirective.ql
@@ -3,4 +3,3 @@ import semmle.code.asp.AspNet
 from AspDirective directive, string name, AspAttribute attrib
 where directive.getAttributeByName(name) = attrib
 select directive, name, attrib
-
diff --git a/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql b/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
index 1133f7d58320..541e258321be 100644
--- a/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
+++ b/csharp/ql/test/library-tests/asp/basic/AspOpenTag.ql
@@ -3,4 +3,3 @@ import semmle.code.asp.AspNet
 from AspOpenTag tag, string name, AspAttribute attrib
 where tag.getAttributeByName(name) = attrib
 select tag, name, attrib
-
diff --git a/csharp/ql/test/library-tests/asp/basic/comments.ql b/csharp/ql/test/library-tests/asp/basic/comments.ql
index be113da412dc..aec0b1004744 100644
--- a/csharp/ql/test/library-tests/asp/basic/comments.ql
+++ b/csharp/ql/test/library-tests/asp/basic/comments.ql
@@ -1,8 +1,5 @@
 import semmle.code.asp.AspNet
 
 from AspComment comment, string kind
-where
-  if comment instanceof AspServerComment
-  then kind = "server"
-  else kind = "client"
+where if comment instanceof AspServerComment then kind = "server" else kind = "client"
 select comment, comment.getBody(), kind
diff --git a/csharp/ql/test/library-tests/asp/parseError/AspDirective.ql b/csharp/ql/test/library-tests/asp/parseError/AspDirective.ql
index 41fac184e126..a23fa466b996 100644
--- a/csharp/ql/test/library-tests/asp/parseError/AspDirective.ql
+++ b/csharp/ql/test/library-tests/asp/parseError/AspDirective.ql
@@ -3,4 +3,3 @@ import semmle.code.asp.AspNet
 from AspDirective directive, string name, AspAttribute attrib
 where directive.getAttributeByName(name) = attrib
 select directive, name, attrib
-
diff --git a/csharp/ql/test/library-tests/asp/parseError/AspOpenTag.ql b/csharp/ql/test/library-tests/asp/parseError/AspOpenTag.ql
index 1133f7d58320..541e258321be 100644
--- a/csharp/ql/test/library-tests/asp/parseError/AspOpenTag.ql
+++ b/csharp/ql/test/library-tests/asp/parseError/AspOpenTag.ql
@@ -3,4 +3,3 @@ import semmle.code.asp.AspNet
 from AspOpenTag tag, string name, AspAttribute attrib
 where tag.getAttributeByName(name) = attrib
 select tag, name, attrib
-
diff --git a/csharp/ql/test/library-tests/asp/parseError/comments.ql b/csharp/ql/test/library-tests/asp/parseError/comments.ql
index be113da412dc..aec0b1004744 100644
--- a/csharp/ql/test/library-tests/asp/parseError/comments.ql
+++ b/csharp/ql/test/library-tests/asp/parseError/comments.ql
@@ -1,8 +1,5 @@
 import semmle.code.asp.AspNet
 
 from AspComment comment, string kind
-where
-  if comment instanceof AspServerComment
-  then kind = "server"
-  else kind = "client"
+where if comment instanceof AspServerComment then kind = "server" else kind = "client"
 select comment, comment.getBody(), kind
diff --git a/csharp/ql/test/library-tests/assemblies/CompareVersions.ql b/csharp/ql/test/library-tests/assemblies/CompareVersions.ql
index 1a55f41f8945..cb4b6745258a 100644
--- a/csharp/ql/test/library-tests/assemblies/CompareVersions.ql
+++ b/csharp/ql/test/library-tests/assemblies/CompareVersions.ql
@@ -1,7 +1,6 @@
 import csharp
 
-Version getAVersion()
-{
+Version getAVersion() {
   result = "1.2" or
   result = "1.2.0" or
   result = "1.2.0.0" or
@@ -15,6 +14,7 @@ Version getAVersion()
 }
 
 from Version v1, Version v2
-where v1 = getAVersion()
-  and v2 = getAVersion()
+where
+  v1 = getAVersion() and
+  v2 = getAVersion()
 select v1, v2, v1.compareTo(v2)
diff --git a/csharp/ql/test/library-tests/assemblies/ValidVersions.ql b/csharp/ql/test/library-tests/assemblies/ValidVersions.ql
index 5ccaca908c78..da5b749200c7 100644
--- a/csharp/ql/test/library-tests/assemblies/ValidVersions.ql
+++ b/csharp/ql/test/library-tests/assemblies/ValidVersions.ql
@@ -1,12 +1,14 @@
 import csharp
 
 from Version version
-where version = "1.2.3.4"
-   or version = "2.3.24"
-   or version = "1.2"
-   or version = "xxx"
-   or version = "1.x"
-   or version = "1"
-   or version = ""
-   or version = "1234.56"
-select version, version.getMajor(), version.getMajorRevision(), version.getMinor(), version.getMinorRevision()
+where
+  version = "1.2.3.4" or
+  version = "2.3.24" or
+  version = "1.2" or
+  version = "xxx" or
+  version = "1.x" or
+  version = "1" or
+  version = "" or
+  version = "1234.56"
+select version, version.getMajor(), version.getMajorRevision(), version.getMinor(),
+  version.getMinorRevision()
diff --git a/csharp/ql/test/library-tests/assemblies/assemblies.ql b/csharp/ql/test/library-tests/assemblies/assemblies.ql
index 10b13cdf2628..4f49bfc83269 100644
--- a/csharp/ql/test/library-tests/assemblies/assemblies.ql
+++ b/csharp/ql/test/library-tests/assemblies/assemblies.ql
@@ -1,41 +1,18 @@
 import csharp
 
-class TypeRef extends @typeref
-{
-  string toString() {
-    hasName(result)
-  }
+class TypeRef extends @typeref {
+  string toString() { hasName(result) }
 
-  predicate hasName(string name) {
-    typerefs(this, name)
-  }
+  predicate hasName(string name) { typerefs(this, name) }
 
-  Type getType() {
-    typeref_type(this, result)
-  }
+  Type getType() { typeref_type(this, result) }
 }
 
-class MissingType extends TypeRef
-{
-  MissingType() {
-    not exists(getType())
-  }
-}
+class MissingType extends TypeRef { MissingType() { not exists(getType()) } }
 
 from
-  Class class1,
-  MissingType class2,
-  MissingType class3,
-  MissingType class4,
-  MissingType class5,
-  MissingType del2,
-  Field a,
-  Method b,
-  Method c,
-  Method d,
-  Method e,
-  Method f,
-  Method g
+  Class class1, MissingType class2, MissingType class3, MissingType class4, MissingType class5,
+  MissingType del2, Field a, Method b, Method c, Method d, Method e, Method f, Method g
 where
   class1.hasQualifiedName("Assembly1.Class1") and
   class2.hasName("Class2") and
@@ -50,10 +27,10 @@ where
   e.hasName("e") and
   f.hasName("f") and
   g.hasName("g") and
-  a.getDeclaringType()=class1 and
-  a.getDeclaringType()=class1 and
-  b.getDeclaringType()=class1 and
-  c.getDeclaringType()=class1 and
+  a.getDeclaringType() = class1 and
+  a.getDeclaringType() = class1 and
+  b.getDeclaringType() = class1 and
+  c.getDeclaringType() = class1 and
   not exists(c.getParameter(0).getType()) and
   not exists(a.getType()) and
   not exists(b.getReturnType()) and
diff --git a/csharp/ql/test/library-tests/assemblies/locations.ql b/csharp/ql/test/library-tests/assemblies/locations.ql
index 01e088279a1e..df22a55ca3c9 100644
--- a/csharp/ql/test/library-tests/assemblies/locations.ql
+++ b/csharp/ql/test/library-tests/assemblies/locations.ql
@@ -1,8 +1,9 @@
 import csharp
 
 from Element e, Class c, Method m, Parameter p
-where c.hasQualifiedName("Locations.Test")
-and m.getDeclaringType()=c
-and m.getAParameter()=p
-and (e=c or e=m or e=p)
+where
+  c.hasQualifiedName("Locations.Test") and
+  m.getDeclaringType() = c and
+  m.getAParameter() = p and
+  (e = c or e = m or e = p)
 select e
diff --git a/csharp/ql/test/library-tests/assemblylocation/AssemblyLocation.ql b/csharp/ql/test/library-tests/assemblylocation/AssemblyLocation.ql
index 04564bf9e82a..fd70c9d1ad41 100644
--- a/csharp/ql/test/library-tests/assemblylocation/AssemblyLocation.ql
+++ b/csharp/ql/test/library-tests/assemblylocation/AssemblyLocation.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from Element e, Assembly a
-where e.fromSource()
-and a = e.getALocation()
-and a.getFullName() = "program, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"
+where
+  e.fromSource() and
+  a = e.getALocation() and
+  a.getFullName() = "program, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"
 select e
diff --git a/csharp/ql/test/library-tests/assignables/AssignableAccess.ql b/csharp/ql/test/library-tests/assignables/AssignableAccess.ql
index 64d8fbf2e3f5..7735fc0c7262 100644
--- a/csharp/ql/test/library-tests/assignables/AssignableAccess.ql
+++ b/csharp/ql/test/library-tests/assignables/AssignableAccess.ql
@@ -1,7 +1,12 @@
 import csharp
 
 from AssignableAccess aa, Assignable a, string s
-where aa.getTarget() = a
-  and a.fromSource()
-  and (aa instanceof AssignableRead and s = "read" or aa instanceof AssignableWrite and s = "write")
+where
+  aa.getTarget() = a and
+  a.fromSource() and
+  (
+    aa instanceof AssignableRead and s = "read"
+    or
+    aa instanceof AssignableWrite and s = "write"
+  )
 select aa, a, s
diff --git a/csharp/ql/test/library-tests/assignables/AssignableDefinition.ql b/csharp/ql/test/library-tests/assignables/AssignableDefinition.ql
index e9485ee3739f..6f24ecaa0e90 100644
--- a/csharp/ql/test/library-tests/assignables/AssignableDefinition.ql
+++ b/csharp/ql/test/library-tests/assignables/AssignableDefinition.ql
@@ -6,7 +6,8 @@ newtype TTargetAccessOption =
 
 class TargetAccessOption extends TTargetAccessOption {
   string toString() {
-    result = som().toString() or
+    result = som().toString()
+    or
     exists(non()) and result = "<none>"
   }
 
@@ -15,19 +16,12 @@ class TargetAccessOption extends TTargetAccessOption {
     result = non().getLocation()
   }
 
-  private AssignableAccess som() {
-    this = TTargetAccessSome(result)
-  }
+  private AssignableAccess som() { this = TTargetAccessSome(result) }
 
-  private AssignableDefinition non() {
-    this = TTargetAccessNone(result)
-  }
+  private AssignableDefinition non() { this = TTargetAccessNone(result) }
 
   predicate fromAssignableDefinition(AssignableDefinition def) {
-    if exists(def.getTargetAccess()) then
-      this.som() = def.getTargetAccess()
-    else
-      this.non() = def
+    if exists(def.getTargetAccess()) then this.som() = def.getTargetAccess() else this.non() = def
   }
 }
 
@@ -37,7 +31,8 @@ newtype TSourceOption =
 
 class SourceOption extends TSourceOption {
   string toString() {
-    result = som().toString() or
+    result = som().toString()
+    or
     exists(non()) and result = "<none>"
   }
 
@@ -46,24 +41,18 @@ class SourceOption extends TSourceOption {
     result = non().getLocation()
   }
 
-  private Expr som() {
-    this = TSourceSome(result)
-  }
+  private Expr som() { this = TSourceSome(result) }
 
-  private AssignableDefinition non() {
-    this = TSourceNone(result)
-  }
+  private AssignableDefinition non() { this = TSourceNone(result) }
 
   predicate fromAssignableDefinition(AssignableDefinition def) {
-    if exists(def.getSource()) then
-      this.som() = def.getSource()
-    else
-      this.non() = def
+    if exists(def.getSource()) then this.som() = def.getSource() else this.non() = def
   }
 }
 
 from AssignableDefinition def, TargetAccessOption access, SourceOption source, string certain
-where (if def.isCertain() then certain = "certain" else certain = "uncertain")
-  and access.fromAssignableDefinition(def)
-  and source.fromAssignableDefinition(def)
+where
+  (if def.isCertain() then certain = "certain" else certain = "uncertain") and
+  access.fromAssignableDefinition(def) and
+  source.fromAssignableDefinition(def)
 select def.getTarget(), def, access, source, certain
diff --git a/csharp/ql/test/library-tests/assignments/AssignOperationExpanded.ql b/csharp/ql/test/library-tests/assignments/AssignOperationExpanded.ql
index aedd006e4e76..24ef67e5dfc7 100644
--- a/csharp/ql/test/library-tests/assignments/AssignOperationExpanded.ql
+++ b/csharp/ql/test/library-tests/assignments/AssignOperationExpanded.ql
@@ -2,18 +2,19 @@ import csharp
 
 predicate getExpandedOperatorArgs(Expr e, Expr left, Expr right) {
   e = any(BinaryArithmeticOperation bo |
-    bo.getLeftOperand() = left and
-    bo.getRightOperand() = right
-  )
+      bo.getLeftOperand() = left and
+      bo.getRightOperand() = right
+    )
   or
   e = any(OperatorCall oc |
-    oc.getArgument(0) = left and
-    oc.getArgument(1) = right
-  )
+      oc.getArgument(0) = left and
+      oc.getArgument(1) = right
+    )
 }
 
 from AssignOperation ao, AssignExpr ae, Expr op, Expr left, Expr right
-where ae = ao.getExpandedAssignment()
-  and op = ae.getRValue()
-  and getExpandedOperatorArgs(op, left, right)
+where
+  ae = ao.getExpandedAssignment() and
+  op = ae.getRValue() and
+  getExpandedOperatorArgs(op, left, right)
 select ao, ae, ae.getLValue(), op, left, right
diff --git a/csharp/ql/test/library-tests/attributes/Attributes1.ql b/csharp/ql/test/library-tests/attributes/Attributes1.ql
index a6d03f54fa6c..c283331dea56 100644
--- a/csharp/ql/test/library-tests/attributes/Attributes1.ql
+++ b/csharp/ql/test/library-tests/attributes/Attributes1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test that types, methods, and parameters can have attributes
  */
+
 import csharp
 
-where exists(Attribute a | a.getTarget() instanceof Type)
-  and exists(Attribute a | a.getTarget() instanceof Method)
-  and exists(Attribute a | a.getTarget() instanceof Parameter)
+where
+  exists(Attribute a | a.getTarget() instanceof Type) and
+  exists(Attribute a | a.getTarget() instanceof Method) and
+  exists(Attribute a | a.getTarget() instanceof Parameter)
 select 1
diff --git a/csharp/ql/test/library-tests/cil/dataflow/DataFlow.ql b/csharp/ql/test/library-tests/cil/dataflow/DataFlow.ql
index 7e4dbb3bdcf4..c80e9ed683e7 100644
--- a/csharp/ql/test/library-tests/cil/dataflow/DataFlow.ql
+++ b/csharp/ql/test/library-tests/cil/dataflow/DataFlow.ql
@@ -2,14 +2,12 @@ import csharp
 import semmle.code.csharp.dataflow.DataFlow::DataFlow
 
 class FlowConfig extends Configuration {
-  FlowConfig() { this="FlowConfig" }
+  FlowConfig() { this = "FlowConfig" }
 
-  override predicate isSource(Node source) {
-    source.asExpr() instanceof Literal
-  }
+  override predicate isSource(Node source) { source.asExpr() instanceof Literal }
 
   override predicate isSink(Node sink) {
-    exists(LocalVariable decl | sink.asExpr()=decl.getInitializer())
+    exists(LocalVariable decl | sink.asExpr() = decl.getInitializer())
   }
 }
 
diff --git a/csharp/ql/test/library-tests/cil/dataflow/TaintTracking.ql b/csharp/ql/test/library-tests/cil/dataflow/TaintTracking.ql
index fd8594a21c91..d0dbafc06589 100644
--- a/csharp/ql/test/library-tests/cil/dataflow/TaintTracking.ql
+++ b/csharp/ql/test/library-tests/cil/dataflow/TaintTracking.ql
@@ -2,14 +2,12 @@ import csharp
 import semmle.code.csharp.dataflow.TaintTracking
 
 class FlowConfig extends TaintTracking::Configuration {
-  FlowConfig() { this="FlowConfig" }
+  FlowConfig() { this = "FlowConfig" }
 
-  override predicate isSource(DataFlow::Node source) {
-    source.asExpr() instanceof Literal
-  }
+  override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof Literal }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(LocalVariable decl | sink.asExpr()=decl.getInitializer())
+    exists(LocalVariable decl | sink.asExpr() = decl.getInitializer())
   }
 }
 
diff --git a/csharp/ql/test/library-tests/cil/pdbs/InstructionLocations.ql b/csharp/ql/test/library-tests/cil/pdbs/InstructionLocations.ql
index 9e276f323674..4775428fd322 100644
--- a/csharp/ql/test/library-tests/cil/pdbs/InstructionLocations.ql
+++ b/csharp/ql/test/library-tests/cil/pdbs/InstructionLocations.ql
@@ -2,13 +2,13 @@ import cil
 
 // Used only because native PDBs are only supported on Windows.
 // They are included as tests but disabled here.
-predicate filterMethod(CIL::Method m)
-{
+predicate filterMethod(CIL::Method m) {
   m.getDeclaringType().getNamespace().getName() = "EmbeddedPdb" or
   m.getDeclaringType().getNamespace().getName() = "PortablePdb"
 }
 
 from CIL::Instruction instruction, CIL::Location location
-where location = instruction.getLocation()
-  and filterMethod(instruction.getImplementation().getMethod())
+where
+  location = instruction.getLocation() and
+  filterMethod(instruction.getImplementation().getMethod())
 select location.toString(), instruction.toString()
diff --git a/csharp/ql/test/library-tests/cil/pdbs/MethodLocations.ql b/csharp/ql/test/library-tests/cil/pdbs/MethodLocations.ql
index 426f87ca71a6..5fa3d09d9405 100644
--- a/csharp/ql/test/library-tests/cil/pdbs/MethodLocations.ql
+++ b/csharp/ql/test/library-tests/cil/pdbs/MethodLocations.ql
@@ -2,15 +2,15 @@ import cil
 
 // Used only because native PDBs are only supported on Windows.
 // They are included as tests but disabled here.
-predicate filterMethod(CIL::Method m)
-{
+predicate filterMethod(CIL::Method m) {
   m.getDeclaringType().getNamespace().getName() = "EmbeddedPdb" or
   m.getDeclaringType().getNamespace().getName() = "PortablePdb"
 }
 
 from CIL::Method method, CIL::Location location, boolean primaryLocation
-where location = method.getALocation()
-  and exists(CIL::Location l | l=method.getALocation() | l.getFile().isPdbSourceFile())
-  and (if location=method.getLocation() then primaryLocation=true else primaryLocation=false)
-  and filterMethod(method)
+where
+  location = method.getALocation() and
+  exists(CIL::Location l | l = method.getALocation() | l.getFile().isPdbSourceFile()) and
+  (if location = method.getLocation() then primaryLocation = true else primaryLocation = false) and
+  filterMethod(method)
 select method.toStringWithTypes(), location.toString(), primaryLocation
diff --git a/csharp/ql/test/library-tests/comments/Comments.ql b/csharp/ql/test/library-tests/comments/Comments.ql
index ea97e81200b8..ab01b83572a9 100644
--- a/csharp/ql/test/library-tests/comments/Comments.ql
+++ b/csharp/ql/test/library-tests/comments/Comments.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from CommentBlock c, CommentLine l
-where l.getParent()=c
+where l.getParent() = c
 select c, c.getNumLines(), l, l.getText(), l.getRawText(), l.getAQlClass()
diff --git a/csharp/ql/test/library-tests/comments/Generics.ql b/csharp/ql/test/library-tests/comments/Generics.ql
index 838a1159d20b..cce6c2dc4f4b 100644
--- a/csharp/ql/test/library-tests/comments/Generics.ql
+++ b/csharp/ql/test/library-tests/comments/Generics.ql
@@ -1,24 +1,18 @@
 import csharp
 
 from CommentBlock b, Element e, string s
-where b.getElement()=e
-and
-(
-  e instanceof ConstructedMethod
-  or e instanceof ConstructedClass
-  or e instanceof UnboundGenericClass
-  or e instanceof UnboundGenericMethod
-)
-and
-s = e.getAQlClass()
-and
-not s = "SourceDeclarationType"
-and
-not s = "SourceDeclarationCallable"
-and
-not s = "SourceDeclarationMethod"
-and
-not s = "NonConstructedMethod"
-and
-not s = "RuntimeInstanceMethod"
+where
+  b.getElement() = e and
+  (
+    e instanceof ConstructedMethod or
+    e instanceof ConstructedClass or
+    e instanceof UnboundGenericClass or
+    e instanceof UnboundGenericMethod
+  ) and
+  s = e.getAQlClass() and
+  not s = "SourceDeclarationType" and
+  not s = "SourceDeclarationCallable" and
+  not s = "SourceDeclarationMethod" and
+  not s = "NonConstructedMethod" and
+  not s = "RuntimeInstanceMethod"
 select b, e, s
diff --git a/csharp/ql/test/library-tests/commons/Disposal/DisposedFields.ql b/csharp/ql/test/library-tests/commons/Disposal/DisposedFields.ql
index 1da5392f3668..c9cf46facf40 100644
--- a/csharp/ql/test/library-tests/commons/Disposal/DisposedFields.ql
+++ b/csharp/ql/test/library-tests/commons/Disposal/DisposedFields.ql
@@ -3,7 +3,8 @@ import semmle.code.csharp.commons.Disposal
 import Whitelist
 
 from CIL::Field field
-where mayBeDisposed(field)
-  and field.getName().charAt(0) = "_" // Filter the results a little
-  and not whitelistedType(field.getDeclaringType())
+where
+  mayBeDisposed(field) and
+  field.getName().charAt(0) = "_" and // Filter the results a little
+  not whitelistedType(field.getDeclaringType())
 select field.getQualifiedName()
diff --git a/csharp/ql/test/library-tests/commons/Disposal/DisposedParameter.ql b/csharp/ql/test/library-tests/commons/Disposal/DisposedParameter.ql
index d53542f21986..c9df810b2205 100644
--- a/csharp/ql/test/library-tests/commons/Disposal/DisposedParameter.ql
+++ b/csharp/ql/test/library-tests/commons/Disposal/DisposedParameter.ql
@@ -3,7 +3,8 @@ import semmle.code.csharp.commons.Disposal
 import Whitelist
 
 from DotNet::Callable c, DotNet::Parameter param, int p
-where mayBeDisposed(param)
-  and param = c.getParameter(p)
-  and not whitelistedType(c.getDeclaringType())
+where
+  mayBeDisposed(param) and
+  param = c.getParameter(p) and
+  not whitelistedType(c.getDeclaringType())
 select c.toStringWithTypes(), p
diff --git a/csharp/ql/test/library-tests/commons/Disposal/DisposedVariables.ql b/csharp/ql/test/library-tests/commons/Disposal/DisposedVariables.ql
index 4b8b0bd6bd61..5a6abf3fb116 100644
--- a/csharp/ql/test/library-tests/commons/Disposal/DisposedVariables.ql
+++ b/csharp/ql/test/library-tests/commons/Disposal/DisposedVariables.ql
@@ -2,6 +2,7 @@ import semmle.code.csharp.commons.Disposal
 import csharp
 
 from Variable v
-where mayBeDisposed(v)
-  and v.fromSource()
+where
+  mayBeDisposed(v) and
+  v.fromSource()
 select v
diff --git a/csharp/ql/test/library-tests/commons/Disposal/UndisposedParameter.ql b/csharp/ql/test/library-tests/commons/Disposal/UndisposedParameter.ql
index 0fdac037bec4..ef9933fc4c43 100644
--- a/csharp/ql/test/library-tests/commons/Disposal/UndisposedParameter.ql
+++ b/csharp/ql/test/library-tests/commons/Disposal/UndisposedParameter.ql
@@ -3,7 +3,8 @@ import semmle.code.csharp.commons.Disposal
 import cil
 
 from DotNet::Callable c, DotNet::Parameter param, int p
-where not mayBeDisposed(param)
-  and param.getType().hasName("TextWriter")
-  and param = c.getParameter(p)
+where
+  not mayBeDisposed(param) and
+  param.getType().hasName("TextWriter") and
+  param = c.getParameter(p)
 select c.toStringWithTypes(), p
diff --git a/csharp/ql/test/library-tests/complexity/Complexity.ql b/csharp/ql/test/library-tests/complexity/Complexity.ql
index a86937bde5c3..11026fcee25c 100644
--- a/csharp/ql/test/library-tests/complexity/Complexity.ql
+++ b/csharp/ql/test/library-tests/complexity/Complexity.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Callable f
-where f.getName().matches("cc_") // cc1, cc2, ...
-and f.fromSource()
+where
+  f.getName().matches("cc_") and // cc1, cc2, ...
+  f.fromSource()
 select f, f.getCyclomaticComplexity()
diff --git a/csharp/ql/test/library-tests/constructors/Constructors1.ql b/csharp/ql/test/library-tests/constructors/Constructors1.ql
index 6e318820217e..0ba6b9c2783b 100644
--- a/csharp/ql/test/library-tests/constructors/Constructors1.ql
+++ b/csharp/ql/test/library-tests/constructors/Constructors1.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for constructors
  */
+
 import csharp
 
 where count(Constructor c | c.getName() = "Class") = 3
 select 1
-
diff --git a/csharp/ql/test/library-tests/constructors/Constructors2.ql b/csharp/ql/test/library-tests/constructors/Constructors2.ql
index 034a952c36e7..f8741f286bfa 100644
--- a/csharp/ql/test/library-tests/constructors/Constructors2.ql
+++ b/csharp/ql/test/library-tests/constructors/Constructors2.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for static constructors
  */
+
 import csharp
 
 where count(StaticConstructor c | c.getName() = "Class") = 1
 select 1
-
diff --git a/csharp/ql/test/library-tests/constructors/Constructors3.ql b/csharp/ql/test/library-tests/constructors/Constructors3.ql
index a283443c4e6c..a8523e978c14 100644
--- a/csharp/ql/test/library-tests/constructors/Constructors3.ql
+++ b/csharp/ql/test/library-tests/constructors/Constructors3.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for constructors
  */
+
 import csharp
 
 from Constructor c
-where c.getNumberOfParameters() = 1
-  and c.getParameter(0).getName() = "i"
-  and c.getParameter(0).getType() instanceof IntType
-  and c.fromSource()
+where
+  c.getNumberOfParameters() = 1 and
+  c.getParameter(0).getName() = "i" and
+  c.getParameter(0).getType() instanceof IntType and
+  c.fromSource()
 select c, c.getAParameter()
-
diff --git a/csharp/ql/test/library-tests/constructors/Constructors4.ql b/csharp/ql/test/library-tests/constructors/Constructors4.ql
index c403ab873bee..19a7b2b319a2 100644
--- a/csharp/ql/test/library-tests/constructors/Constructors4.ql
+++ b/csharp/ql/test/library-tests/constructors/Constructors4.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for constructors
  */
+
 import csharp
 
 where forall(StaticConstructor c | c.hasNoParameters())
 select 1
-
diff --git a/csharp/ql/test/library-tests/constructors/Destructors1.ql b/csharp/ql/test/library-tests/constructors/Destructors1.ql
index eb019c36e874..f8b1fa9b6ef8 100644
--- a/csharp/ql/test/library-tests/constructors/Destructors1.ql
+++ b/csharp/ql/test/library-tests/constructors/Destructors1.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for destructors
  */
+
 import csharp
 
 from Destructor c
-where c.getDeclaringType().getName() = "Class"
-  and c.getDeclaringType().getNamespace().getQualifiedName() = "Constructors"
+where
+  c.getDeclaringType().getName() = "Class" and
+  c.getDeclaringType().getNamespace().getQualifiedName() = "Constructors"
 select c, c.getDeclaringType().getQualifiedName()
-
diff --git a/csharp/ql/test/library-tests/constructors/Destructors2.ql b/csharp/ql/test/library-tests/constructors/Destructors2.ql
index 0deeb78fbe53..818f3028cec6 100644
--- a/csharp/ql/test/library-tests/constructors/Destructors2.ql
+++ b/csharp/ql/test/library-tests/constructors/Destructors2.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for destructors
  */
+
 import csharp
 
 where forex(Type t | count(Destructor d | d.getDeclaringType() = t) <= 1)
 select 1
-
diff --git a/csharp/ql/test/library-tests/constructors/Destructors3.ql b/csharp/ql/test/library-tests/constructors/Destructors3.ql
index 1494328e3008..637d5e4fddec 100644
--- a/csharp/ql/test/library-tests/constructors/Destructors3.ql
+++ b/csharp/ql/test/library-tests/constructors/Destructors3.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for destructors
  */
+
 import csharp
 
 from Destructor d, ValueOrRefType t
-where t = d.getDeclaringType()
-and not t instanceof ConstructedGeneric
-and not t instanceof UnboundGenericType
-and d.getName() != "~" + t.getName()
+where
+  t = d.getDeclaringType() and
+  not t instanceof ConstructedGeneric and
+  not t instanceof UnboundGenericType and
+  d.getName() != "~" + t.getName()
 select t, d
-
diff --git a/csharp/ql/test/library-tests/constructors/Destructors4.ql b/csharp/ql/test/library-tests/constructors/Destructors4.ql
index f88a893ce657..e2e9b9327eb2 100644
--- a/csharp/ql/test/library-tests/constructors/Destructors4.ql
+++ b/csharp/ql/test/library-tests/constructors/Destructors4.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for destructors
  */
+
 import csharp
 
 where forex(Destructor d | d.hasNoParameters())
 select 1
-
diff --git a/csharp/ql/test/library-tests/constructors/Destructors5.ql b/csharp/ql/test/library-tests/constructors/Destructors5.ql
index 19584a202f3a..0fa431663b4e 100644
--- a/csharp/ql/test/library-tests/constructors/Destructors5.ql
+++ b/csharp/ql/test/library-tests/constructors/Destructors5.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for destructors
  */
+
 import csharp
 
-where forex(Stmt s | exists(Destructor d | d.getBody().getAChild() = s) |
-    s instanceof LocalVariableDeclStmt)
+where
+  forex(Stmt s | exists(Destructor d | d.getBody().getAChild() = s) |
+    s instanceof LocalVariableDeclStmt
+  )
 select 1
-
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.ql b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.ql
index 7cb2559d9da6..b63f597f1813 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.ql
@@ -2,7 +2,4 @@ import csharp
 import Common
 
 from SourceBasicBlock bb
-select
-  bb.getFirstNode(),
-  bb.getLastNode(),
-  bb.length()
+select bb.getFirstNode(), bb.getLastNode(), bb.length()
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Common.qll b/csharp/ql/test/library-tests/controlflow/graph/Common.qll
index 625bbf242d53..fe0fffc5748a 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Common.qll
+++ b/csharp/ql/test/library-tests/controlflow/graph/Common.qll
@@ -1,25 +1,15 @@
 import csharp
 
-class StubFile extends File {
-  StubFile() {
-    this.getAbsolutePath().matches("%resources/stubs/%")
-  }
-}
+class StubFile extends File { StubFile() { this.getAbsolutePath().matches("%resources/stubs/%") } }
 
 class SourceControlFlowElement extends ControlFlowElement {
-  SourceControlFlowElement() {
-    not this.getLocation().getFile() instanceof StubFile
-  }
+  SourceControlFlowElement() { not this.getLocation().getFile() instanceof StubFile }
 }
 
 class SourceControlFlowNode extends ControlFlow::Node {
-  SourceControlFlowNode() {
-    not this.getLocation().getFile() instanceof StubFile
-  }
+  SourceControlFlowNode() { not this.getLocation().getFile() instanceof StubFile }
 }
 
 class SourceBasicBlock extends ControlFlow::BasicBlock {
-  SourceBasicBlock() {
-    not this.getLocation().getFile() instanceof StubFile
-  }
+  SourceBasicBlock() { not this.getLocation().getFile() instanceof StubFile }
 }
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ConditionBlock.ql b/csharp/ql/test/library-tests/controlflow/graph/ConditionBlock.ql
index c2dc8a9a1033..5f433cd9e289 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ConditionBlock.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/ConditionBlock.ql
@@ -2,5 +2,6 @@ import csharp
 import ControlFlow
 
 from BasicBlocks::ConditionBlock cb, BasicBlock controlled, boolean testIsTrue
-where cb.controls(controlled,any(SuccessorTypes::ConditionalSuccessor s | testIsTrue = s.getValue()))
+where
+  cb.controls(controlled, any(SuccessorTypes::ConditionalSuccessor s | testIsTrue = s.getValue()))
 select cb.getLastNode(), controlled.getFirstNode(), testIsTrue
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ConditionalFlow.ql b/csharp/ql/test/library-tests/controlflow/graph/ConditionalFlow.ql
index cf21cf130be0..3c48613319fd 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ConditionalFlow.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/ConditionalFlow.ql
@@ -1,14 +1,15 @@
 import csharp
 
 ControlFlow::Node successor(ControlFlow::Node node, boolean kind) {
-  (kind = true and result = node.getATrueSuccessor()) or
+  (kind = true and result = node.getATrueSuccessor())
+  or
   (kind = false and result = node.getAFalseSuccessor())
 }
 
 from ControlFlow::Node node, ControlFlow::Node successor, Location nl, Location sl, boolean kind
-where successor = successor(node, kind)
-  and nl = node.getLocation()
-  and sl = successor.getLocation()
-select
-  nl.getStartLine(), nl.getStartColumn(), node, kind,
-  sl.getStartLine(), sl.getStartColumn(), successor
+where
+  successor = successor(node, kind) and
+  nl = node.getLocation() and
+  sl = successor.getLocation()
+select nl.getStartLine(), nl.getStartColumn(), node, kind, sl.getStartLine(), sl.getStartColumn(),
+  successor
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ElementGraph.ql b/csharp/ql/test/library-tests/controlflow/graph/ElementGraph.ql
index 43d9d9f2a78d..20d7c1910405 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ElementGraph.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/ElementGraph.ql
@@ -1,9 +1,12 @@
 import csharp
 import Common
 
-query predicate edges(SourceControlFlowElement node, SourceControlFlowElement successor, string attr, string val) {
+query predicate edges(
+  SourceControlFlowElement node, SourceControlFlowElement successor, string attr, string val
+) {
   exists(ControlFlow::SuccessorType t |
-    successor = node.getAControlFlowNode().getASuccessorByType(t).getElement() |
+    successor = node.getAControlFlowNode().getASuccessorByType(t).getElement()
+  |
     attr = "semmle.label" and
     val = t.toString()
   )
diff --git a/csharp/ql/test/library-tests/controlflow/graph/FinallyNode.ql b/csharp/ql/test/library-tests/controlflow/graph/FinallyNode.ql
index c8d15e063472..4088884cb0f8 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/FinallyNode.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/FinallyNode.ql
@@ -6,14 +6,13 @@ import Nodes
 class MyFinallySplitControlFlowNode extends ElementNode {
   MyFinallySplitControlFlowNode() {
     exists(FinallySplitting::FinallySplitType type |
-      type = this.getASplit().(FinallySplit).getType() |
+      type = this.getASplit().(FinallySplit).getType()
+    |
       not type instanceof SuccessorTypes::NormalSuccessor
     )
   }
 
-  TryStmt getTryStmt() {
-    this.getElement() = FinallySplitting::getAFinallyDescendant(result)
-  }
+  TryStmt getTryStmt() { this.getElement() = FinallySplitting::getAFinallyDescendant(result) }
 }
 
 from MyFinallySplitControlFlowNode f
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.ql b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.ql
index 62e6cef9cab0..4a1cf5b58801 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.ql
@@ -1,9 +1,10 @@
 import csharp
 import Common
 
-query predicate edges(SourceControlFlowNode node, SourceControlFlowNode successor, string attr, string val) {
-  exists(ControlFlow::SuccessorType t |
-    successor = node.getASuccessorByType(t) |
+query predicate edges(
+  SourceControlFlowNode node, SourceControlFlowNode successor, string attr, string val
+) {
+  exists(ControlFlow::SuccessorType t | successor = node.getASuccessorByType(t) |
     attr = "semmle.label" and
     val = t.toString()
   )
diff --git a/csharp/ql/test/library-tests/controlflow/graph/PreBasicBlockConsistency.ql b/csharp/ql/test/library-tests/controlflow/graph/PreBasicBlockConsistency.ql
index 27bbf25b0544..227c239ea87a 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/PreBasicBlockConsistency.ql
+++ b/csharp/ql/test/library-tests/controlflow/graph/PreBasicBlockConsistency.ql
@@ -2,9 +2,7 @@ import csharp
 import ControlFlow::Internal::PreBasicBlocks
 
 predicate bbStartInconsistency(ControlFlowElement cfe) {
-  exists(ControlFlow::BasicBlock bb |
-    bb.getFirstNode() = cfe.getAControlFlowNode()
-  ) and
+  exists(ControlFlow::BasicBlock bb | bb.getFirstNode() = cfe.getAControlFlowNode()) and
   not cfe = any(PreBasicBlock bb).getFirstElement()
 }
 
diff --git a/csharp/ql/test/library-tests/controlflow/guards/MatchingGuardedExpr.ql b/csharp/ql/test/library-tests/controlflow/guards/MatchingGuardedExpr.ql
index bf9840640ac4..ff93f50a67da 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/MatchingGuardedExpr.ql
+++ b/csharp/ql/test/library-tests/controlflow/guards/MatchingGuardedExpr.ql
@@ -2,6 +2,7 @@ import csharp
 import semmle.code.csharp.controlflow.Guards
 
 from GuardedExpr ge, Expr e, AbstractValues::MatchValue v, boolean match
-where e = ge.getAGuard(e, v)
-  and if v.isMatch() then match = true else match = false
+where
+  e = ge.getAGuard(e, v) and
+  if v.isMatch() then match = true else match = false
 select ge, e, v.getCaseStmt(), match
diff --git a/csharp/ql/test/library-tests/conversion/boxing/Boxing.ql b/csharp/ql/test/library-tests/conversion/boxing/Boxing.ql
index 8f740b0a6c28..526fea576e30 100644
--- a/csharp/ql/test/library-tests/conversion/boxing/Boxing.ql
+++ b/csharp/ql/test/library-tests/conversion/boxing/Boxing.ql
@@ -3,21 +3,22 @@ import semmle.code.csharp.Conversion
 // Avoid printing conversions for type parameters from library
 class LibraryTypeParameter extends TypeParameter {
   LibraryTypeParameter() { fromLibrary() }
+
   override string toString() { none() }
 }
 
 class InterestingType extends Type {
   InterestingType() {
-    this.fromSource()
-    or this instanceof CharType
-    or this instanceof BoolType
-    or this instanceof IntType
-    or this.(NullableType).getUnderlyingType() instanceof IntType
+    this.fromSource() or
+    this instanceof CharType or
+    this instanceof BoolType or
+    this instanceof IntType or
+    this.(NullableType).getUnderlyingType() instanceof IntType
   }
 }
 
 from InterestingType sub, Type sup
-where convBoxing(sub, sup)
-  and sub != sup
-select sub.toString() as s1, sup.toString() as s2
-order by s1, s2
+where
+  convBoxing(sub, sup) and
+  sub != sup
+select sub.toString() as s1, sup.toString() as s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/conversion/identity/Identity.ql b/csharp/ql/test/library-tests/conversion/identity/Identity.ql
index 44da7089d0c4..039fd0221423 100644
--- a/csharp/ql/test/library-tests/conversion/identity/Identity.ql
+++ b/csharp/ql/test/library-tests/conversion/identity/Identity.ql
@@ -1,7 +1,7 @@
 import semmle.code.csharp.Conversion
 
 from Type sub, Type sup
-where convIdentity(sub, sup)
-  and sub != sup
-select sub.toString() as s1, sup.toString() as s2
-order by s1, s2
+where
+  convIdentity(sub, sup) and
+  sub != sup
+select sub.toString() as s1, sup.toString() as s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/conversion/nullable/Nullable.ql b/csharp/ql/test/library-tests/conversion/nullable/Nullable.ql
index 801eff5543d9..9b77dce025fb 100644
--- a/csharp/ql/test/library-tests/conversion/nullable/Nullable.ql
+++ b/csharp/ql/test/library-tests/conversion/nullable/Nullable.ql
@@ -2,14 +2,14 @@ import semmle.code.csharp.Conversion
 
 class InterestingType extends Type {
   InterestingType() {
-    this instanceof IntegralType
-    or this instanceof CharType
-    or this.(NullableType).getUnderlyingType() instanceof InterestingType
+    this instanceof IntegralType or
+    this instanceof CharType or
+    this.(NullableType).getUnderlyingType() instanceof InterestingType
   }
 }
 
 from InterestingType sub, Type sup
-where convNullableType(sub, sup)
-  and sub != sup
-select sub.toString() as s1, sup.toString() as s2
-order by s1, s2
+where
+  convNullableType(sub, sup) and
+  sub != sup
+select sub.toString() as s1, sup.toString() as s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/conversion/numeric/Numeric.ql b/csharp/ql/test/library-tests/conversion/numeric/Numeric.ql
index 53eab307dbad..cf952ab85703 100644
--- a/csharp/ql/test/library-tests/conversion/numeric/Numeric.ql
+++ b/csharp/ql/test/library-tests/conversion/numeric/Numeric.ql
@@ -1,7 +1,7 @@
 import semmle.code.csharp.Conversion
 
 from Type sub, Type sup
-where convNumeric(sub, sup)
-  and sub != sup
-select sub.toString() as s1, sup.toString() as s2
-order by s1, s2
+where
+  convNumeric(sub, sup) and
+  sub != sup
+select sub.toString() as s1, sup.toString() as s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/conversion/operator/Operator.ql b/csharp/ql/test/library-tests/conversion/operator/Operator.ql
index f72a2d8b94f3..2ac6e36ff551 100644
--- a/csharp/ql/test/library-tests/conversion/operator/Operator.ql
+++ b/csharp/ql/test/library-tests/conversion/operator/Operator.ql
@@ -1,13 +1,16 @@
 import semmle.code.csharp.Conversion
 
 from Type sub, Type sup, string s1, string s2
-where convConversionOperator(sub, sup)
-  and sub != sup
-  and s1 = sub.toString()
-  and s2 = sup.toString()
-  /* Remove certain results to make the test output consistent
-   * between different versions of .NET Core. */
-  and s2 != "FormatParam"
-  and s2 != "StringOrCharArray"
-select s1, s2
-order by s1, s2
+where
+  convConversionOperator(sub, sup) and
+  sub != sup and
+  s1 = sub.toString() and
+  s2 = sup.toString() and
+  /*
+   * Remove certain results to make the test output consistent
+   * between different versions of .NET Core.
+   */
+
+  s2 != "FormatParam" and
+  s2 != "StringOrCharArray"
+select s1, s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/conversion/reftype/RefType.ql b/csharp/ql/test/library-tests/conversion/reftype/RefType.ql
index 0d674ce4f49f..2ca3314f97c4 100644
--- a/csharp/ql/test/library-tests/conversion/reftype/RefType.ql
+++ b/csharp/ql/test/library-tests/conversion/reftype/RefType.ql
@@ -3,30 +3,34 @@ import semmle.code.csharp.Conversion
 // Avoid printing conversions for type parameters from library
 class LibraryTypeParameter extends TypeParameter {
   LibraryTypeParameter() { fromLibrary() }
+
   override string toString() { none() }
 }
 
 // Restrict the results
 class InterestingType extends Type {
   InterestingType() {
-    this.fromSource()
-    or this instanceof NullType
-    or this instanceof DynamicType
-    or this instanceof ObjectType
-    or this instanceof IntegralType
-    or this.(ConstructedType).getATypeArgument().fromSource()
-    or this.(ArrayType).getElementType() instanceof InterestingType
+    this.fromSource() or
+    this instanceof NullType or
+    this instanceof DynamicType or
+    this instanceof ObjectType or
+    this instanceof IntegralType or
+    this.(ConstructedType).getATypeArgument().fromSource() or
+    this.(ArrayType).getElementType() instanceof InterestingType
   }
 }
 
 from InterestingType sub, InterestingType sup, string s1, string s2
-where convRefType(sub, sup)
-  and sub != sup
-  and s1 = sub.toString()
-  and s2 = sup.toString()
-  /* Remove certain results to make the test output consistent
-   * between different versions of .NET Core. */
-  and s1 != "UInt16[]"
-  and s2 != "UInt16[]"
-select s1, s2
-order by s1, s2
+where
+  convRefType(sub, sup) and
+  sub != sup and
+  s1 = sub.toString() and
+  s2 = sup.toString() and
+  /*
+   * Remove certain results to make the test output consistent
+   * between different versions of .NET Core.
+   */
+
+  s1 != "UInt16[]" and
+  s2 != "UInt16[]"
+select s1, s2 order by s1, s2
diff --git a/csharp/ql/test/library-tests/csharp6/MemberAccess1.ql b/csharp/ql/test/library-tests/csharp6/MemberAccess1.ql
index 82fcb5a6df42..5919323afbad 100644
--- a/csharp/ql/test/library-tests/csharp6/MemberAccess1.ql
+++ b/csharp/ql/test/library-tests/csharp6/MemberAccess1.ql
@@ -5,6 +5,8 @@
 import csharp
 
 from MemberAccess ma, string conditional
-where (ma.isConditional() and conditional="Conditional")
-or (not ma.isConditional() and conditional="Unconditional")
+where
+  (ma.isConditional() and conditional = "Conditional")
+  or
+  (not ma.isConditional() and conditional = "Unconditional")
 select ma, ma.getQualifier(), conditional
diff --git a/csharp/ql/test/library-tests/csharp6/MemberAccess2.ql b/csharp/ql/test/library-tests/csharp6/MemberAccess2.ql
index 9584986795d7..6c8e3f3dafe1 100644
--- a/csharp/ql/test/library-tests/csharp6/MemberAccess2.ql
+++ b/csharp/ql/test/library-tests/csharp6/MemberAccess2.ql
@@ -5,6 +5,8 @@
 import csharp
 
 from MethodCall mc, string conditional
-where (mc.isConditional() and conditional="Conditional")
-or (not mc.isConditional() and conditional="Unconditional")
+where
+  (mc.isConditional() and conditional = "Conditional")
+  or
+  (not mc.isConditional() and conditional = "Unconditional")
 select mc, mc.getQualifier(), conditional
diff --git a/csharp/ql/test/library-tests/csharp7.2/InParameters.ql b/csharp/ql/test/library-tests/csharp7.2/InParameters.ql
index e8b676f1fb47..ce930786183a 100644
--- a/csharp/ql/test/library-tests/csharp7.2/InParameters.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/InParameters.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Parameter p
-where p.fromSource()
-  and p.isIn()
+where
+  p.fromSource() and
+  p.isIn()
 select p
diff --git a/csharp/ql/test/library-tests/csharp7.2/PrivateProtected.ql b/csharp/ql/test/library-tests/csharp7.2/PrivateProtected.ql
index 2c2eb2e7f3c0..060ea09f7872 100644
--- a/csharp/ql/test/library-tests/csharp7.2/PrivateProtected.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/PrivateProtected.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from Modifiable m
-where m.fromSource()
-  and m.isPrivate()
-  and m.isProtected()
+where
+  m.fromSource() and
+  m.isPrivate() and
+  m.isProtected()
 select m
diff --git a/csharp/ql/test/library-tests/csharp7.2/ReadonlyStructs.ql b/csharp/ql/test/library-tests/csharp7.2/ReadonlyStructs.ql
index 8b69ae14a26e..c23340b38d1e 100644
--- a/csharp/ql/test/library-tests/csharp7.2/ReadonlyStructs.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/ReadonlyStructs.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Struct s
-where s.fromSource()
-  and s.isReadonly()
+where
+  s.fromSource() and
+  s.isReadonly()
 select s
diff --git a/csharp/ql/test/library-tests/csharp7.2/RefReadonlyDelegate.ql b/csharp/ql/test/library-tests/csharp7.2/RefReadonlyDelegate.ql
index 653c378488e4..6bfe6c812a85 100644
--- a/csharp/ql/test/library-tests/csharp7.2/RefReadonlyDelegate.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/RefReadonlyDelegate.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from DelegateType del
-where del.fromSource()
-  and del.returnsRefReadonly()
+where
+  del.fromSource() and
+  del.returnsRefReadonly()
 select del
diff --git a/csharp/ql/test/library-tests/csharp7.2/RefReadonlyReturns.ql b/csharp/ql/test/library-tests/csharp7.2/RefReadonlyReturns.ql
index a2d330c7d532..9b878f2f55d9 100644
--- a/csharp/ql/test/library-tests/csharp7.2/RefReadonlyReturns.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/RefReadonlyReturns.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Callable c
-where c.fromSource()
-  and c.returnsRefReadonly()
+where
+  c.fromSource() and
+  c.returnsRefReadonly()
 select c
diff --git a/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql b/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql
index e5e70d645f44..556a0b156d8f 100644
--- a/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql
+++ b/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Struct s
-where s.fromSource()
-  and s.isRef()
+where
+  s.fromSource() and
+  s.isRef()
 select s
diff --git a/csharp/ql/test/library-tests/csharp7/Access.ql b/csharp/ql/test/library-tests/csharp7/Access.ql
index 8cbf1bfc3a73..8b546fc53207 100644
--- a/csharp/ql/test/library-tests/csharp7/Access.ql
+++ b/csharp/ql/test/library-tests/csharp7/Access.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from LocalVariableAccess a, string access
-where a.getEnclosingCallable().getDeclaringType().hasName("OutVariables")
-  and if a instanceof LocalVariableRead then access="read" else access="write"
+where
+  a.getEnclosingCallable().getDeclaringType().hasName("OutVariables") and
+  if a instanceof LocalVariableRead then access = "read" else access = "write"
 select a, access
diff --git a/csharp/ql/test/library-tests/csharp7/ConstructedLocalFunctions.ql b/csharp/ql/test/library-tests/csharp7/ConstructedLocalFunctions.ql
index 4654ca51e421..7ca9db3c2ce2 100644
--- a/csharp/ql/test/library-tests/csharp7/ConstructedLocalFunctions.ql
+++ b/csharp/ql/test/library-tests/csharp7/ConstructedLocalFunctions.ql
@@ -2,4 +2,3 @@ import csharp
 
 from ConstructedLocalFunction generic
 select generic, generic.toStringWithTypes(), generic.getUnboundGeneric().toStringWithTypes()
-
diff --git a/csharp/ql/test/library-tests/csharp7/DefUse.ql b/csharp/ql/test/library-tests/csharp7/DefUse.ql
index 664fa8daedbb..fb8d72257e59 100644
--- a/csharp/ql/test/library-tests/csharp7/DefUse.ql
+++ b/csharp/ql/test/library-tests/csharp7/DefUse.ql
@@ -1,9 +1,7 @@
 import csharp
 
-from
-  AssignableDefinition def,
-  AssignableRead read,
-  Ssa::Definition ssaDef
-where ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() = def
-  and read = ssaDef.getARead()
+from AssignableDefinition def, AssignableRead read, Ssa::Definition ssaDef
+where
+  ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() = def and
+  read = ssaDef.getARead()
 select def, read
diff --git a/csharp/ql/test/library-tests/csharp7/ForEach.ql b/csharp/ql/test/library-tests/csharp7/ForEach.ql
index c69316067280..e42b6f47372f 100644
--- a/csharp/ql/test/library-tests/csharp7/ForEach.ql
+++ b/csharp/ql/test/library-tests/csharp7/ForEach.ql
@@ -1,4 +1,5 @@
 import csharp
 
 from ForeachStmt stmt, int i
-select stmt, i, stmt.getVariableDeclExpr(i), stmt.getVariable(i), stmt.getIterableExpr(), stmt.getBody()
+select stmt, i, stmt.getVariableDeclExpr(i), stmt.getVariable(i), stmt.getIterableExpr(),
+  stmt.getBody()
diff --git a/csharp/ql/test/library-tests/csharp7/GlobalFlow.ql b/csharp/ql/test/library-tests/csharp7/GlobalFlow.ql
index e704d7983eaf..9abda8dedbfe 100644
--- a/csharp/ql/test/library-tests/csharp7/GlobalFlow.ql
+++ b/csharp/ql/test/library-tests/csharp7/GlobalFlow.ql
@@ -1,8 +1,7 @@
 import csharp
 
-class DataflowConfiguration extends DataFlow::Configuration
-{
-  DataflowConfiguration() { this="data flow configuration" }
+class DataflowConfiguration extends DataFlow::Configuration {
+  DataflowConfiguration() { this = "data flow configuration" }
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr().(Expr).getValue() = "tainted"
diff --git a/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.ql b/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.ql
index 99952fefecfd..03fb06f1f385 100644
--- a/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.ql
+++ b/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.ql
@@ -1,8 +1,7 @@
 import csharp
 
-class DataflowConfiguration extends TaintTracking::Configuration
-{
-  DataflowConfiguration() { this="taint tracking configuration" }
+class DataflowConfiguration extends TaintTracking::Configuration {
+  DataflowConfiguration() { this = "taint tracking configuration" }
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr().(Expr).getValue() = "tainted"
diff --git a/csharp/ql/test/library-tests/csharp7/IsFlow.ql b/csharp/ql/test/library-tests/csharp7/IsFlow.ql
index e5ca92054178..02b65c0d3e2c 100644
--- a/csharp/ql/test/library-tests/csharp7/IsFlow.ql
+++ b/csharp/ql/test/library-tests/csharp7/IsFlow.ql
@@ -2,7 +2,8 @@ import csharp
 
 query predicate edges(ControlFlow::Node n1, ControlFlow::Node n2, string attr, string val) {
   exists(SwitchStmt switch, ControlFlow::SuccessorType t |
-    switch.getAControlFlowNode().getASuccessor*()=n1 |
+    switch.getAControlFlowNode().getASuccessor*() = n1
+  |
     n2 = n1.getASuccessorByType(t) and
     attr = "semmle.label" and
     val = t.toString()
diff --git a/csharp/ql/test/library-tests/csharp7/IsPatterns.ql b/csharp/ql/test/library-tests/csharp7/IsPatterns.ql
index 57c196fd00da..d7b889e0a229 100644
--- a/csharp/ql/test/library-tests/csharp7/IsPatterns.ql
+++ b/csharp/ql/test/library-tests/csharp7/IsPatterns.ql
@@ -1,8 +1,5 @@
 import csharp
 
 from IsPatternExpr e, boolean isVar
-where
-  if e.getVariableDeclExpr().isImplicitlyTyped()
-  then isVar=true
-  else isVar=false
+where if e.getVariableDeclExpr().isImplicitlyTyped() then isVar = true else isVar = false
 select e, e.getTypeAccess(), e.getCheckedType().toString(), e.getVariableDeclExpr(), isVar
diff --git a/csharp/ql/test/library-tests/csharp7/Literals.ql b/csharp/ql/test/library-tests/csharp7/Literals.ql
index fac065314c15..8db02c9bdb98 100644
--- a/csharp/ql/test/library-tests/csharp7/Literals.ql
+++ b/csharp/ql/test/library-tests/csharp7/Literals.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Literal l, Class c
-where c.hasName("Literals")
-  and l = c.getAField().getInitializer()
+where
+  c.hasName("Literals") and
+  l = c.getAField().getInitializer()
 select l, l.getValue()
diff --git a/csharp/ql/test/library-tests/csharp7/LocalFunctions.ql b/csharp/ql/test/library-tests/csharp7/LocalFunctions.ql
index d6eb37ef4afe..e59adf32545c 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalFunctions.ql
+++ b/csharp/ql/test/library-tests/csharp7/LocalFunctions.ql
@@ -1,4 +1,5 @@
 import csharp
 
 from LocalFunction fn
-select fn, fn.getName(), fn.getReturnType().toString(), fn.getParent(), fn.getStatement(), fn.toStringWithTypes()
+select fn, fn.getName(), fn.getReturnType().toString(), fn.getParent(), fn.getStatement(),
+  fn.toStringWithTypes()
diff --git a/csharp/ql/test/library-tests/csharp7/RefFunctions.ql b/csharp/ql/test/library-tests/csharp7/RefFunctions.ql
index a583b8d56fcb..61eeb2547643 100644
--- a/csharp/ql/test/library-tests/csharp7/RefFunctions.ql
+++ b/csharp/ql/test/library-tests/csharp7/RefFunctions.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Callable f
-where f.returnsRef()
-  and f.fromSource()
+where
+  f.returnsRef() and
+  f.fromSource()
 select f
diff --git a/csharp/ql/test/library-tests/csharp7/TaintReaches.ql b/csharp/ql/test/library-tests/csharp7/TaintReaches.ql
index f401f80b162a..ff8664cae3aa 100644
--- a/csharp/ql/test/library-tests/csharp7/TaintReaches.ql
+++ b/csharp/ql/test/library-tests/csharp7/TaintReaches.ql
@@ -1,4 +1,3 @@
-
 import csharp
 import semmle.code.csharp.dataflow.TaintTracking
 
diff --git a/csharp/ql/test/library-tests/csharp7/TupleAccess.ql b/csharp/ql/test/library-tests/csharp7/TupleAccess.ql
index d77a9be70948..f89f5a725f7d 100644
--- a/csharp/ql/test/library-tests/csharp7/TupleAccess.ql
+++ b/csharp/ql/test/library-tests/csharp7/TupleAccess.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from TupleExpr e, string access
-where if e.isReadAccess() then access="read" else access="write"
+where if e.isReadAccess() then access = "read" else access = "write"
 select e, access
diff --git a/csharp/ql/test/library-tests/csharp7/TupleTypes.ql b/csharp/ql/test/library-tests/csharp7/TupleTypes.ql
index e5bc3f060c27..288fe1bfe982 100644
--- a/csharp/ql/test/library-tests/csharp7/TupleTypes.ql
+++ b/csharp/ql/test/library-tests/csharp7/TupleTypes.ql
@@ -2,4 +2,5 @@ import csharp
 
 from TupleType tt, int i
 where tt.getAnElement().fromSource()
-select tt.getName(), tt.toStringWithTypes(), tt.getUnderlyingType().toStringWithTypes(), tt.getArity(), i, tt.getElement(i)
+select tt.getName(), tt.toStringWithTypes(), tt.getUnderlyingType().toStringWithTypes(),
+  tt.getArity(), i, tt.getElement(i)
diff --git a/csharp/ql/test/library-tests/csharp7/TypeCase2.ql b/csharp/ql/test/library-tests/csharp7/TypeCase2.ql
index 7e68d3c403e1..0bd45b5eb807 100644
--- a/csharp/ql/test/library-tests/csharp7/TypeCase2.ql
+++ b/csharp/ql/test/library-tests/csharp7/TypeCase2.ql
@@ -1,8 +1,5 @@
 import csharp
 
 from TypeCase c, boolean isVar
-where
-  if c.getVariableDeclExpr().isImplicitlyTyped()
-  then isVar=true
-  else isVar=false
+where if c.getVariableDeclExpr().isImplicitlyTyped() then isVar = true else isVar = false
 select c, c.getVariableDeclExpr(), c.getTypeAccess(), c.getCheckedType().toString(), isVar
diff --git a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll
index 433c9a51477d..1272dfb22f11 100644
--- a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll
+++ b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll
@@ -3,9 +3,7 @@ import semmle.code.csharp.dataflow.DefUse
 import semmle.code.csharp.controlflow.Guards
 
 class Configuration extends DataFlow::Configuration {
-  Configuration() {
-    this = "Configuration"
-  }
+  Configuration() { this = "Configuration" }
 
   override predicate isSource(DataFlow::Node source) { any() }
 
@@ -29,7 +27,10 @@ predicate flowOutFromParameter(DataFlow::Configuration c, Parameter p) {
 }
 
 predicate flowOutFromParameterOutOrRef(DataFlow::Configuration c, Parameter p, int outRef) {
-  exists(DataFlow::ExprNode ne, Ssa::ExplicitDefinition def, DataFlow::ParameterNode np, Parameter outRefParameter |
+  exists(
+    DataFlow::ExprNode ne, Ssa::ExplicitDefinition def, DataFlow::ParameterNode np,
+    Parameter outRefParameter
+  |
     outRefParameter.isOutOrRef() and
     np.getParameter() = p and
     ne.getExpr() = def.getADefinition().getSource() and
diff --git a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/DataFlow.ql b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/DataFlow.ql
index 594b1d56b95d..7b60ecdf5072 100644
--- a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/DataFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/DataFlow.ql
@@ -2,6 +2,8 @@ import csharp
 import Common
 
 from Configuration c, Parameter p, int outRefArg
-where flowOutFromParameter(c, p) and outRefArg = -1
-   or flowOutFromParameterOutOrRef(c, p, outRefArg)
+where
+  flowOutFromParameter(c, p) and outRefArg = -1
+  or
+  flowOutFromParameterOutOrRef(c, p, outRefArg)
 select p.getCallable(), p.getPosition(), outRefArg
diff --git a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/TaintTracking.ql b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/TaintTracking.ql
index 7af798742ab7..f1004b76160f 100644
--- a/csharp/ql/test/library-tests/dataflow/callablereturnsarg/TaintTracking.ql
+++ b/csharp/ql/test/library-tests/dataflow/callablereturnsarg/TaintTracking.ql
@@ -3,15 +3,19 @@ import Common
 
 class TaintTrackingConfiguration extends TaintTracking::Configuration {
   Configuration c;
-  TaintTrackingConfiguration() {
-    this = "Taint " + c
-  }
+
+  TaintTrackingConfiguration() { this = "Taint " + c }
+
   override predicate isSource(DataFlow::Node source) { c.isSource(source) }
+
   override predicate isSink(DataFlow::Node sink) { c.isSink(sink) }
+
   override predicate isSanitizer(DataFlow::Node node) { c.isBarrier(node) }
 }
 
 from TaintTrackingConfiguration c, Parameter p, int outRefArg
-where flowOutFromParameter(c, p) and outRefArg = -1
-   or flowOutFromParameterOutOrRef(c, p, outRefArg)
+where
+  flowOutFromParameter(c, p) and outRefArg = -1
+  or
+  flowOutFromParameterOutOrRef(c, p, outRefArg)
 select p.getCallable(), p.getPosition(), outRefArg
diff --git a/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql
index 4f3fc8532c2d..887bcab44f79 100644
--- a/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql
+++ b/csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql
@@ -4,9 +4,9 @@ import csharp
 predicate defReaches(AssignableDefinition def, LocalScopeVariable v, ControlFlow::Node cfn) {
   def.getTarget() = v and cfn = def.getAControlFlowNode().getASuccessor()
   or
-  exists(ControlFlow::Node mid |
-    defReaches(def, v, mid) |
-    not mid = any(AssignableDefinition ad | ad.getTarget() = v and ad.isCertain()).getAControlFlowNode() and
+  exists(ControlFlow::Node mid | defReaches(def, v, mid) |
+    not mid = any(AssignableDefinition ad | ad.getTarget() = v and ad.isCertain())
+          .getAControlFlowNode() and
     cfn = mid.getASuccessor()
   )
 }
@@ -20,14 +20,23 @@ predicate defUsePair(AssignableDefinition def, AssignableRead read) {
 
 private LocalScopeVariableRead getAReachableUncertainRead(AssignableDefinition def) {
   exists(Ssa::Definition ssaDef |
-    def = ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() |
+    def = ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition()
+  |
     result = ssaDef.getARead()
   )
 }
 
 from AssignableDefinition def, LocalScopeVariableRead read, string s
 where
-  (read = getAReachableUncertainRead(def) and not defUsePair(def, read) and s = "not a def/use pair")
+  (
+    read = getAReachableUncertainRead(def) and
+    not defUsePair(def, read) and
+    s = "not a def/use pair"
+  )
   or
-  (defUsePair(def, read) and not read = getAReachableUncertainRead(def) and s = "missing def/use pair")
+  (
+    defUsePair(def, read) and
+    not read = getAReachableUncertainRead(def) and
+    s = "missing def/use pair"
+  )
 select def, read, s
diff --git a/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql
index 837d33933ce7..06369f2ad2be 100644
--- a/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql
+++ b/csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql
@@ -4,9 +4,9 @@ import csharp
 predicate parameterReaches(Parameter p, ControlFlow::Node cfn) {
   cfn = p.getCallable().getEntryPoint().getASuccessor()
   or
-  exists(ControlFlow::Node mid |
-    parameterReaches(p, mid) |
-    not mid = any(AssignableDefinition ad | ad.getTarget() = p and ad.isCertain()).getAControlFlowNode() and
+  exists(ControlFlow::Node mid | parameterReaches(p, mid) |
+    not mid = any(AssignableDefinition ad | ad.getTarget() = p and ad.isCertain())
+          .getAControlFlowNode() and
     cfn = mid.getASuccessor()
   )
 }
@@ -16,16 +16,27 @@ predicate parameterUsePair(Parameter p, AssignableRead read) {
   read.getTarget() = p
 }
 
-private LocalScopeVariableRead getAReachableUncertainRead(AssignableDefinitions::ImplicitParameterDefinition p) {
+private LocalScopeVariableRead getAReachableUncertainRead(
+  AssignableDefinitions::ImplicitParameterDefinition p
+) {
   exists(Ssa::Definition ssaDef |
-    p = ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() |
+    p = ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition()
+  |
     result = ssaDef.getARead()
   )
 }
 
 from AssignableDefinitions::ImplicitParameterDefinition p, AssignableRead read, string s
 where
-  (read = getAReachableUncertainRead(p) and not parameterUsePair(p.getParameter(), read) and s = "not a param/use pair")
+  (
+    read = getAReachableUncertainRead(p) and
+    not parameterUsePair(p.getParameter(), read) and
+    s = "not a param/use pair"
+  )
   or
-  (parameterUsePair(p.getParameter(), read) and not read = getAReachableUncertainRead(p) and s = "missing param/use pair")
+  (
+    parameterUsePair(p.getParameter(), read) and
+    not read = getAReachableUncertainRead(p) and
+    s = "missing param/use pair"
+  )
 select p, read, s
diff --git a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
index f70c1a54f5a1..d4b1809b0cb5 100644
--- a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
+++ b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
@@ -4,9 +4,9 @@ import csharp
 predicate useReaches(LocalScopeVariableRead read, LocalScopeVariable v, ControlFlow::Node cfn) {
   read.getTarget() = v and cfn = read.getAControlFlowNode().getASuccessor()
   or
-  exists(ControlFlow::Node mid |
-    useReaches(read, v, mid) |
-    not mid = any(AssignableDefinition ad | ad.getTarget() = v and ad.isCertain()).getAControlFlowNode() and
+  exists(ControlFlow::Node mid | useReaches(read, v, mid) |
+    not mid = any(AssignableDefinition ad | ad.getTarget() = v and ad.isCertain())
+          .getAControlFlowNode() and
     cfn = mid.getASuccessor()
   )
 }
@@ -23,23 +23,29 @@ private newtype TLocalScopeVariableReadOrSsaDef =
   TSsaDefinition(Ssa::Definition ssaDef)
 
 private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableReadOrSsaDef prev) {
-  exists(LocalScopeVariableRead read |
-    prev = TLocalScopeVariableRead(read) |
+  exists(LocalScopeVariableRead read | prev = TLocalScopeVariableRead(read) |
     result = TLocalScopeVariableRead(read.getANextRead())
     or
     not exists(read.getANextRead()) and
-    exists(Ssa::Definition ssaDef, Ssa::PseudoDefinition pseudoDef, ControlFlow::Node cfn, ControlFlow::BasicBlock bb, int i |
-      ssaDef.getARead() = read |
+    exists(
+      Ssa::Definition ssaDef, Ssa::PseudoDefinition pseudoDef, ControlFlow::Node cfn,
+      ControlFlow::BasicBlock bb, int i
+    |
+      ssaDef.getARead() = read
+    |
       pseudoDef.getAnInput() = ssaDef and
       pseudoDef.definesAt(bb, i) and
       cfn = read.getAReachableElement().getAControlFlowNode() and
-      (cfn = bb.getNode(i) or cfn = bb.getFirstNode() and i < 0) and
+      (
+        cfn = bb.getNode(i)
+        or
+        cfn = bb.getFirstNode() and i < 0
+      ) and
       result = TSsaDefinition(pseudoDef)
     )
   )
   or
-  exists(Ssa::Definition ssaDef |
-    prev = TSsaDefinition(ssaDef) |
+  exists(Ssa::Definition ssaDef | prev = TSsaDefinition(ssaDef) |
     result = TLocalScopeVariableRead(ssaDef.getAFirstRead())
     or
     not exists(ssaDef.getAFirstRead()) and
diff --git a/csharp/ql/test/library-tests/dataflow/global/Common.qll b/csharp/ql/test/library-tests/dataflow/global/Common.qll
index bcc537171c5c..1ecaebd9f949 100644
--- a/csharp/ql/test/library-tests/dataflow/global/Common.qll
+++ b/csharp/ql/test/library-tests/dataflow/global/Common.qll
@@ -10,8 +10,7 @@ class Config extends DataFlow::Configuration {
   }
 
   override predicate isSink(DataFlow::Node sink) {
-    sink.asExpr() instanceof Access
-    and
+    sink.asExpr() instanceof Access and
     exists(MethodCall mc |
       mc.getTarget().getName() = "Check" and
       mc.getAnArgument() = sink.asExpr().getParent*()
diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlow.ql b/csharp/ql/test/library-tests/dataflow/global/DataFlow.ql
index 02d4737492e1..efc827dd6e6c 100644
--- a/csharp/ql/test/library-tests/dataflow/global/DataFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/global/DataFlow.ql
@@ -2,7 +2,7 @@ import csharp
 import Common
 
 from Config c, DataFlow::Node source, DataFlow::Node sink, string s
-where c.hasFlow(source, sink)
-  and s = sink.toString()
-select s
-order by s asc
+where
+  c.hasFlow(source, sink) and
+  s = sink.toString()
+select s order by s
diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.ql b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.ql
index a7f2d662c47e..a995769f0ed6 100644
--- a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.ql
+++ b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.ql
@@ -1,12 +1,13 @@
 /**
  * @kind path-problem
  */
+
 import csharp
 import Common
 import DataFlow::PathGraph
 
 from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string s
-where c.hasFlowPath(source, sink)
-  and s = sink.toString()
-select sink, s, source, sink
-order by s asc
+where
+  c.hasFlowPath(source, sink) and
+  s = sink.toString()
+select sink, s, source, sink order by s
diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.ql b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.ql
index a8dfebd3e07a..d57eb8e1e87d 100644
--- a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.ql
+++ b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.ql
@@ -3,21 +3,16 @@ import Common
 
 class TTConfig extends TaintTracking::Configuration {
   Config c;
-  TTConfig() {
-    this = c
-  }
 
-  override predicate isSource(DataFlow::Node source) {
-    c.isSource(source)
-  }
+  TTConfig() { this = c }
 
-  override predicate isSink(DataFlow::Node sink) {
-    c.isSink(sink)
-  }
+  override predicate isSource(DataFlow::Node source) { c.isSource(source) }
+
+  override predicate isSink(DataFlow::Node sink) { c.isSink(sink) }
 }
 
 from TTConfig c, DataFlow::Node source, DataFlow::Node sink, string s
-where c.hasFlow(source, sink)
-  and s = sink.toString()
-select s
-order by s asc
+where
+  c.hasFlow(source, sink) and
+  s = sink.toString()
+select s order by s
diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.ql b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.ql
index eb1a2f2c3ad4..71975ecd1118 100644
--- a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.ql
+++ b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.ql
@@ -1,27 +1,23 @@
 /**
  * @kind path-problem
  */
+
 import csharp
 import Common
 import DataFlow::PathGraph
 
 class TTConfig extends TaintTracking::Configuration {
   Config c;
-  TTConfig() {
-    this = c
-  }
 
-  override predicate isSource(DataFlow::Node source) {
-    c.isSource(source)
-  }
+  TTConfig() { this = c }
+
+  override predicate isSource(DataFlow::Node source) { c.isSource(source) }
 
-  override predicate isSink(DataFlow::Node sink) {
-    c.isSink(sink)
-  }
+  override predicate isSink(DataFlow::Node sink) { c.isSink(sink) }
 }
 
 from TTConfig c, DataFlow::PathNode source, DataFlow::PathNode sink, string s
-where c.hasFlowPath(source, sink)
-  and s = sink.toString()
-select sink, s, source, sink
-order by s asc
+where
+  c.hasFlowPath(source, sink) and
+  s = sink.toString()
+select sink, s, source, sink order by s
diff --git a/csharp/ql/test/library-tests/dataflow/library/LibraryTypeDataFlow.ql b/csharp/ql/test/library-tests/dataflow/library/LibraryTypeDataFlow.ql
index 1b800fa48a4c..2c050ebd399a 100644
--- a/csharp/ql/test/library-tests/dataflow/library/LibraryTypeDataFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/library/LibraryTypeDataFlow.ql
@@ -11,8 +11,12 @@ predicate callableFlow(string callable, string flow, boolean preservesValue) {
 }
 
 from string entity, string flow, boolean preservesValue
-where callableFlow(entity, flow, preservesValue)
-  /* Remove certain results to make the test output consistent
-   * between different versions of .NET Core. */
-  and not entity = "System.IO.FileStream.CopyToAsync(Stream, int, CancellationToken)"
+where
+  callableFlow(entity, flow, preservesValue) and
+  /*
+   * Remove certain results to make the test output consistent
+   * between different versions of .NET Core.
+   */
+
+  not entity = "System.IO.FileStream.CopyToAsync(Stream, int, CancellationToken)"
 select entity, flow, preservesValue
diff --git a/csharp/ql/test/library-tests/dataflow/local/Common.qll b/csharp/ql/test/library-tests/dataflow/local/Common.qll
index c0cd45f7c1f4..c3e9e08c6f35 100644
--- a/csharp/ql/test/library-tests/dataflow/local/Common.qll
+++ b/csharp/ql/test/library-tests/dataflow/local/Common.qll
@@ -2,8 +2,7 @@ import csharp
 
 class MyFlowSource extends DataFlow::Node {
   MyFlowSource() {
-    exists(Expr e |
-      e = this.asExpr() |
+    exists(Expr e | e = this.asExpr() |
       e.(StringLiteral).getValue() = "taint source" or
       e.(VariableAccess).getTarget().hasName("taintedDataContract") or
       e.(VariableAccess).getTarget().hasName("taintedHttpRequest") or
@@ -12,8 +11,7 @@ class MyFlowSource extends DataFlow::Node {
     or
     this.asParameter().hasName("tainted")
     or
-    exists(Expr e |
-      e = this.(DataFlow::Internal::ImplicitDelegateCallNode).getArgument() |
+    exists(Expr e | e = this.(DataFlow::Internal::ImplicitDelegateCallNode).getArgument() |
       e.(DelegateCreation).getArgument().(MethodAccess).getTarget().hasName("TaintedMethod") or
       e.(LambdaExpr).getExpressionBody().(StringLiteral).getValue() = "taint source"
     )
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlow.ql b/csharp/ql/test/library-tests/dataflow/local/DataFlow.ql
index 55b972679167..d51032520e66 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlow.ql
@@ -6,5 +6,4 @@ where
   DataFlow::localFlowStep+(source, DataFlow::exprNode(target)) and
   exists(MethodCall mc | mc.getTarget().getName() = "Check" and mc.getAnArgument() = target) and
   s = target.toString()
-select s
-order by s asc
+select s order by s
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTracking.ql b/csharp/ql/test/library-tests/dataflow/local/TaintTracking.ql
index af4d767ade9a..f7b5e4dab888 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTracking.ql
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTracking.ql
@@ -6,5 +6,4 @@ where
   TaintTracking::localTaintStep+(source, DataFlow::exprNode(sink)) and
   exists(MethodCall mc | mc.getTarget().getName() = "Check" and mc.getAnArgument() = sink) and
   s = sink.toString()
-select s
-order by s asc
+select s order by s
diff --git a/csharp/ql/test/library-tests/dataflow/ssa-large/countssa.ql b/csharp/ql/test/library-tests/dataflow/ssa-large/countssa.ql
index 03dc84e8adce..2a2366d890a9 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa-large/countssa.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa-large/countssa.ql
@@ -2,6 +2,8 @@ import csharp
 
 from int uses, int live
 where
-uses = strictcount(Ssa::ExplicitDefinition ssa, AssignableRead read | read = ssa.getARead()) and
-live = strictcount(Ssa::ExplicitDefinition ssa, ControlFlow::BasicBlock bb | ssa.isLiveAtEndOfBlock(bb))
+  uses = strictcount(Ssa::ExplicitDefinition ssa, AssignableRead read | read = ssa.getARead()) and
+  live = strictcount(Ssa::ExplicitDefinition ssa, ControlFlow::BasicBlock bb |
+      ssa.isLiveAtEndOfBlock(bb)
+    )
 select uses, live
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/BaseSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/BaseSsaConsistency.ql
index bdc169510a64..f2c262fb1850 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/BaseSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/BaseSsaConsistency.ql
@@ -2,8 +2,9 @@ import csharp
 import semmle.code.csharp.dataflow.internal.BaseSSA
 
 from AssignableRead ar, AssignableDefinition def, LocalScopeVariable v
-where ar = BaseSsa::getARead(def, v)
-  and not exists(Ssa::ExplicitDefinition edef |
+where
+  ar = BaseSsa::getARead(def, v) and
+  not exists(Ssa::ExplicitDefinition edef |
     edef.getADefinition() = def and
     edef.getARead() = ar
   )
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/IsLiveOutRefParameterDefinition.ql b/csharp/ql/test/library-tests/dataflow/ssa/IsLiveOutRefParameterDefinition.ql
index 242554db8313..ca43b497dd53 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/IsLiveOutRefParameterDefinition.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/IsLiveOutRefParameterDefinition.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Ssa::SourceVariable v, Ssa::Definition def
-where v = def.getSourceVariable()
-  and def.isLiveOutRefParameterDefinition(_)
+where
+  v = def.getSourceVariable() and
+  def.isLiveOutRefParameterDefinition(_)
 select v, def
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
index dea9b67b0593..fb1a010a876b 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
@@ -1,13 +1,12 @@
 import csharp
 import ControlFlow::Internal
 
-query
-predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SimpleAssignable a, boolean b) {
-  exists(AssignableDefinition def |
-    e = def.getExpr() |
+query predicate defReadInconsistency(
+  AssignableRead ar, Expr e, PreSsa::SimpleAssignable a, boolean b
+) {
+  exists(AssignableDefinition def | e = def.getExpr() |
     b = true and
-    exists(PreSsa::Definition ssaDef |
-      ssaDef.getAssignable() = a |
+    exists(PreSsa::Definition ssaDef | ssaDef.getAssignable() = a |
       PreSsa::firstReadSameVar(ssaDef, ar) and
       ssaDef.getDefinition() = def and
       not exists(Ssa::ExplicitDefinition edef |
@@ -29,8 +28,9 @@ predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SimpleAssignab
   )
 }
 
-query
-predicate readReadInconsistency(LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SimpleAssignable a, boolean b) {
+query predicate readReadInconsistency(
+  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SimpleAssignable a, boolean b
+) {
   b = true and
   a = read1.getTarget() and
   PreSsa::adjacentReadPairSameVar(read1, read2) and
@@ -43,17 +43,17 @@ predicate readReadInconsistency(LocalScopeVariableRead read1, LocalScopeVariable
   not PreSsa::adjacentReadPairSameVar(read1, read2)
 }
 
-query
-predicate phiInconsistency(ControlFlowElement cfe, Expr e, PreSsa::SimpleAssignable a, boolean b) {
-  exists(AssignableDefinition adef |
-    e = adef.getExpr() |
+query predicate phiInconsistency(
+  ControlFlowElement cfe, Expr e, PreSsa::SimpleAssignable a, boolean b
+) {
+  exists(AssignableDefinition adef | e = adef.getExpr() |
     b = true and
-    exists(PreSsa::Definition def |
-      a = def.getAssignable() |
+    exists(PreSsa::Definition def | a = def.getAssignable() |
       adef = def.getAPhiInput+().getDefinition() and
       cfe = def.getBasicBlock().getFirstElement() and
       not exists(Ssa::PhiNode phi, ControlFlow::BasicBlock bb, Ssa::ExplicitDefinition edef |
-        edef = phi.getAnUltimateDefinition() |
+        edef = phi.getAnUltimateDefinition()
+      |
         edef.getADefinition() = adef and
         phi.definesAt(bb, _) and
         cfe = bb.getFirstNode().getElement()
@@ -62,7 +62,8 @@ predicate phiInconsistency(ControlFlowElement cfe, Expr e, PreSsa::SimpleAssigna
     or
     b = false and
     exists(Ssa::PhiNode phi, ControlFlow::BasicBlock bb, Ssa::ExplicitDefinition edef |
-      a = phi.getSourceVariable().getAssignable() |
+      a = phi.getSourceVariable().getAssignable()
+    |
       edef = phi.getAnUltimateDefinition() and
       edef.getADefinition() = adef and
       phi.definesAt(bb, _) and
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.ql b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.ql
index 97473a6d94ba..90726a62880f 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Ssa::SourceVariable v, Ssa::PhiNode phi, Ssa::Definition input
-where phi.getAnInput() = input
-  and v = phi.getSourceVariable()
+where
+  phi.getAnInput() = input and
+  v = phi.getSourceVariable()
 select v, phi, input
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql b/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql
index 64f7e848859a..42c48d3a7bef 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.ql
@@ -1,6 +1,12 @@
 import csharp
 
 from string inout, Ssa::ExplicitDefinition def, Ssa::Definition targetDef, Call c
-where (inout = "in" and def.isCapturedVariableDefinitionFlowIn(targetDef, c))
-   or (inout = "out" and def.isCapturedVariableDefinitionFlowOut(targetDef) and targetDef.(Ssa::ImplicitCallDefinition).getCall() = c)
+where
+  (inout = "in" and def.isCapturedVariableDefinitionFlowIn(targetDef, c))
+  or
+  (
+    inout = "out" and
+    def.isCapturedVariableDefinitionFlowOut(targetDef) and
+    targetDef.(Ssa::ImplicitCallDefinition).getCall() = c
+  )
 select inout, def.getSourceVariable(), def, targetDef, c
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.ql b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.ql
index cdde9df7a399..44e4cdc23d0a 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Ssa::SourceVariable v, Ssa::Definition def, AssignableRead read
-where read = def.getARead()
-  and v = def.getSourceVariable()
+where
+  read = def.getARead() and
+  v = def.getSourceVariable()
 select v, def, read
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.ql b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.ql
index 4fc7cf041a56..5d47aeb4b2c7 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Ssa::SourceVariable v, Ssa::Definition def, Ssa::Definition u
-where u = def.getAnUltimateDefinition()
-  and v = def.getSourceVariable()
+where
+  u = def.getAnUltimateDefinition() and
+  v = def.getSourceVariable()
 select v, def, u
diff --git a/csharp/ql/test/library-tests/delegates/Delegates1.ql b/csharp/ql/test/library-tests/delegates/Delegates1.ql
index c0ead3913198..e5a269d11dde 100644
--- a/csharp/ql/test/library-tests/delegates/Delegates1.ql
+++ b/csharp/ql/test/library-tests/delegates/Delegates1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for delegates
  */
+
 import csharp
 
 from DelegateType d
-where d.hasName("FooDelegate")
-  and d.getNumberOfParameters() = 3
+where
+  d.hasName("FooDelegate") and
+  d.getNumberOfParameters() = 3
 select d
diff --git a/csharp/ql/test/library-tests/delegates/Delegates2.ql b/csharp/ql/test/library-tests/delegates/Delegates2.ql
index eddbf58afcd2..951c7ab97249 100644
--- a/csharp/ql/test/library-tests/delegates/Delegates2.ql
+++ b/csharp/ql/test/library-tests/delegates/Delegates2.ql
@@ -1,18 +1,20 @@
 /**
  * @name Test for delegates
  */
+
 import csharp
 
 from DelegateType d
-where d.hasQualifiedName("Delegates.FooDelegate")
-  and d.getReturnType() instanceof DoubleType
-  and d.getParameter(0).hasName("param")
-  and d.getParameter(0).isRef()
-  and d.getParameter(0).getType() instanceof StringType
-  and d.getParameter(1).getName() = "condition"
-  and d.getParameter(1).isOut()
-  and d.getParameter(1).getType() instanceof BoolType
-  and d.getParameter(2).hasName("args")
-  and d.getParameter(2).isParams()
-  and d.getParameter(2).getType().(ArrayType).getElementType() instanceof StringType
+where
+  d.hasQualifiedName("Delegates.FooDelegate") and
+  d.getReturnType() instanceof DoubleType and
+  d.getParameter(0).hasName("param") and
+  d.getParameter(0).isRef() and
+  d.getParameter(0).getType() instanceof StringType and
+  d.getParameter(1).getName() = "condition" and
+  d.getParameter(1).isOut() and
+  d.getParameter(1).getType() instanceof BoolType and
+  d.getParameter(2).hasName("args") and
+  d.getParameter(2).isParams() and
+  d.getParameter(2).getType().(ArrayType).getElementType() instanceof StringType
 select d, d.getAParameter().getType().toString()
diff --git a/csharp/ql/test/library-tests/delegates/Delegates3.ql b/csharp/ql/test/library-tests/delegates/Delegates3.ql
index ed825ff4b3df..88c019b3067c 100644
--- a/csharp/ql/test/library-tests/delegates/Delegates3.ql
+++ b/csharp/ql/test/library-tests/delegates/Delegates3.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for delegates
  */
+
 import csharp
 
 from DelegateType d
-where d.hasQualifiedName("System.Threading.ContextCallback")
-  and d.getNumberOfParameters() = 1
-  and d.getParameter(0).hasName("state")
-  and d.getParameter(0).isValue()
-  and d.getParameter(0).getType() instanceof ObjectType
-  and d.getReturnType() instanceof VoidType
+where
+  d.hasQualifiedName("System.Threading.ContextCallback") and
+  d.getNumberOfParameters() = 1 and
+  d.getParameter(0).hasName("state") and
+  d.getParameter(0).isValue() and
+  d.getParameter(0).getType() instanceof ObjectType and
+  d.getReturnType() instanceof VoidType
 select d.toString()
diff --git a/csharp/ql/test/library-tests/dispatch/CallGraph.ql b/csharp/ql/test/library-tests/dispatch/CallGraph.ql
index 42d0002770aa..75796e89f9f0 100644
--- a/csharp/ql/test/library-tests/dispatch/CallGraph.ql
+++ b/csharp/ql/test/library-tests/dispatch/CallGraph.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Callable caller, Callable callee
-where caller.calls(callee)
-  and callee.fromSource()
+where
+  caller.calls(callee) and
+  callee.fromSource()
 select caller, callee
diff --git a/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.ql b/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.ql
index 4feeb4a2cf38..587663f75509 100644
--- a/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.ql
+++ b/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.ql
@@ -2,6 +2,7 @@ import csharp
 import semmle.code.csharp.dispatch.Dispatch
 
 from DispatchCall call, Callable callable
-where callable = call.getADynamicTarget()
-  and callable.fromSource()
+where
+  callable = call.getADynamicTarget() and
+  callable.fromSource()
 select call, callable.getQualifiedNameWithTypes()
diff --git a/csharp/ql/test/library-tests/dispatch/exactCallable.ql b/csharp/ql/test/library-tests/dispatch/exactCallable.ql
index 4f7bd5534754..1bd12f7d4c47 100644
--- a/csharp/ql/test/library-tests/dispatch/exactCallable.ql
+++ b/csharp/ql/test/library-tests/dispatch/exactCallable.ql
@@ -2,9 +2,10 @@ import csharp
 import semmle.code.csharp.dispatch.Dispatch
 
 from DispatchCall call, Method m
-where call.getCall().getEnclosingCallable().getName() = "Run"
-  and call.getLocation().getFile().getStem() = "ExactCallable"
-  and strictcount(call.getADynamicTarget().getSourceDeclaration()) = 1
-  and m = call.getADynamicTarget().getSourceDeclaration()
-  and m.fromSource()
+where
+  call.getCall().getEnclosingCallable().getName() = "Run" and
+  call.getLocation().getFile().getStem() = "ExactCallable" and
+  strictcount(call.getADynamicTarget().getSourceDeclaration()) = 1 and
+  m = call.getADynamicTarget().getSourceDeclaration() and
+  m.fromSource()
 select call, m.toString(), m.getDeclaringType().toString()
diff --git a/csharp/ql/test/library-tests/enums/Enums1.ql b/csharp/ql/test/library-tests/enums/Enums1.ql
index f11b90887b4a..f99780144877 100644
--- a/csharp/ql/test/library-tests/enums/Enums1.ql
+++ b/csharp/ql/test/library-tests/enums/Enums1.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for enums
  */
+
 import csharp
 
 from EnumConstant c
-where c.getName() = "Red"
-  and c.getDeclaringType().hasQualifiedName("Enums.Color")
+where
+  c.getName() = "Red" and
+  c.getDeclaringType().hasQualifiedName("Enums.Color")
 select c, c.getType()
-
diff --git a/csharp/ql/test/library-tests/enums/Enums10.ql b/csharp/ql/test/library-tests/enums/Enums10.ql
index 165a2ad42495..21bb80197853 100644
--- a/csharp/ql/test/library-tests/enums/Enums10.ql
+++ b/csharp/ql/test/library-tests/enums/Enums10.ql
@@ -1,19 +1,20 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from EnumConstant c, EnumConstant d
-where c.getName() = "Blue"
-  and d.hasName("AnotherBlue")
-  and c.getDeclaringType().hasQualifiedName("Enums.SparseColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getType() = d.getType()
-  and c.getValue() = "11"
-  and c.getValue() = d.getValue()
-  and c.getUnderlyingType() instanceof IntType
-  and c.getUnderlyingType() = d.getUnderlyingType()
-  and not c.hasExplicitValue()
-  and d.hasExplicitValue()
+where
+  c.getName() = "Blue" and
+  d.hasName("AnotherBlue") and
+  c.getDeclaringType().hasQualifiedName("Enums.SparseColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getType() = d.getType() and
+  c.getValue() = "11" and
+  c.getValue() = d.getValue() and
+  c.getUnderlyingType() instanceof IntType and
+  c.getUnderlyingType() = d.getUnderlyingType() and
+  not c.hasExplicitValue() and
+  d.hasExplicitValue()
 select c, d
diff --git a/csharp/ql/test/library-tests/enums/Enums2.ql b/csharp/ql/test/library-tests/enums/Enums2.ql
index 4c1e999f9169..eda8843c3c80 100644
--- a/csharp/ql/test/library-tests/enums/Enums2.ql
+++ b/csharp/ql/test/library-tests/enums/Enums2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for enums
  */
+
 import csharp
 
 from EnumConstant c
-where c.getName() = "Green"
-  and c.getDeclaringType().hasQualifiedName("Enums.Color")
-  and c.getType() = c.getDeclaringType()
-  and c.getUnderlyingType() instanceof IntType
+where
+  c.getName() = "Green" and
+  c.getDeclaringType().hasQualifiedName("Enums.Color") and
+  c.getType() = c.getDeclaringType() and
+  c.getUnderlyingType() instanceof IntType
 select c
-
diff --git a/csharp/ql/test/library-tests/enums/Enums3.ql b/csharp/ql/test/library-tests/enums/Enums3.ql
index 837abe7041a8..4cbb3e65e4da 100644
--- a/csharp/ql/test/library-tests/enums/Enums3.ql
+++ b/csharp/ql/test/library-tests/enums/Enums3.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for enums
  */
+
 import csharp
 
 from EnumConstant c
-where c.getName() = "Green"
-  and c.getDeclaringType().hasQualifiedName("Enums.LongColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getValue() = "1"
+where
+  c.getName() = "Green" and
+  c.getDeclaringType().hasQualifiedName("Enums.LongColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getValue() = "1"
 select c, c.getDeclaringType().getBaseClass().getQualifiedName()
-
diff --git a/csharp/ql/test/library-tests/enums/Enums4.ql b/csharp/ql/test/library-tests/enums/Enums4.ql
index 27e0bff17a1c..087c6b1f5768 100644
--- a/csharp/ql/test/library-tests/enums/Enums4.ql
+++ b/csharp/ql/test/library-tests/enums/Enums4.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for enums
  */
+
 import csharp
 
-where forall (Enum e | e.getBaseClass().hasQualifiedName("System.Enum"))
+where forall(Enum e | e.getBaseClass().hasQualifiedName("System.Enum"))
 select 1
-
diff --git a/csharp/ql/test/library-tests/enums/Enums5.ql b/csharp/ql/test/library-tests/enums/Enums5.ql
index e408cb3bb8e7..2693fee80656 100644
--- a/csharp/ql/test/library-tests/enums/Enums5.ql
+++ b/csharp/ql/test/library-tests/enums/Enums5.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from Enum e
-where e.hasName("E")
-  and e.getUnderlyingType() instanceof LongType
+where
+  e.hasName("E") and
+  e.getUnderlyingType() instanceof LongType
 select e
diff --git a/csharp/ql/test/library-tests/enums/Enums6.ql b/csharp/ql/test/library-tests/enums/Enums6.ql
index 1d6318abf7ee..93e03a3e7875 100644
--- a/csharp/ql/test/library-tests/enums/Enums6.ql
+++ b/csharp/ql/test/library-tests/enums/Enums6.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from EnumConstant c
-where c.getName() = "FourBlue"
-  and c.getDeclaringType().hasQualifiedName("Enums.ValueColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getValue() = "4"
-  and c.getUnderlyingType() instanceof UIntType
+where
+  c.getName() = "FourBlue" and
+  c.getDeclaringType().hasQualifiedName("Enums.ValueColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getValue() = "4" and
+  c.getUnderlyingType() instanceof UIntType
 select c
diff --git a/csharp/ql/test/library-tests/enums/Enums7.ql b/csharp/ql/test/library-tests/enums/Enums7.ql
index 1d6318abf7ee..93e03a3e7875 100644
--- a/csharp/ql/test/library-tests/enums/Enums7.ql
+++ b/csharp/ql/test/library-tests/enums/Enums7.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from EnumConstant c
-where c.getName() = "FourBlue"
-  and c.getDeclaringType().hasQualifiedName("Enums.ValueColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getValue() = "4"
-  and c.getUnderlyingType() instanceof UIntType
+where
+  c.getName() = "FourBlue" and
+  c.getDeclaringType().hasQualifiedName("Enums.ValueColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getValue() = "4" and
+  c.getUnderlyingType() instanceof UIntType
 select c
diff --git a/csharp/ql/test/library-tests/enums/Enums8.ql b/csharp/ql/test/library-tests/enums/Enums8.ql
index 04e5ab5751d7..26ac31db4572 100644
--- a/csharp/ql/test/library-tests/enums/Enums8.ql
+++ b/csharp/ql/test/library-tests/enums/Enums8.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from EnumConstant c
-where c.getName() = "Red"
-  and c.getDeclaringType().hasQualifiedName("Enums.SparseColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getValue() = "0"
-  and c.getUnderlyingType() instanceof IntType
-  and not c.hasExplicitValue()
+where
+  c.getName() = "Red" and
+  c.getDeclaringType().hasQualifiedName("Enums.SparseColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getValue() = "0" and
+  c.getUnderlyingType() instanceof IntType and
+  not c.hasExplicitValue()
 select c
diff --git a/csharp/ql/test/library-tests/enums/Enums9.ql b/csharp/ql/test/library-tests/enums/Enums9.ql
index 153c0eb7f7e5..895764920f70 100644
--- a/csharp/ql/test/library-tests/enums/Enums9.ql
+++ b/csharp/ql/test/library-tests/enums/Enums9.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for enums
  */
-import csharp
 
+import csharp
 
 from EnumConstant c
-where c.getName() = "Green"
-  and c.getDeclaringType().hasQualifiedName("Enums.SparseColor")
-  and c.getType() = c.getDeclaringType()
-  and c.getValue() = "10"
-  and c.getUnderlyingType() instanceof IntType
-  and c.hasExplicitValue()
+where
+  c.getName() = "Green" and
+  c.getDeclaringType().hasQualifiedName("Enums.SparseColor") and
+  c.getType() = c.getDeclaringType() and
+  c.getValue() = "10" and
+  c.getUnderlyingType() instanceof IntType and
+  c.hasExplicitValue()
 select c
diff --git a/csharp/ql/test/library-tests/events/Events1.ql b/csharp/ql/test/library-tests/events/Events1.ql
index 757697cac679..5be331349b10 100644
--- a/csharp/ql/test/library-tests/events/Events1.ql
+++ b/csharp/ql/test/library-tests/events/Events1.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from Event e
-where e.getName() = "Click"
-  and e.getDeclaringType().hasQualifiedName("Events.Button")
-  and e.isPublic()
+where
+  e.getName() = "Click" and
+  e.getDeclaringType().hasQualifiedName("Events.Button") and
+  e.isPublic()
 select e, e.getType()
-
diff --git a/csharp/ql/test/library-tests/events/Events10.ql b/csharp/ql/test/library-tests/events/Events10.ql
index 4064288f1bf3..1e27d752e57c 100644
--- a/csharp/ql/test/library-tests/events/Events10.ql
+++ b/csharp/ql/test/library-tests/events/Events10.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 where count(RemoveEventAccessor e | e.fromSource()) = 3
 select 1
-
diff --git a/csharp/ql/test/library-tests/events/Events11.ql b/csharp/ql/test/library-tests/events/Events11.ql
index 13f00c3f5d0e..873f4cb0abf7 100644
--- a/csharp/ql/test/library-tests/events/Events11.ql
+++ b/csharp/ql/test/library-tests/events/Events11.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
-where forex(RemoveEventAccessor a |
-  a.fromSource() |
-  a.getParameter(0).hasName("value")
-  and a.getParameter(0).getType() = a.getDeclaration().getType()
-  and a.getNumberOfParameters() = 1)
+where
+  forex(RemoveEventAccessor a | a.fromSource() |
+    a.getParameter(0).hasName("value") and
+    a.getParameter(0).getType() = a.getDeclaration().getType() and
+    a.getNumberOfParameters() = 1
+  )
 select 1
-
diff --git a/csharp/ql/test/library-tests/events/Events12.ql b/csharp/ql/test/library-tests/events/Events12.ql
index cad6415ccf2a..607ae0d73c73 100644
--- a/csharp/ql/test/library-tests/events/Events12.ql
+++ b/csharp/ql/test/library-tests/events/Events12.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
-where forex(AddEventAccessor a |
-  a.fromSource() |
-  a.getParameter(0).hasName("value")
-  and a.getParameter(0).getType() = a.getDeclaration().getType()
-  and a.getNumberOfParameters() = 1)
+where
+  forex(AddEventAccessor a | a.fromSource() |
+    a.getParameter(0).hasName("value") and
+    a.getParameter(0).getType() = a.getDeclaration().getType() and
+    a.getNumberOfParameters() = 1
+  )
 select 1
-
diff --git a/csharp/ql/test/library-tests/events/Events2.ql b/csharp/ql/test/library-tests/events/Events2.ql
index cc623154d25d..3ff06e1a4d49 100644
--- a/csharp/ql/test/library-tests/events/Events2.ql
+++ b/csharp/ql/test/library-tests/events/Events2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from Event e
-where e.getName() = "Click"
-  and e.getDeclaringType().hasQualifiedName("Events.Button")
-  and e.isFieldLike()
+where
+  e.getName() = "Click" and
+  e.getDeclaringType().hasQualifiedName("Events.Button") and
+  e.isFieldLike()
 select e, e.getType()
-
diff --git a/csharp/ql/test/library-tests/events/Events3.ql b/csharp/ql/test/library-tests/events/Events3.ql
index 2ecc93deff60..b90a358b43af 100644
--- a/csharp/ql/test/library-tests/events/Events3.ql
+++ b/csharp/ql/test/library-tests/events/Events3.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from Event e
-where e.getName() = "Click"
-  and e.getDeclaringType().hasQualifiedName("Events.Button")
-  and e.getType().hasName("EventHandler")
+where
+  e.getName() = "Click" and
+  e.getDeclaringType().hasQualifiedName("Events.Button") and
+  e.getType().hasName("EventHandler")
 select e, e.getType()
-
diff --git a/csharp/ql/test/library-tests/events/Events4.ql b/csharp/ql/test/library-tests/events/Events4.ql
index f6f56b2914c7..7250c0b2c1c0 100644
--- a/csharp/ql/test/library-tests/events/Events4.ql
+++ b/csharp/ql/test/library-tests/events/Events4.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from Event e
-where e.getName() = "MouseUp"
-  and e.getDeclaringType().hasQualifiedName("Events.Control")
-  and e.getType().hasName("EventHandler")
-  and e.isPublic()
+where
+  e.getName() = "MouseUp" and
+  e.getDeclaringType().hasQualifiedName("Events.Control") and
+  e.getType().hasName("EventHandler") and
+  e.isPublic()
 select e, e.getType()
-
diff --git a/csharp/ql/test/library-tests/events/Events5.ql b/csharp/ql/test/library-tests/events/Events5.ql
index 8c8f46c44992..259ac14966d9 100644
--- a/csharp/ql/test/library-tests/events/Events5.ql
+++ b/csharp/ql/test/library-tests/events/Events5.ql
@@ -1,9 +1,13 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
-where count(Event e | e.getDeclaringType().hasQualifiedName("Events.Control")
-                  and e.getType().hasName("EventHandler")
-                  and e.isPublic()) = 2
+where
+  count(Event e |
+    e.getDeclaringType().hasQualifiedName("Events.Control") and
+    e.getType().hasName("EventHandler") and
+    e.isPublic()
+  ) = 2
 select 1
diff --git a/csharp/ql/test/library-tests/events/Events6.ql b/csharp/ql/test/library-tests/events/Events6.ql
index dea05be9a941..22d7cf99dba4 100644
--- a/csharp/ql/test/library-tests/events/Events6.ql
+++ b/csharp/ql/test/library-tests/events/Events6.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 where forex(AddEventAccessor a | exists(a.getDeclaration()))
 select 1
-
diff --git a/csharp/ql/test/library-tests/events/Events7.ql b/csharp/ql/test/library-tests/events/Events7.ql
index d9f7ec55501b..407d69be06d0 100644
--- a/csharp/ql/test/library-tests/events/Events7.ql
+++ b/csharp/ql/test/library-tests/events/Events7.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from Event e
-where e.getName() = "MouseUp"
-  and e.getDeclaringType().hasQualifiedName("Events.Control")
-  and not e.isFieldLike()
+where
+  e.getName() = "MouseUp" and
+  e.getDeclaringType().hasQualifiedName("Events.Control") and
+  not e.isFieldLike()
 select e, e.getType()
-
diff --git a/csharp/ql/test/library-tests/events/Events8.ql b/csharp/ql/test/library-tests/events/Events8.ql
index 7d52b825b749..5461c273b819 100644
--- a/csharp/ql/test/library-tests/events/Events8.ql
+++ b/csharp/ql/test/library-tests/events/Events8.ql
@@ -1,9 +1,8 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
-where forall(Event e | exists(e.getAddEventAccessor()) implies
-                       exists(e.getRemoveEventAccessor()))
+where forall(Event e | exists(e.getAddEventAccessor()) implies exists(e.getRemoveEventAccessor()))
 select 1
-
diff --git a/csharp/ql/test/library-tests/events/Events9.ql b/csharp/ql/test/library-tests/events/Events9.ql
index 676645abc6a5..4b33e15ee9ec 100644
--- a/csharp/ql/test/library-tests/events/Events9.ql
+++ b/csharp/ql/test/library-tests/events/Events9.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for events
  */
+
 import csharp
 
 from RemoveEventAccessor a
-where a.getStatementBody().getNumberOfStmts() = 1
-  and a.getStatementBody().getStmt(0) instanceof ExprStmt
+where
+  a.getStatementBody().getNumberOfStmts() = 1 and
+  a.getStatementBody().getStmt(0) instanceof ExprStmt
 select a
-
diff --git a/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql b/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
index fe14c9eaf36b..48f6b41e19d2 100644
--- a/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
+++ b/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for add event handlers
  */
+
 import csharp
 
 from Constructor c, AddEventExpr e
-where c.hasName("LoginDialog")
-  and e.getEnclosingCallable() = c
-  and e.getTarget().hasName("Click")
-  and e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("OkButton")
+where
+  c.hasName("LoginDialog") and
+  e.getEnclosingCallable() = c and
+  e.getTarget().hasName("Click") and
+  e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("OkButton")
 select c, e
-
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
index 5114690e4af3..2c8268e87e19 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for anonymous methods
  */
+
 import csharp
 
 from Assignment assign, AnonymousMethodExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f7")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getParameter(0).getType() instanceof IntType
-  and e.getParameter(0).hasName("x")
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getParameter(0).getType() instanceof IntType and
+  e.getParameter(0).hasName("x")
 select e
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
index 67bf2ef1e47b..e9fbbf01a10b 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for anonymous methods
  */
+
 import csharp
 
 from Assignment assign, AnonymousMethodExpr e, Parameter p, ParameterAccess pa
-where assign.getLValue().(VariableAccess).getTarget().hasName("f7")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and p = e.getParameter(0)
-  and pa.getEnclosingStmt().getParent+() = e.getBody()
-  and pa.getTarget() = p
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  p = e.getParameter(0) and
+  pa.getEnclosingStmt().getParent+() = e.getBody() and
+  pa.getTarget() = p
 select e, p
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
index 37d06dc481ce..e4c2e9ae9ba9 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for anonymous methods
  */
+
 import csharp
 
 from Assignment assign, AnonymousMethodExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f7")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getType().(DelegateType).getReturnType() instanceof IntType
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getType().(DelegateType).getReturnType() instanceof IntType
 select e
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
index 7b0a9c16a13a..4d424b65b84a 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for anonymous methods
  */
+
 import csharp
 
 from Assignment assign, AnonymousMethodExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f8")
-  and e.getParent+() = assign
-  and e.hasNoParameters()
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f8") and
+  e.getParent+() = assign and
+  e.hasNoParameters()
 select e, e
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
index 5e903fc1cb1c..cbc6ac82ca7e 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for anonymous methods
  */
+
 import csharp
 
 from Assignment assign, AnonymousMethodExpr e, LocalVariableAccess va
-where assign.getLValue().(VariableAccess).getTarget().hasName("f8")
-  and e.getParent+() = assign
-  and e.hasNoParameters()
-  and va.getEnclosingStmt().getParent+() = e.getBody()
-  and va.getTarget().hasName("j")
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f8") and
+  e.getParent+() = assign and
+  e.hasNoParameters() and
+  va.getEnclosingStmt().getParent+() = e.getBody() and
+  va.getTarget().hasName("j")
 select e, va
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
index 63071ac4dcbc..74d8cd27a948 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for anonymous object creations
  */
+
 import csharp
 
 from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
-where assign.getLValue().(VariableAccess).getTarget().hasName("list2")
-  and o.getParent+() = assign
-  and o.getInitializer().getMemberInitializer(0) = a
-  and a.getRValue().getValue() = "2"
-  and p = a.getLValue().(PropertyAccess).getTarget()
-  and p.hasName("i")
-  and p.getDeclaringType() = o.getObjectType()
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("list2") and
+  o.getParent+() = assign and
+  o.getInitializer().getMemberInitializer(0) = a and
+  a.getRValue().getValue() = "2" and
+  p = a.getLValue().(PropertyAccess).getTarget() and
+  p.hasName("i") and
+  p.getDeclaringType() = o.getObjectType()
 select o
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
index 065829be103c..5f9e16564b42 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for anonymous object creations
  */
+
 import csharp
 
 from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
-where assign.getLValue().(VariableAccess).getTarget().hasName("contacts2")
-  and o.getParent+() = assign
-  and o.getInitializer().getMemberInitializer(0) = a
-  and a.getRValue().getValue() = "Chris Smith"
-  and p = a.getLValue().(PropertyAccess).getTarget()
-  and p.hasName("Name")
-  and p.getDeclaringType() = o.getObjectType()
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+  o.getParent+() = assign and
+  o.getInitializer().getMemberInitializer(0) = a and
+  a.getRValue().getValue() = "Chris Smith" and
+  p = a.getLValue().(PropertyAccess).getTarget() and
+  p.hasName("Name") and
+  p.getDeclaringType() = o.getObjectType()
 select o, p.getType().toString()
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
index 2b0d18e43aab..0fd0aed97e2e 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for anonymous object creations
  */
+
 import csharp
 
 from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
-where assign.getLValue().(VariableAccess).getTarget().hasName("contacts2")
-  and o.getParent+() = assign
-  and o.getInitializer().getMemberInitializer(1) = a
-  and a.getRValue() instanceof ArrayCreation
-  and p = a.getLValue().(PropertyAccess).getTarget()
-  and p.hasName("PhoneNumbers")
-  and p.getDeclaringType() = o.getObjectType()
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+  o.getParent+() = assign and
+  o.getInitializer().getMemberInitializer(1) = a and
+  a.getRValue() instanceof ArrayCreation and
+  p = a.getLValue().(PropertyAccess).getTarget() and
+  p.hasName("PhoneNumbers") and
+  p.getDeclaringType() = o.getObjectType()
 select o, p.getType()
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
index 804d9d026aa8..b6354d1f4931 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
@@ -1,16 +1,18 @@
 /**
  * @name Test for anonymous object creations
  */
+
 import csharp
 
-from Assignment assign,
-     AnonymousObjectCreation o, Assignment a,
-     AnonymousObjectCreation p, Assignment b
-where assign.getLValue().(VariableAccess).getTarget().hasName("contacts2")
-  and o.getParent+() = assign
-  and o.getInitializer().getMemberInitializer(1) = a
-  and p.getParent+() = assign
-  and p.getInitializer().getMemberInitializer(1) = b
-  and o != p
-  and o.getObjectType() = p.getObjectType()
+from
+  Assignment assign, AnonymousObjectCreation o, Assignment a, AnonymousObjectCreation p,
+  Assignment b
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+  o.getParent+() = assign and
+  o.getInitializer().getMemberInitializer(1) = a and
+  p.getParent+() = assign and
+  p.getInitializer().getMemberInitializer(1) = b and
+  o != p and
+  o.getObjectType() = p.getObjectType()
 select o, p
diff --git a/csharp/ql/test/library-tests/expressions/ArrayAccess1.ql b/csharp/ql/test/library-tests/expressions/ArrayAccess1.ql
index c89ac27553cd..06ed7ea21d07 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayAccess1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for array access
  */
+
 import csharp
 
 from Method m, ArrayAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getQualifier().(LocalVariableAccess).getTarget().getName() = "array"
-  and e.getIndex(0).(IntLiteral).getValue() = "1"
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getQualifier().(LocalVariableAccess).getTarget().getName() = "array" and
+  e.getIndex(0).(IntLiteral).getValue() = "1"
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
index ac7d81eaf9c2..fba7a4036156 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
@@ -1,19 +1,20 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e, ArrayInitializer i
-where a.getLValue().(VariableAccess).getTarget().hasName("is1")
-  and e = a.getRValue()
-  and not e.isImplicitlyTyped()
-  and i = e.getInitializer()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 2
-  and e.getArrayType().getElementType() instanceof IntType
-  and i.getNumberOfElements() = 3
-  and i.getElement(0).(ArrayInitializer).getNumberOfElements() = 2
-  and i.getElement(0).(ArrayInitializer).getElement(0).getValue() = "0"
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is1") and
+  e = a.getRValue() and
+  not e.isImplicitlyTyped() and
+  i = e.getInitializer() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 2 and
+  e.getArrayType().getElementType() instanceof IntType and
+  i.getNumberOfElements() = 3 and
+  i.getElement(0).(ArrayInitializer).getNumberOfElements() = 2 and
+  i.getElement(0).(ArrayInitializer).getElement(0).getValue() = "0"
 select e, i
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
index 75f84abaec61..d8a1df128671 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
@@ -1,17 +1,19 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e, CastExpr cast
-where a.getLValue().(VariableAccess).getTarget().hasName("os")
-  and e.getEnclosingCallable().hasName("MainElementAccess")
-  and e = a.getRValue()
-  and not e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 1
-  and e.getInitializer().getNumberOfElements() = 1
-  and e.getInitializer().getElement(0) = cast
-  and cast.getExpr() instanceof ParameterAccess
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("os") and
+  e.getEnclosingCallable().hasName("MainElementAccess") and
+  e = a.getRValue() and
+  not e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 1 and
+  e.getInitializer().getNumberOfElements() = 1 and
+  e.getInitializer().getElement(0) = cast and
+  cast.getExpr() instanceof ParameterAccess
 select e, e.getInitializer().getElement(0)
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
index 44688e14f0df..ae56d5798396 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
@@ -1,21 +1,22 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e, ArrayInitializer i
-where a.getLValue().(VariableAccess).getTarget().hasName("is2")
-  and e = a.getRValue()
-  and not e.isImplicitlyTyped()
-  and i = e.getInitializer()
-  and e.getNumberOfLengthArguments() = 2
-  and e.getLengthArgument(0).getValue() = "3"
-  and e.getLengthArgument(1).getValue() = "2"
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 2
-  and e.getArrayType().getElementType() instanceof IntType
-  and i.getNumberOfElements() = 3
-  and i.getElement(0).(ArrayInitializer).getNumberOfElements() = 2
-  and i.getElement(2).(ArrayInitializer).getElement(1).getValue() = "5"
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is2") and
+  e = a.getRValue() and
+  not e.isImplicitlyTyped() and
+  i = e.getInitializer() and
+  e.getNumberOfLengthArguments() = 2 and
+  e.getLengthArgument(0).getValue() = "3" and
+  e.getLengthArgument(1).getValue() = "2" and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 2 and
+  e.getArrayType().getElementType() instanceof IntType and
+  i.getNumberOfElements() = 3 and
+  i.getElement(0).(ArrayInitializer).getNumberOfElements() = 2 and
+  i.getElement(2).(ArrayInitializer).getElement(1).getValue() = "5"
 select e, i
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
index 2c62f1f58504..efe626dab088 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
@@ -1,17 +1,18 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("is3")
-  and e = a.getRValue()
-  and not e.isImplicitlyTyped()
-  and not e.hasInitializer()
-  and e.getNumberOfLengthArguments() = 1
-  and e.getLengthArgument(0).getValue() = "100"
-  and e.getArrayType().getDimension() = 2
-  and e.getArrayType().getRank() = 1
-  and e.getArrayType().getElementType().(ArrayType).getElementType() instanceof IntType
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is3") and
+  e = a.getRValue() and
+  not e.isImplicitlyTyped() and
+  not e.hasInitializer() and
+  e.getNumberOfLengthArguments() = 1 and
+  e.getLengthArgument(0).getValue() = "100" and
+  e.getArrayType().getDimension() = 2 and
+  e.getArrayType().getRank() = 1 and
+  e.getArrayType().getElementType().(ArrayType).getElementType() instanceof IntType
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
index 52b28a987856..2a0dd5312833 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
@@ -1,18 +1,19 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("is4")
-  and e = a.getRValue()
-  and not e.isImplicitlyTyped()
-  and not e.hasInitializer()
-  and e.getNumberOfLengthArguments() = 2
-  and e.getLengthArgument(0).getValue() = "100"
-  and e.getLengthArgument(1).getValue() = "5"
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 2
-  and e.getArrayType().getElementType() instanceof IntType
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is4") and
+  e = a.getRValue() and
+  not e.isImplicitlyTyped() and
+  not e.hasInitializer() and
+  e.getNumberOfLengthArguments() = 2 and
+  e.getLengthArgument(0).getValue() = "100" and
+  e.getLengthArgument(1).getValue() = "5" and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 2 and
+  e.getArrayType().getElementType() instanceof IntType
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
index 4f6330cc9092..04c29cafba8c 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
@@ -1,20 +1,21 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e, int i
-where a.getLValue().(VariableAccess).getTarget().hasName("is5")
-  and e = a.getRValue()
-  and e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 1
-  and e.getArrayType().getElementType() instanceof IntType
-  and e.getInitializer().getNumberOfElements() = 4
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is5") and
+  e = a.getRValue() and
+  e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 1 and
+  e.getArrayType().getElementType() instanceof IntType and
+  e.getInitializer().getNumberOfElements() = 4 and
   // Workaround for `e.getInitializer().getElement(2).getValue() = "100"`
   // until CORE-182 has been resolved
-  and e.getInitializer().getElement(i + 1).getValue() = "100"
-  and i = 1
+  e.getInitializer().getElement(i + 1).getValue() = "100" and
+  i = 1
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
index 7c3c0380d8dc..7ca6bbe9668f 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
@@ -1,17 +1,18 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("is6")
-  and e = a.getRValue()
-  and e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 1
-  and e.getArrayType().getElementType() instanceof DoubleType
-  and e.getInitializer().getNumberOfElements() = 4
-  and e.getInitializer().getElement(1).getValue() = "1.5"
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is6") and
+  e = a.getRValue() and
+  e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 1 and
+  e.getArrayType().getElementType() instanceof DoubleType and
+  e.getInitializer().getNumberOfElements() = 4 and
+  e.getInitializer().getElement(1).getValue() = "1.5"
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
index b2312b925095..e34253a4f02b 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
@@ -1,17 +1,18 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("is7")
-  and e = a.getRValue()
-  and e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 2
-  and e.getArrayType().getElementType() instanceof StringType
-  and e.getInitializer().getNumberOfElements() = 2
-  and e.getInitializer().getElement(0).(ArrayInitializer).getElement(1).getValue() = "null"
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("is7") and
+  e = a.getRValue() and
+  e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 2 and
+  e.getArrayType().getElementType() instanceof StringType and
+  e.getInitializer().getNumberOfElements() = 2 and
+  e.getInitializer().getElement(0).(ArrayInitializer).getElement(1).getValue() = "null"
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
index b2dd5d698fbe..cc1fd366db13 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
@@ -1,17 +1,18 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("contacts2")
-  and e = a.getRValue()
-  and e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 1
-  and e.getArrayType().getElementType() instanceof AnonymousClass
-  and e.getInitializer().getNumberOfElements() = 2
-  and e.getInitializer().getElement(0) instanceof AnonymousObjectCreation
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+  e = a.getRValue() and
+  e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 1 and
+  e.getArrayType().getElementType() instanceof AnonymousClass and
+  e.getInitializer().getNumberOfElements() = 2 and
+  e.getInitializer().getElement(0) instanceof AnonymousObjectCreation
 select e
-
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
index d8a177abc109..fc4b561c170f 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
@@ -1,16 +1,18 @@
 /**
  * @name Test for array creations
  */
+
 import csharp
 
 from Assignment a, ArrayCreation e
-where a.getLValue().(VariableAccess).getTarget().hasName("t")
-  and e = a.getRValue()
-  and e.isImplicitlyTyped()
-  and e.isImplicitlySized()
-  and e.getArrayType().getDimension() = 1
-  and e.getArrayType().getRank() = 1
-  and e.getArrayType().getElementType().hasName("Type")
-  and e.getInitializer().getNumberOfElements() = 10
-  and e.getInitializer().getElement(0) instanceof TypeofExpr
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("t") and
+  e = a.getRValue() and
+  e.isImplicitlyTyped() and
+  e.isImplicitlySized() and
+  e.getArrayType().getDimension() = 1 and
+  e.getArrayType().getRank() = 1 and
+  e.getArrayType().getElementType().hasName("Type") and
+  e.getInitializer().getNumberOfElements() = 10 and
+  e.getInitializer().getElement(0) instanceof TypeofExpr
 select e
diff --git a/csharp/ql/test/library-tests/expressions/As1.ql b/csharp/ql/test/library-tests/expressions/As1.ql
index cbe86a29cbae..6c436883d134 100644
--- a/csharp/ql/test/library-tests/expressions/As1.ql
+++ b/csharp/ql/test/library-tests/expressions/As1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for as expressions
  */
+
 import csharp
 
 from Method m, AsExpr e
-where m.hasName("MainIsAsCast")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(ParameterAccess).getTarget().getName() = "o"
-  and e.getTargetType().(Class).hasQualifiedName("Expressions.Class")
-  and e.getEnclosingStmt().getParent().getParent() instanceof IfStmt
+where
+  m.hasName("MainIsAsCast") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(ParameterAccess).getTarget().getName() = "o" and
+  e.getTargetType().(Class).hasQualifiedName("Expressions.Class") and
+  e.getEnclosingStmt().getParent().getParent() instanceof IfStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/BaseAccess1.ql b/csharp/ql/test/library-tests/expressions/BaseAccess1.ql
index abfce27a3067..3469e88ea8ba 100644
--- a/csharp/ql/test/library-tests/expressions/BaseAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/BaseAccess1.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for base access
  */
+
 import csharp
 
 from Method m, BaseAccess e
-where m.hasName("OtherAccesses")
-  and e.getEnclosingCallable() = m
+where
+  m.hasName("OtherAccesses") and
+  e.getEnclosingCallable() = m
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Call1.ql b/csharp/ql/test/library-tests/expressions/Call1.ql
index a46733979565..be4e200e230b 100644
--- a/csharp/ql/test/library-tests/expressions/Call1.ql
+++ b/csharp/ql/test/library-tests/expressions/Call1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from StaticConstructor c, MethodCall e
-where c.hasName("Class")
-  and e.getEnclosingCallable() = c
-  and e.hasNoArguments()
-  and e.getEnclosingStmt() = c.getStatementBody().getStmt(2)
-  and not exists(e.getQualifier())
+where
+  c.hasName("Class") and
+  e.getEnclosingCallable() = c and
+  e.hasNoArguments() and
+  e.getEnclosingStmt() = c.getStatementBody().getStmt(2) and
+  not exists(e.getQualifier())
 select c, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Call2.ql b/csharp/ql/test/library-tests/expressions/Call2.ql
index 0f407068a790..4cf44d9c998c 100644
--- a/csharp/ql/test/library-tests/expressions/Call2.ql
+++ b/csharp/ql/test/library-tests/expressions/Call2.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from StaticConstructor c, MethodCall e
-where c.hasName("Class")
-  and e.getEnclosingCallable() = c
-  and e.hasNoArguments()
-  and e.getEnclosingStmt() = c.getStatementBody().getStmt(1)
-  and exists(e.getQualifier())
+where
+  c.hasName("Class") and
+  e.getEnclosingCallable() = c and
+  e.hasNoArguments() and
+  e.getEnclosingStmt() = c.getStatementBody().getStmt(1) and
+  exists(e.getQualifier())
 select c, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Call3.ql b/csharp/ql/test/library-tests/expressions/Call3.ql
index 0f407068a790..4cf44d9c998c 100644
--- a/csharp/ql/test/library-tests/expressions/Call3.ql
+++ b/csharp/ql/test/library-tests/expressions/Call3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from StaticConstructor c, MethodCall e
-where c.hasName("Class")
-  and e.getEnclosingCallable() = c
-  and e.hasNoArguments()
-  and e.getEnclosingStmt() = c.getStatementBody().getStmt(1)
-  and exists(e.getQualifier())
+where
+  c.hasName("Class") and
+  e.getEnclosingCallable() = c and
+  e.hasNoArguments() and
+  e.getEnclosingStmt() = c.getStatementBody().getStmt(1) and
+  exists(e.getQualifier())
 select c, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Call4.ql b/csharp/ql/test/library-tests/expressions/Call4.ql
index def234d320f7..4e631fd408e6 100644
--- a/csharp/ql/test/library-tests/expressions/Call4.ql
+++ b/csharp/ql/test/library-tests/expressions/Call4.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from Method m, MethodCall e, Method t
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getNumberOfArguments() = 2
-  and t = e.getTarget()
-  and t.hasName("Bar")
-  and e.getArgument(1) instanceof PropertyAccess
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getNumberOfArguments() = 2 and
+  t = e.getTarget() and
+  t.hasName("Bar") and
+  e.getArgument(1) instanceof PropertyAccess
 select m, e, t
-
diff --git a/csharp/ql/test/library-tests/expressions/Call5.ql b/csharp/ql/test/library-tests/expressions/Call5.ql
index dba85d03c6b5..c972dfa44712 100644
--- a/csharp/ql/test/library-tests/expressions/Call5.ql
+++ b/csharp/ql/test/library-tests/expressions/Call5.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from Method m, MethodCall e, Method t
-where m.hasName("OtherAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getNumberOfArguments() = 6
-  and t = e.getTarget()
-  and t.hasName("MainAccesses")
-  and t.getDeclaringType() = m.getDeclaringType().(NestedType).getDeclaringType()
-  and e.getQualifier() instanceof BaseAccess
-  and e.getArgument(0) instanceof ThisAccess
+where
+  m.hasName("OtherAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getNumberOfArguments() = 6 and
+  t = e.getTarget() and
+  t.hasName("MainAccesses") and
+  t.getDeclaringType() = m.getDeclaringType().(NestedType).getDeclaringType() and
+  e.getQualifier() instanceof BaseAccess and
+  e.getArgument(0) instanceof ThisAccess
 select m, e.getAnArgument(), t
-
diff --git a/csharp/ql/test/library-tests/expressions/Call6.ql b/csharp/ql/test/library-tests/expressions/Call6.ql
index c852b914e9e9..ff98957c2b1c 100644
--- a/csharp/ql/test/library-tests/expressions/Call6.ql
+++ b/csharp/ql/test/library-tests/expressions/Call6.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from Method m, MethodCall e, Method t, CastExpr cast
-where m.hasName("OtherAccesses")
-  and e.getEnclosingCallable() = m
-  and t = e.getTarget()
-  and t.hasName("MainAccesses")
-  and e.getArgument(1) = cast
-  and cast.getExpr() instanceof IntLiteral
-  and cast.getExpr().getValue() = "1"
+where
+  m.hasName("OtherAccesses") and
+  e.getEnclosingCallable() = m and
+  t = e.getTarget() and
+  t.hasName("MainAccesses") and
+  e.getArgument(1) = cast and
+  cast.getExpr() instanceof IntLiteral and
+  cast.getExpr().getValue() = "1"
 select m, e.getAnArgument(), t
-
diff --git a/csharp/ql/test/library-tests/expressions/Call7.ql b/csharp/ql/test/library-tests/expressions/Call7.ql
index 95224c2cc988..6bb2fb5147b5 100644
--- a/csharp/ql/test/library-tests/expressions/Call7.ql
+++ b/csharp/ql/test/library-tests/expressions/Call7.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for calls
  */
+
 import csharp
 
 from Method m, MethodCall e, Method t
-where m.hasName("MainLocalVarDecl")
-  and e.getEnclosingCallable() = m
-  and t = e.getTarget()
-  and t.hasName("WriteLine")
-  and t.getDeclaringType().hasQualifiedName("System", "Console")
-  and e.getArgument(0) instanceof AddExpr
+where
+  m.hasName("MainLocalVarDecl") and
+  e.getEnclosingCallable() = m and
+  t = e.getTarget() and
+  t.hasName("WriteLine") and
+  t.getDeclaringType().hasQualifiedName("System", "Console") and
+  e.getArgument(0) instanceof AddExpr
 select m, e.getAnArgument(), t.toString()
-
diff --git a/csharp/ql/test/library-tests/expressions/Cast1.ql b/csharp/ql/test/library-tests/expressions/Cast1.ql
index b30e35ff3492..d7f812326efa 100644
--- a/csharp/ql/test/library-tests/expressions/Cast1.ql
+++ b/csharp/ql/test/library-tests/expressions/Cast1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for cast expressions
  */
+
 import csharp
 
 from Method m, CastExpr e
-where m.hasName("MainIsAsCast")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(ParameterAccess).getTarget().getName() = "p"
-  and e.getTargetType().(Class).hasQualifiedName("Expressions.Class")
-  and e.getEnclosingStmt().getParent().getParent() instanceof IfStmt
+where
+  m.hasName("MainIsAsCast") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(ParameterAccess).getTarget().getName() = "p" and
+  e.getTargetType().(Class).hasQualifiedName("Expressions.Class") and
+  e.getEnclosingStmt().getParent().getParent() instanceof IfStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Cast2.ql b/csharp/ql/test/library-tests/expressions/Cast2.ql
index 9480c1b7936a..baef69f2521d 100644
--- a/csharp/ql/test/library-tests/expressions/Cast2.ql
+++ b/csharp/ql/test/library-tests/expressions/Cast2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for cast expressions
  */
+
 import csharp
 
 from Method m, CastExpr e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(ULongLiteral).getValue() = "4"
-  and e.getTargetType() instanceof IntType
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(ULongLiteral).getValue() = "4" and
+  e.getTargetType() instanceof IntType
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Cast3.ql b/csharp/ql/test/library-tests/expressions/Cast3.ql
index 67925eb78924..54197cc9aef8 100644
--- a/csharp/ql/test/library-tests/expressions/Cast3.ql
+++ b/csharp/ql/test/library-tests/expressions/Cast3.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for implicit cast
  */
+
 import csharp
 
 from Method m, CastExpr e, VariableAccess access
-where m.hasName("MainIsAsCast")
-  and e.getEnclosingCallable() = m
-  and e.getExpr() = access
-  and access.getTarget().getName() = "i"
-  and e.isImplicit()
+where
+  m.hasName("MainIsAsCast") and
+  e.getEnclosingCallable() = m and
+  e.getExpr() = access and
+  access.getTarget().getName() = "i" and
+  e.isImplicit()
 select 1
diff --git a/csharp/ql/test/library-tests/expressions/ConstructorInitializer1.ql b/csharp/ql/test/library-tests/expressions/ConstructorInitializer1.ql
index 8dc7a9c9399a..43af39d55931 100644
--- a/csharp/ql/test/library-tests/expressions/ConstructorInitializer1.ql
+++ b/csharp/ql/test/library-tests/expressions/ConstructorInitializer1.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for constructor initializers
  */
+
 import csharp
 
 from InstanceConstructor c, ConstructorInitializer i
-where c.hasName("Class")
-  and i.getEnclosingCallable() = c
-  and c.getInitializer() = i
-  and c.hasNoParameters()
-  and i.getTarget().getDeclaringType() = c.getDeclaringType()
-  and i.getTarget().getNumberOfParameters() = 1
-  and i.getArgument(0).getValue() = "0"
+where
+  c.hasName("Class") and
+  i.getEnclosingCallable() = c and
+  c.getInitializer() = i and
+  c.hasNoParameters() and
+  i.getTarget().getDeclaringType() = c.getDeclaringType() and
+  i.getTarget().getNumberOfParameters() = 1 and
+  i.getArgument(0).getValue() = "0"
 select c, i
-
diff --git a/csharp/ql/test/library-tests/expressions/ConstructorInitializer2.ql b/csharp/ql/test/library-tests/expressions/ConstructorInitializer2.ql
index 387a8ace4296..293d6f2ab34d 100644
--- a/csharp/ql/test/library-tests/expressions/ConstructorInitializer2.ql
+++ b/csharp/ql/test/library-tests/expressions/ConstructorInitializer2.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for constructor initializers
  */
+
 import csharp
 
 from InstanceConstructor c, ConstructorInitializer i
-where c.hasName("Nested")
-  and i.getEnclosingCallable() = c
-  and c.getInitializer() = i
-  and c.getNumberOfParameters() = 1
-  and i.getTarget().getDeclaringType() = c.getDeclaringType().getBaseClass()
-  and i.getTarget().getNumberOfParameters() = 1
-  and i.getArgument(0) instanceof AddExpr
+where
+  c.hasName("Nested") and
+  i.getEnclosingCallable() = c and
+  c.getInitializer() = i and
+  c.getNumberOfParameters() = 1 and
+  i.getTarget().getDeclaringType() = c.getDeclaringType().getBaseClass() and
+  i.getTarget().getNumberOfParameters() = 1 and
+  i.getArgument(0) instanceof AddExpr
 select c, i
-
diff --git a/csharp/ql/test/library-tests/expressions/Default1.ql b/csharp/ql/test/library-tests/expressions/Default1.ql
index 03ead692da07..41167315e957 100644
--- a/csharp/ql/test/library-tests/expressions/Default1.ql
+++ b/csharp/ql/test/library-tests/expressions/Default1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for default value expressions
  */
+
 import csharp
 
 from Method m, DefaultValueExpr e
-where m.hasName("MainIsAsCast")
-  and e.getEnclosingCallable() = m
-  and e.getType() instanceof IntType
-  and e.getTypeAccess().getTarget() instanceof IntType
+where
+  m.hasName("MainIsAsCast") and
+  e.getEnclosingCallable() = m and
+  e.getType() instanceof IntType and
+  e.getTypeAccess().getTarget() instanceof IntType
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Default2.ql b/csharp/ql/test/library-tests/expressions/Default2.ql
index 3626727e754e..0e4a25cc4f71 100644
--- a/csharp/ql/test/library-tests/expressions/Default2.ql
+++ b/csharp/ql/test/library-tests/expressions/Default2.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for default value expressions
  */
+
 import csharp
 
 from Method m, DefaultValueExpr e, TypeParameter t
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getType() = e.getTypeAccess().getTarget()
-  and e.getType() = t
-  and t.hasName("T")
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getType() = e.getTypeAccess().getTarget() and
+  e.getType() = t and
+  t.hasName("T")
 select m, e, t
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCall1.ql b/csharp/ql/test/library-tests/expressions/DelegateCall1.ql
index 00e624035fb4..430d2fdc43a4 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCall1.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCall1.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for delegate calls
  */
+
 import csharp
 
 from Method m, DelegateCall e, LocalVariableAccess a
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getNumberOfArguments() = 1
-  and e.getDelegateExpr() = a
-  and a.getTarget().hasName("cd1")
-  and e.getArgument(0).getValue() = "-40"
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getNumberOfArguments() = 1 and
+  e.getDelegateExpr() = a and
+  a.getTarget().hasName("cd1") and
+  e.getArgument(0).getValue() = "-40"
 select m, e, a
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCall2.ql b/csharp/ql/test/library-tests/expressions/DelegateCall2.ql
index 05479381d88f..4fb915f30867 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCall2.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCall2.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for delegate calls
  */
+
 import csharp
 
 from Method m, DelegateCall e, LocalVariableAccess a
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getNumberOfArguments() = 1
-  and e.getDelegateExpr() = a
-  and a.getTarget().hasName("cd7")
-  and e.getArgument(0).(AddExpr).getRightOperand().(LocalVariableAccess).getTarget().hasName("x")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getNumberOfArguments() = 1 and
+  e.getDelegateExpr() = a and
+  a.getTarget().hasName("cd7") and
+  e.getArgument(0).(AddExpr).getRightOperand().(LocalVariableAccess).getTarget().hasName("x")
 select m, e, a
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCall3.ql b/csharp/ql/test/library-tests/expressions/DelegateCall3.ql
index 1ffb8b1632e3..5702cad683ab 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCall3.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCall3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for delegate calls
  */
+
 import csharp
 
 from Method m, DelegateCall e, LocalVariableAccess a
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateExpr() = a
-  and a.getTarget().hasName("cd7")
-  and a.getTarget().getType().(DelegateType).hasQualifiedName("Expressions.D")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateExpr() = a and
+  a.getTarget().hasName("cd7") and
+  a.getTarget().getType().(DelegateType).hasQualifiedName("Expressions.D")
 select m, e, a
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation1.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation1.ql
index d1d15a19b64d..e3b66417f282 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for delegate creations
  */
+
 import csharp
 
 from Method m, ExplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(LocalVariableAccess).getTarget().hasName("cd6")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(LocalVariableAccess).getTarget().hasName("cd6")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation2.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation2.ql
index 9d089cabac4c..a81bc44c0ca4 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for delegate creations
  */
+
 import csharp
 
 from Method m, ExplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(MethodAccess).getTarget().hasName("M1")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(MethodAccess).getTarget().hasName("M1")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation3.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation3.ql
index 3324325ccfc9..c0bbc33723e5 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for delegate creations
  */
+
 import csharp
 
 from Method m, ExplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(MethodAccess).getTarget().hasName("M3")
-  and e.getArgument().(MethodAccess).getQualifier().(LocalVariableAccess).getTarget().hasName("c")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(MethodAccess).getTarget().hasName("M3") and
+  e.getArgument().(MethodAccess).getQualifier().(LocalVariableAccess).getTarget().hasName("c")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation4.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation4.ql
index 341a5d3dd7ca..2ac6a5722e06 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation4.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for delegate creations
  */
+
 import csharp
 
 from Method m, ImplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(MethodAccess).getTarget().hasName("M2")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(MethodAccess).getTarget().hasName("M2")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation5.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation5.ql
index 2ebd3fcd1521..59d516342213 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation5.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation5.ql
@@ -1,8 +1,9 @@
 import csharp
 
 from Method m, ExplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(LocalFunctionAccess).getTarget().hasName("LocalFunction")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(LocalFunctionAccess).getTarget().hasName("LocalFunction")
 select m, e
diff --git a/csharp/ql/test/library-tests/expressions/DelegateCreation6.ql b/csharp/ql/test/library-tests/expressions/DelegateCreation6.ql
index 6ae4b1250586..48271c80eac4 100644
--- a/csharp/ql/test/library-tests/expressions/DelegateCreation6.ql
+++ b/csharp/ql/test/library-tests/expressions/DelegateCreation6.ql
@@ -1,8 +1,9 @@
 import csharp
 
 from Method m, ImplicitDelegateCreation e
-where m.hasName("MainDelegateAndMethodAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getDelegateType().hasName("D")
-  and e.getArgument().(LocalFunctionAccess).getTarget().hasName("LocalFunction")
+where
+  m.hasName("MainDelegateAndMethodAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getDelegateType().hasName("D") and
+  e.getArgument().(LocalFunctionAccess).getTarget().hasName("LocalFunction")
 select m, e
diff --git a/csharp/ql/test/library-tests/expressions/EventAccess1.ql b/csharp/ql/test/library-tests/expressions/EventAccess1.ql
index ba0fa31eb004..4ddf75670b52 100644
--- a/csharp/ql/test/library-tests/expressions/EventAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/EventAccess1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for event access
  */
+
 import csharp
 
 from Method m, EventAccess e
-where m.hasName("OnClick")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Click"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-   and e.getEnclosingStmt() instanceof IfStmt
+where
+  m.hasName("OnClick") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Click" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  e.getEnclosingStmt() instanceof IfStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/EventAccess2.ql b/csharp/ql/test/library-tests/expressions/EventAccess2.ql
index 72383291b611..a085555ec2d4 100644
--- a/csharp/ql/test/library-tests/expressions/EventAccess2.ql
+++ b/csharp/ql/test/library-tests/expressions/EventAccess2.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for event access
  */
+
 import csharp
 
 from Method m, EventAccess e
-where m.hasName("Reset")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Click"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-  and e.getQualifier().isImplicit()
+where
+  m.hasName("Reset") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Click" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  e.getQualifier().isImplicit()
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/EventAccess3.ql b/csharp/ql/test/library-tests/expressions/EventAccess3.ql
index 745e9f4c298b..741f973b2216 100644
--- a/csharp/ql/test/library-tests/expressions/EventAccess3.ql
+++ b/csharp/ql/test/library-tests/expressions/EventAccess3.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for event access
  */
+
 import csharp
 
 from Method m, EventAccess e, DelegateCall d
-where m.hasName("OnClick")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Click"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-  and d.getEnclosingCallable() = m
-  and d.getDelegateExpr() = e
-  and d.getArgument(0) instanceof ThisAccess
-  and d.getArgument(1).(ParameterAccess).getTarget().hasName("e")
+where
+  m.hasName("OnClick") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Click" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  d.getEnclosingCallable() = m and
+  d.getDelegateExpr() = e and
+  d.getArgument(0) instanceof ThisAccess and
+  d.getArgument(1).(ParameterAccess).getTarget().hasName("e")
 select m, d, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ExprsChecked1.ql b/csharp/ql/test/library-tests/expressions/ExprsChecked1.ql
index 02f492016ae5..0293d9db385a 100644
--- a/csharp/ql/test/library-tests/expressions/ExprsChecked1.ql
+++ b/csharp/ql/test/library-tests/expressions/ExprsChecked1.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for checked expression
  */
+
 import csharp
 
 from Method m, CheckedExpr e
-where m.hasName("MainChecked")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(PropertyAccess).getTarget().hasName("Name")
+where
+  m.hasName("MainChecked") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(PropertyAccess).getTarget().hasName("Name")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ExprsUnchecked1.ql b/csharp/ql/test/library-tests/expressions/ExprsUnchecked1.ql
index 3f6d4bacb5f6..2240027f0c55 100644
--- a/csharp/ql/test/library-tests/expressions/ExprsUnchecked1.ql
+++ b/csharp/ql/test/library-tests/expressions/ExprsUnchecked1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for unchecked expression
  */
+
 import csharp
 
 from Method m, UncheckedExpr e
-where m.hasName("MainChecked")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(AddExpr).getLeftOperand().(FieldAccess).getTarget().hasName("f")
-  and e.getExpr().(AddExpr).getRightOperand().(IntLiteral).getValue() = "20"
+where
+  m.hasName("MainChecked") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(AddExpr).getLeftOperand().(FieldAccess).getTarget().hasName("f") and
+  e.getExpr().(AddExpr).getRightOperand().(IntLiteral).getValue() = "20"
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/FieldAccess1.ql b/csharp/ql/test/library-tests/expressions/FieldAccess1.ql
index 9d64b07cc4a7..f766e5bf81ce 100644
--- a/csharp/ql/test/library-tests/expressions/FieldAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/FieldAccess1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for field access
  */
+
 import csharp
 
 from Method m, FieldAccess e
-where m.hasName("OtherAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getQualifier() instanceof ThisAccess
-  and e.getTarget().getName() = "f"
+where
+  m.hasName("OtherAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getQualifier() instanceof ThisAccess and
+  e.getTarget().getName() = "f"
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/IndexerAccess1.ql b/csharp/ql/test/library-tests/expressions/IndexerAccess1.ql
index b133d91a4626..3d99c08ff7a0 100644
--- a/csharp/ql/test/library-tests/expressions/IndexerAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/IndexerAccess1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for indexer access
  */
+
 import csharp
 
 from Method m, IndexerAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getQualifier().(ParameterAccess).getTarget().hasName("other")
-  and e.getIndex(0).(LocalVariableAccess).getTarget().hasName("i")
-  and e.getIndex(1).(MemberConstantAccess).getTarget().hasName("constant")
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getQualifier().(ParameterAccess).getTarget().hasName("other") and
+  e.getIndex(0).(LocalVariableAccess).getTarget().hasName("i") and
+  e.getIndex(1).(MemberConstantAccess).getTarget().hasName("constant")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/IndexerAccess2.ql b/csharp/ql/test/library-tests/expressions/IndexerAccess2.ql
index 2d2c1fe8e65d..fd746bd49e39 100644
--- a/csharp/ql/test/library-tests/expressions/IndexerAccess2.ql
+++ b/csharp/ql/test/library-tests/expressions/IndexerAccess2.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for indexer access
  */
+
 import csharp
 
 from Method m, IndexerAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getQualifier() instanceof ThisAccess
-  and e.getIndex(0).(IntLiteral).getValue() = "0"
-  and e.getIndex(1).(StringLiteral).getValue() = ""
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getQualifier() instanceof ThisAccess and
+  e.getIndex(0).(IntLiteral).getValue() = "0" and
+  e.getIndex(1).(StringLiteral).getValue() = ""
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Is1.ql b/csharp/ql/test/library-tests/expressions/Is1.ql
index ba627906c14d..ab24b4aeb7dc 100644
--- a/csharp/ql/test/library-tests/expressions/Is1.ql
+++ b/csharp/ql/test/library-tests/expressions/Is1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for is expressions
  */
+
 import csharp
 
 from Method m, IsTypeExpr e
-where m.hasName("MainIsAsCast")
-  and e.getEnclosingCallable() = m
-  and e.getExpr().(ParameterAccess).getTarget().getName() = "o"
-  and e.getCheckedType().(Class).hasQualifiedName("Expressions.Class")
+where
+  m.hasName("MainIsAsCast") and
+  e.getEnclosingCallable() = m and
+  e.getExpr().(ParameterAccess).getTarget().getName() = "o" and
+  e.getCheckedType().(Class).hasQualifiedName("Expressions.Class")
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Lambda1.ql b/csharp/ql/test/library-tests/expressions/Lambda1.ql
index ee29d9c88d89..f4787c584f32 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda1.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda1.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f1")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getParameter(0).getType() instanceof ShortType
-  and e.getParameter(0).hasName("x")
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f1") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getParameter(0).getType() instanceof ShortType and
+  e.getParameter(0).hasName("x")
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Lambda2.ql b/csharp/ql/test/library-tests/expressions/Lambda2.ql
index 7418d02cdc9d..5fff4bd2cf62 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda2.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda2.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f2")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getParameter(0).getType() instanceof IntType
-  and e.getParameter(0).hasName("x")
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f2") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getParameter(0).getType() instanceof IntType and
+  e.getParameter(0).hasName("x")
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Lambda3.ql b/csharp/ql/test/library-tests/expressions/Lambda3.ql
index 10a32af76ada..32aa919cd205 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda3.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda3.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f3")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getParameter(0).getType() instanceof IntType
-  and e.getParameter(0).hasName("x")
-  and e.getExpressionBody() instanceof AddExpr
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f3") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getParameter(0).getType() instanceof IntType and
+  e.getParameter(0).hasName("x") and
+  e.getExpressionBody() instanceof AddExpr
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Lambda4.ql b/csharp/ql/test/library-tests/expressions/Lambda4.ql
index 5c2ad62f4722..ca7eb7a4207b 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda4.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda4.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f4")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 1
-  and e.getParameter(0).getType() instanceof IntType
-  and e.getParameter(0).hasName("x")
-  and e.getType().(DelegateType).getReturnType() instanceof StringType
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f4") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 1 and
+  e.getParameter(0).getType() instanceof IntType and
+  e.getParameter(0).hasName("x") and
+  e.getType().(DelegateType).getReturnType() instanceof StringType
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Lambda5.ql b/csharp/ql/test/library-tests/expressions/Lambda5.ql
index c79918a58cd9..cc577aa85cb7 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda5.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda5.ql
@@ -1,15 +1,17 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f5")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 2
-  and e.getParameter(0).getType() instanceof IntType
-  and e.getParameter(0).hasName("x")
-  and e.getParameter(1).getType() instanceof IntType
-  and e.getParameter(1).hasName("y")
-  and e.getType().(DelegateType).hasName("S")
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f5") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 2 and
+  e.getParameter(0).getType() instanceof IntType and
+  e.getParameter(0).hasName("x") and
+  e.getParameter(1).getType() instanceof IntType and
+  e.getParameter(1).hasName("y") and
+  e.getType().(DelegateType).hasName("S")
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Lambda6.ql b/csharp/ql/test/library-tests/expressions/Lambda6.ql
index bd89fe9edce0..c584e4f6c093 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda6.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda6.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for lambda expressions
  */
+
 import csharp
 
 from Assignment assign, LambdaExpr e
-where assign.getLValue().(VariableAccess).getTarget().hasName("f6")
-  and e.getParent+() = assign
-  and e.getNumberOfParameters() = 0
-  and e.getType().(DelegateType).hasName("Unit")
-  and e.getExpressionBody() instanceof Call
+where
+  assign.getLValue().(VariableAccess).getTarget().hasName("f6") and
+  e.getParent+() = assign and
+  e.getNumberOfParameters() = 0 and
+  e.getType().(DelegateType).hasName("Unit") and
+  e.getExpressionBody() instanceof Call
 select e
diff --git a/csharp/ql/test/library-tests/expressions/Literals1.ql b/csharp/ql/test/library-tests/expressions/Literals1.ql
index d2ce8052e09b..0a80d5991ff4 100644
--- a/csharp/ql/test/library-tests/expressions/Literals1.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, BoolLiteral t, BoolLiteral f
-where m.hasName("MainLiterals")
-  and t.getEnclosingCallable() = m
-  and t.getValue() = "true"
-  and f.getEnclosingCallable() = m
-  and f.getValue() = "false"
+where
+  m.hasName("MainLiterals") and
+  t.getEnclosingCallable() = m and
+  t.getValue() = "true" and
+  f.getEnclosingCallable() = m and
+  f.getValue() = "false"
 select t, f
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals10.ql b/csharp/ql/test/library-tests/expressions/Literals10.ql
index 4e6dedb91a71..1522de0205c3 100644
--- a/csharp/ql/test/library-tests/expressions/Literals10.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals10.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, StringLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue().toUpperCase() = "TEST"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue().toUpperCase() = "TEST"
 select l, l.getValue()
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals11.ql b/csharp/ql/test/library-tests/expressions/Literals11.ql
index 252a676bd23d..57c800b18e05 100644
--- a/csharp/ql/test/library-tests/expressions/Literals11.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals11.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, NullLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "null"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "null"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals2.ql b/csharp/ql/test/library-tests/expressions/Literals2.ql
index e05fabbdd2d0..6940b67e689c 100644
--- a/csharp/ql/test/library-tests/expressions/Literals2.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, CharLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "@"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "@"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals3.ql b/csharp/ql/test/library-tests/expressions/Literals3.ql
index e237a612041f..784384d73680 100644
--- a/csharp/ql/test/library-tests/expressions/Literals3.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals3.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, IntLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "1"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "1"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals4.ql b/csharp/ql/test/library-tests/expressions/Literals4.ql
index 66b511d1a6d0..4fee02fa80d2 100644
--- a/csharp/ql/test/library-tests/expressions/Literals4.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals4.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, LongLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "8989898"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "8989898"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals5.ql b/csharp/ql/test/library-tests/expressions/Literals5.ql
index c1137265c805..6102bd5cf3b3 100644
--- a/csharp/ql/test/library-tests/expressions/Literals5.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals5.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, UIntLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "3"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "3"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals6.ql b/csharp/ql/test/library-tests/expressions/Literals6.ql
index fe53f6fe3359..9269e4667cd3 100644
--- a/csharp/ql/test/library-tests/expressions/Literals6.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals6.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, ULongLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "89898787897"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "89898787897"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals7.ql b/csharp/ql/test/library-tests/expressions/Literals7.ql
index 7c5c328c9556..82d3261d78a0 100644
--- a/csharp/ql/test/library-tests/expressions/Literals7.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals7.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, FloatLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "4.5"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "4.5"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals8.ql b/csharp/ql/test/library-tests/expressions/Literals8.ql
index 51295a5df27d..6672020f8462 100644
--- a/csharp/ql/test/library-tests/expressions/Literals8.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals8.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, DoubleLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "4.565"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "4.565"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/Literals9.ql b/csharp/ql/test/library-tests/expressions/Literals9.ql
index 6e12701d0101..c34c02b6c2d6 100644
--- a/csharp/ql/test/library-tests/expressions/Literals9.ql
+++ b/csharp/ql/test/library-tests/expressions/Literals9.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for literals
  */
+
 import csharp
 
 from Method m, DecimalLiteral l
-where m.hasName("MainLiterals")
-  and l.getEnclosingCallable() = m
-  and l.getValue() = "123.456"
+where
+  m.hasName("MainLiterals") and
+  l.getEnclosingCallable() = m and
+  l.getValue() = "123.456"
 select l
-
diff --git a/csharp/ql/test/library-tests/expressions/LocalConstAccess1.ql b/csharp/ql/test/library-tests/expressions/LocalConstAccess1.ql
index b2f90a4b8593..912a9d61063c 100644
--- a/csharp/ql/test/library-tests/expressions/LocalConstAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/LocalConstAccess1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for local constant access
  */
+
 import csharp
 
 from Method m, LocalVariableAccess e, LocalConstant c
-where m.hasName("MainLocalConstDecl")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = c
-  and c.getName() = "pi"
-  and e.getParent().getParent().getParent() instanceof Call
+where
+  m.hasName("MainLocalConstDecl") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = c and
+  c.getName() = "pi" and
+  e.getParent().getParent().getParent() instanceof Call
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/LocalVarAccess1.ql b/csharp/ql/test/library-tests/expressions/LocalVarAccess1.ql
index 9898f0a8fabb..39794cbd002c 100644
--- a/csharp/ql/test/library-tests/expressions/LocalVarAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/LocalVarAccess1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for local variable access
  */
+
 import csharp
 
 from Method m, LocalVariableAccess e
-where m.hasName("MainLocalVarDecl")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "a"
-  and e.getParent() instanceof AssignExpr
+where
+  m.hasName("MainLocalVarDecl") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "a" and
+  e.getParent() instanceof AssignExpr
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/LocalVarAccess2.ql b/csharp/ql/test/library-tests/expressions/LocalVarAccess2.ql
index 363e957c8ab1..9a56d395b085 100644
--- a/csharp/ql/test/library-tests/expressions/LocalVarAccess2.ql
+++ b/csharp/ql/test/library-tests/expressions/LocalVarAccess2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for local variable access
  */
+
 import csharp
 
 from Method m, LocalVariableAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "i"
-  and e.getParent() instanceof IndexerAccess
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "i" and
+  e.getParent() instanceof IndexerAccess
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/LogicalOperators1.ql b/csharp/ql/test/library-tests/expressions/LogicalOperators1.ql
index fbf0309f948c..37a85a9f0afa 100644
--- a/csharp/ql/test/library-tests/expressions/LogicalOperators1.ql
+++ b/csharp/ql/test/library-tests/expressions/LogicalOperators1.ql
@@ -5,7 +5,8 @@
 import csharp
 
 from LogicalOperation o, int i, Location loc
-where loc = o.getLocation()
-  and loc.getStartLine() = loc.getEndLine()
-  and o.getEnclosingCallable().getName() = "LogicalOperators"
+where
+  loc = o.getLocation() and
+  loc.getStartLine() = loc.getEndLine() and
+  o.getEnclosingCallable().getName() = "LogicalOperators"
 select loc.getStartLine(), loc.getStartColumn(), loc.getEndColumn(), o, i, o.getChild(i)
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation1.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation1.ql
index 4003aa586a1f..6ce55cfd32b7 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Constructor c, ObjectCreation e, Constructor cc
-where c.hasName("LoginDialog")
-  and e.getEnclosingCallable() = c
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Button")
+where
+  c.hasName("LoginDialog") and
+  e.getEnclosingCallable() = c and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Button")
 select c, e, cc
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
index a897e845b2d9..abd4a9d6ec6b 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Assignment a, CollectionInitializer i
-where a.getLValue().(VariableAccess).getTarget().hasName("list1")
-  and i.getParent+() = a
-  and i.getElementInitializer(0).getArgument(0) instanceof AssignExpr
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("list1") and
+  i.getParent+() = a and
+  i.getElementInitializer(0).getArgument(0) instanceof AssignExpr
 select i.getAChild+()
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
index c0d1d4f71abc..c874735c3000 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Assignment a, CollectionInitializer i, AnonymousObjectCreation o
-where a.getLValue().(VariableAccess).getTarget().hasName("list2")
-  and i.getParent+() = a
-  and i.getElementInitializer(0).getArgument(0) = o
+where
+  a.getLValue().(VariableAccess).getTarget().hasName("list2") and
+  i.getParent+() = a and
+  i.getElementInitializer(0).getArgument(0) = o
 select i, o
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation2.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation2.ql
index 50102e2e648f..7aa872a27ad2 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation2.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Method m, ObjectCreation e, Constructor cc
-where m.hasName("MainUnaryOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 1
-  and e.getArgument(0).getValue() = "4"
-  and cc.hasName("IntVector")
-  and not e.hasInitializer()
+where
+  m.hasName("MainUnaryOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 1 and
+  e.getArgument(0).getValue() = "4" and
+  cc.hasName("IntVector") and
+  not e.hasInitializer()
 select m, e, cc
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation3.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation3.ql
index 5f533dae5bb0..0cadbb0ea776 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation3.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Method m, ObjectCreation e, Constructor cc, ObjectOrCollectionInitializer i
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Point")
-  and i = e.getInitializer()
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Point") and
+  i = e.getInitializer()
 select m, e, cc, i
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
index 7edb0c84aa9d..5812397b11b6 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
@@ -1,21 +1,23 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
-from Method m, ObjectCreation e, Constructor cc, ObjectInitializer i,
-    MemberInitializer a, MemberInitializer b
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Point")
-  and i = e.getInitializer()
-  and a = i.getMemberInitializer(0)
-  and a.getLValue().(PropertyAccess).getTarget().hasName("X")
-  and a.getRValue().getValue() = "0"
-  and b = i.getMemberInitializer(1)
-  and b.getLValue().(PropertyAccess).getTarget().hasName("Y")
-  and b.getRValue().getValue() = "1"
+from
+  Method m, ObjectCreation e, Constructor cc, ObjectInitializer i, MemberInitializer a,
+  MemberInitializer b
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Point") and
+  i = e.getInitializer() and
+  a = i.getMemberInitializer(0) and
+  a.getLValue().(PropertyAccess).getTarget().hasName("X") and
+  a.getRValue().getValue() = "0" and
+  b = i.getMemberInitializer(1) and
+  b.getLValue().(PropertyAccess).getTarget().hasName("Y") and
+  b.getRValue().getValue() = "1"
 select e, i, a, b
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
index 9c561d8768da..cf31f518ec73 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
@@ -1,22 +1,24 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
-from Method m, ObjectCreation e, Constructor cc, ObjectInitializer i,
-    MemberInitializer a, MemberInitializer b
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Point")
-  and i = e.getInitializer()
-  and a = i.getMemberInitializer(0)
-  and a.getLValue().(PropertyAccess).getTarget().hasName("X")
-  and a.getRValue().getValue() = "2"
-  and b = i.getMemberInitializer(1)
-  and b.getLValue().(PropertyAccess).getTarget().hasName("Y")
-  and b.getRValue().getValue() = "3"
-  and i.getNumberOfMemberInitializers() = 2
+from
+  Method m, ObjectCreation e, Constructor cc, ObjectInitializer i, MemberInitializer a,
+  MemberInitializer b
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Point") and
+  i = e.getInitializer() and
+  a = i.getMemberInitializer(0) and
+  a.getLValue().(PropertyAccess).getTarget().hasName("X") and
+  a.getRValue().getValue() = "2" and
+  b = i.getMemberInitializer(1) and
+  b.getLValue().(PropertyAccess).getTarget().hasName("Y") and
+  b.getRValue().getValue() = "3" and
+  i.getNumberOfMemberInitializers() = 2
 select i, a, b
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
index c302c8aefe47..11e771890ca2 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
@@ -1,22 +1,24 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
-from Method m, ObjectCreation e, Constructor cc, ObjectInitializer i,
-    MemberInitializer a, MemberInitializer b
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Rectangle")
-  and i = e.getInitializer()
-  and a = i.getMemberInitializer(0)
-  and a.getLValue().(PropertyAccess).getTarget().hasName("P1")
-  and a.getRValue() instanceof ObjectCreation
-  and b = i.getMemberInitializer(1)
-  and b.getLValue().(PropertyAccess).getTarget().hasName("P2")
-  and b.getRValue() instanceof ObjectCreation
-  and i.getNumberOfMemberInitializers() = 2
+from
+  Method m, ObjectCreation e, Constructor cc, ObjectInitializer i, MemberInitializer a,
+  MemberInitializer b
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Rectangle") and
+  i = e.getInitializer() and
+  a = i.getMemberInitializer(0) and
+  a.getLValue().(PropertyAccess).getTarget().hasName("P1") and
+  a.getRValue() instanceof ObjectCreation and
+  b = i.getMemberInitializer(1) and
+  b.getLValue().(PropertyAccess).getTarget().hasName("P2") and
+  b.getRValue() instanceof ObjectCreation and
+  i.getNumberOfMemberInitializers() = 2
 select i, a, b
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
index d5832c177876..ccb17515525e 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
@@ -1,22 +1,24 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
-from Method m, ObjectCreation e, Constructor cc, ObjectInitializer i,
-    MemberInitializer a, MemberInitializer b
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.hasName("Rectangle2")
-  and i = e.getInitializer()
-  and a = i.getMemberInitializer(0)
-  and a.getLValue().(PropertyAccess).getTarget().hasName("P1")
-  and a.getRValue() instanceof ObjectInitializer
-  and b = i.getMemberInitializer(1)
-  and b.getLValue().(PropertyAccess).getTarget().hasName("P2")
-  and b.getRValue() instanceof ObjectInitializer
-  and i.getNumberOfMemberInitializers() = 2
+from
+  Method m, ObjectCreation e, Constructor cc, ObjectInitializer i, MemberInitializer a,
+  MemberInitializer b
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.hasName("Rectangle2") and
+  i = e.getInitializer() and
+  a = i.getMemberInitializer(0) and
+  a.getLValue().(PropertyAccess).getTarget().hasName("P1") and
+  a.getRValue() instanceof ObjectInitializer and
+  b = i.getMemberInitializer(1) and
+  b.getLValue().(PropertyAccess).getTarget().hasName("P2") and
+  b.getRValue() instanceof ObjectInitializer and
+  i.getNumberOfMemberInitializers() = 2
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation8.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation8.ql
index 900e23e090c0..00e39109f1e4 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation8.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation8.ql
@@ -1,17 +1,19 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Method m, ObjectCreation e, Constructor cc, CollectionInitializer i
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.getName().matches("List%")
-  and i = e.getInitializer()
-  and i.getNumberOfElementInitializers() = 10
-  and forall(int d | d in [0..9] |
-               i.getElementInitializer(d).getArgument(0).getValue() = d.toString())
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.getName().matches("List%") and
+  i = e.getInitializer() and
+  i.getNumberOfElementInitializers() = 10 and
+  forall(int d | d in [0 .. 9] |
+    i.getElementInitializer(d).getArgument(0).getValue() = d.toString()
+  )
 select m, e, i
-
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation9.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation9.ql
index 37fa1e47f2f5..7dcedc88c1a3 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation9.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation9.ql
@@ -1,17 +1,18 @@
 /**
  * @name Test for object creations
  */
+
 import csharp
 
 from Method m, ObjectCreation e, Constructor cc, CollectionInitializer i
-where m.hasName("MainCreations")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = cc
-  and e.getNumberOfArguments() = 0
-  and cc.getDeclaringType().getName() = "List<Contact>"
-  and i = e.getInitializer()
-  and i.getNumberOfElementInitializers() = 2
-  and i.getElementInitializer(0).getArgument(0) instanceof ObjectCreation
-  and i.getElementInitializer(1).getArgument(0) instanceof ObjectCreation
+where
+  m.hasName("MainCreations") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = cc and
+  e.getNumberOfArguments() = 0 and
+  cc.getDeclaringType().getName() = "List<Contact>" and
+  i = e.getInitializer() and
+  i.getNumberOfElementInitializers() = 2 and
+  i.getElementInitializer(0).getArgument(0) instanceof ObjectCreation and
+  i.getElementInitializer(1).getArgument(0) instanceof ObjectCreation
 select m, e, i
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall1.ql b/csharp/ql/test/library-tests/expressions/OperatorCall1.ql
index 3461efe76295..db59ee1b7ed4 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall1.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall1.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, OperatorCall e, AddOperator o
-where m.hasName("MainUnaryOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = o
-  and e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1")
-  and e.getArgument(1).(LocalVariableAccess).getTarget().hasName("iv2")
-  and e.getNumberOfArguments() = 2
+where
+  m.hasName("MainUnaryOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = o and
+  e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1") and
+  e.getArgument(1).(LocalVariableAccess).getTarget().hasName("iv2") and
+  e.getNumberOfArguments() = 2
 select m, e, o
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall2.ql b/csharp/ql/test/library-tests/expressions/OperatorCall2.ql
index 57e3c260433a..235f9d692e59 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall2.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, OperatorCall e, ExplicitConversionOperator o
-where m.hasName("MainConversionOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = o
-  and e.getArgument(0).getValue() = "8"
+where
+  m.hasName("MainConversionOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = o and
+  e.getArgument(0).getValue() = "8"
 select m, e, o
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall3.ql b/csharp/ql/test/library-tests/expressions/OperatorCall3.ql
index 9e76cbd27dcd..172e7501909e 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall3.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall3.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, OperatorCall e, ImplicitConversionOperator o
-where m.hasName("MainConversionOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = o
-  and e.getArgument(0).getType().(Struct).hasName("Digit")
-  and e.getArgument(0).(LocalVariableAccess).getTarget().hasName("d")
-  and e.getNumberOfArguments() = 1
+where
+  m.hasName("MainConversionOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = o and
+  e.getArgument(0).getType().(Struct).hasName("Digit") and
+  e.getArgument(0).(LocalVariableAccess).getTarget().hasName("d") and
+  e.getNumberOfArguments() = 1
 select m, e, o
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall4.ql b/csharp/ql/test/library-tests/expressions/OperatorCall4.ql
index 1fdf58655b0e..3fc215f5c21a 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall4.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall4.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, MutatorOperatorCall e, IncrementOperator o
-where m.hasName("MainUnaryOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = o
-  and e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1")
-  and e.getNumberOfArguments() = 1
-  and e.isPostfix()
+where
+  m.hasName("MainUnaryOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = o and
+  e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1") and
+  e.getNumberOfArguments() = 1 and
+  e.isPostfix()
 select m, e, o
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall5.ql b/csharp/ql/test/library-tests/expressions/OperatorCall5.ql
index 6caae7d40997..68ee738019f5 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall5.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall5.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, MutatorOperatorCall e, IncrementOperator o
-where m.hasName("MainUnaryOperator")
-  and e.getEnclosingCallable() = m
-  and e.getTarget() = o
-  and e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1")
-  and e.getNumberOfArguments() = 1
-  and e.isPrefix()
+where
+  m.hasName("MainUnaryOperator") and
+  e.getEnclosingCallable() = m and
+  e.getTarget() = o and
+  e.getArgument(0).(LocalVariableAccess).getTarget().hasName("iv1") and
+  e.getNumberOfArguments() = 1 and
+  e.isPrefix()
 select m, e, o
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall6.ql b/csharp/ql/test/library-tests/expressions/OperatorCall6.ql
index f06fb0cc8ca4..d796d852c171 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall6.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall6.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, OperatorCall e, Callable t
-where m.hasName("addition")
-  and e.getEnclosingCallable() = m
-  and t = e.getTarget()
-  and t.getName() = "+"
-  and t.getDeclaringType().hasQualifiedName("Expressions.OperatorCalls", "Num")
+where
+  m.hasName("addition") and
+  e.getEnclosingCallable() = m and
+  t = e.getTarget() and
+  t.getName() = "+" and
+  t.getDeclaringType().hasQualifiedName("Expressions.OperatorCalls", "Num")
 select m, e.getAnArgument(), t
-
diff --git a/csharp/ql/test/library-tests/expressions/OperatorCall7.ql b/csharp/ql/test/library-tests/expressions/OperatorCall7.ql
index ebb509f69153..7c885f43af7c 100644
--- a/csharp/ql/test/library-tests/expressions/OperatorCall7.ql
+++ b/csharp/ql/test/library-tests/expressions/OperatorCall7.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for user-defined operator "calls"
  */
+
 import csharp
 
 from Method m, OperatorCall e, AddOperator t
-where m.hasName("delegateCombine")
-  and e.getEnclosingCallable() = m
-  and t = e.getTarget()
+where
+  m.hasName("delegateCombine") and
+  e.getEnclosingCallable() = m and
+  t = e.getTarget()
 select m, m.getDeclaringType(), e.getAnArgument(), t.getDeclaringType()
-
diff --git a/csharp/ql/test/library-tests/expressions/ParameterAccess1.ql b/csharp/ql/test/library-tests/expressions/ParameterAccess1.ql
index 64953cab22b9..4d0c453f43e7 100644
--- a/csharp/ql/test/library-tests/expressions/ParameterAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/ParameterAccess1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for parameter access
  */
+
 import csharp
 
 from Method m, ParameterAccess e
-where m.hasName("Bar")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "s"
-  and e.getEnclosingStmt() instanceof ReturnStmt
+where
+  m.hasName("Bar") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "s" and
+  e.getEnclosingStmt() instanceof ReturnStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ParameterAccess2.ql b/csharp/ql/test/library-tests/expressions/ParameterAccess2.ql
index 5b9d514df2b1..e6ded21696d2 100644
--- a/csharp/ql/test/library-tests/expressions/ParameterAccess2.ql
+++ b/csharp/ql/test/library-tests/expressions/ParameterAccess2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for parameter access
  */
+
 import csharp
 
 from Method m, ParameterAccess e
-where m.hasName("Bar")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "x"
-  and e.getEnclosingStmt() instanceof ReturnStmt
+where
+  m.hasName("Bar") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "x" and
+  e.getEnclosingStmt() instanceof ReturnStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ParameterAccess3.ql b/csharp/ql/test/library-tests/expressions/ParameterAccess3.ql
index ec5e8f1e4140..8a0463f51fd9 100644
--- a/csharp/ql/test/library-tests/expressions/ParameterAccess3.ql
+++ b/csharp/ql/test/library-tests/expressions/ParameterAccess3.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for parameter access
  */
+
 import csharp
 
 from Property p, ParameterAccess e
-where p.hasName("Name")
-  and e.getEnclosingCallable() = p.getSetter()
-  and e.getTarget().getName() = "value"
-  and e.getEnclosingStmt().(ExprStmt).getExpr() instanceof AssignExpr
-  and e.getTarget().getDeclaringElement() = p.getSetter()
+where
+  p.hasName("Name") and
+  e.getEnclosingCallable() = p.getSetter() and
+  e.getTarget().getName() = "value" and
+  e.getEnclosingStmt().(ExprStmt).getExpr() instanceof AssignExpr and
+  e.getTarget().getDeclaringElement() = p.getSetter()
 select p, e
diff --git a/csharp/ql/test/library-tests/expressions/PropertyAccess1.ql b/csharp/ql/test/library-tests/expressions/PropertyAccess1.ql
index 563834298120..093a9878e2dd 100644
--- a/csharp/ql/test/library-tests/expressions/PropertyAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/PropertyAccess1.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for property access
  */
+
 import csharp
 
 from Method m, PropertyAccess e
-where m.hasName("Bar")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Length"
-  and e.getTarget().getDeclaringType() instanceof StringType
-  and e.getQualifier().(ParameterAccess).getTarget().getName() = "s"
-  and e.getEnclosingStmt() instanceof ReturnStmt
+where
+  m.hasName("Bar") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Length" and
+  e.getTarget().getDeclaringType() instanceof StringType and
+  e.getQualifier().(ParameterAccess).getTarget().getName() = "s" and
+  e.getEnclosingStmt() instanceof ReturnStmt
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/PropertyAccess2.ql b/csharp/ql/test/library-tests/expressions/PropertyAccess2.ql
index 9831937fb537..5f7a076c2f7e 100644
--- a/csharp/ql/test/library-tests/expressions/PropertyAccess2.ql
+++ b/csharp/ql/test/library-tests/expressions/PropertyAccess2.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for property access
  */
+
 import csharp
 
 from Method m, PropertyAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Name"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-  and e.getQualifier().(ParameterAccess).getTarget().getName() = "other"
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Name" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  e.getQualifier().(ParameterAccess).getTarget().getName() = "other"
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/PropertyAccess3.ql b/csharp/ql/test/library-tests/expressions/PropertyAccess3.ql
index 943e697b210f..feceaa07ec7a 100644
--- a/csharp/ql/test/library-tests/expressions/PropertyAccess3.ql
+++ b/csharp/ql/test/library-tests/expressions/PropertyAccess3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for property access
  */
+
 import csharp
 
 from Method m, PropertyAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Name"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-  and e.getQualifier().isImplicit()
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Name" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  e.getQualifier().isImplicit()
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/PropertyAccess4.ql b/csharp/ql/test/library-tests/expressions/PropertyAccess4.ql
index 778b04aac4c3..df39886dd224 100644
--- a/csharp/ql/test/library-tests/expressions/PropertyAccess4.ql
+++ b/csharp/ql/test/library-tests/expressions/PropertyAccess4.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for property access
  */
+
 import csharp
 
 from Method m, PropertyAccess e
-where m.hasName("MainAccesses")
-  and e.getEnclosingCallable() = m
-  and e.getTarget().getName() = "Name"
-  and e.getTarget().getDeclaringType() = m.getDeclaringType()
-  and e.getQualifier() instanceof ThisAccess
+where
+  m.hasName("MainAccesses") and
+  e.getEnclosingCallable() = m and
+  e.getTarget().getName() = "Name" and
+  e.getTarget().getDeclaringType() = m.getDeclaringType() and
+  e.getQualifier() instanceof ThisAccess
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql b/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
index 6d7cdc1cbe98..95b223ed6f4d 100644
--- a/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
+++ b/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for add event handlers
  */
+
 import csharp
 
 from Constructor c, RemoveEventExpr e
-where c.hasName("LoginDialog")
-  and e.getEnclosingCallable() = c
-  and e.getTarget().hasName("Click")
-  and e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("CancelButton")
+where
+  c.hasName("LoginDialog") and
+  e.getEnclosingCallable() = c and
+  e.getTarget().hasName("Click") and
+  e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("CancelButton")
 select c, e
-
diff --git a/csharp/ql/test/library-tests/expressions/ThisAccess1.ql b/csharp/ql/test/library-tests/expressions/ThisAccess1.ql
index cfa21b76589e..0d4ecf6a5959 100644
--- a/csharp/ql/test/library-tests/expressions/ThisAccess1.ql
+++ b/csharp/ql/test/library-tests/expressions/ThisAccess1.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for this access
  */
+
 import csharp
 
 from Method m, ThisAccess e
-where m.hasName("OtherAccesses")
-  and e.getEnclosingCallable() = m
+where
+  m.hasName("OtherAccesses") and
+  e.getEnclosingCallable() = m
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Typeof1.ql b/csharp/ql/test/library-tests/expressions/Typeof1.ql
index 984d31ff8e1c..a0a5b1f4f81e 100644
--- a/csharp/ql/test/library-tests/expressions/Typeof1.ql
+++ b/csharp/ql/test/library-tests/expressions/Typeof1.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for typeof expressions
  */
+
 import csharp
 
 from Method m, TypeofExpr e
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getTypeAccess().getTarget() instanceof VoidType
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getTypeAccess().getTarget() instanceof VoidType
 select m, e
-
diff --git a/csharp/ql/test/library-tests/expressions/Typeof2.ql b/csharp/ql/test/library-tests/expressions/Typeof2.ql
index 8a971857fa4a..49b021568917 100644
--- a/csharp/ql/test/library-tests/expressions/Typeof2.ql
+++ b/csharp/ql/test/library-tests/expressions/Typeof2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for typeof expressions
  */
+
 import csharp
 
 from Method m, TypeofExpr e
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getTypeAccess().getTarget() instanceof IntType
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getTypeAccess().getTarget() instanceof IntType
 select m, e.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/expressions/Typeof3.ql b/csharp/ql/test/library-tests/expressions/Typeof3.ql
index 200fad3c0367..3a80c553eba6 100644
--- a/csharp/ql/test/library-tests/expressions/Typeof3.ql
+++ b/csharp/ql/test/library-tests/expressions/Typeof3.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for typeof expressions
  */
+
 import csharp
 
 from Method m, TypeofExpr e
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getTypeAccess().getTarget() instanceof TypeParameter
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getTypeAccess().getTarget() instanceof TypeParameter
 select m, e.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/expressions/Typeof4.ql b/csharp/ql/test/library-tests/expressions/Typeof4.ql
index 06a8bc3cd678..730c305cd96d 100644
--- a/csharp/ql/test/library-tests/expressions/Typeof4.ql
+++ b/csharp/ql/test/library-tests/expressions/Typeof4.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for typeof expressions
  */
+
 import csharp
 
 from Method m, TypeofExpr e
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getTypeAccess().getTarget().hasName("X<X<>>")
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getTypeAccess().getTarget().hasName("X<X<>>")
 select m, e.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/expressions/Typeof5.ql b/csharp/ql/test/library-tests/expressions/Typeof5.ql
index c2f5b30b3bb2..8fd5fb0ffc6e 100644
--- a/csharp/ql/test/library-tests/expressions/Typeof5.ql
+++ b/csharp/ql/test/library-tests/expressions/Typeof5.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for typeof expressions
  */
+
 import csharp
 
 from Method m, TypeofExpr e
-where m.hasName("PrintTypes")
-  and e.getEnclosingCallable() = m
-  and e.getTypeAccess().getTarget().hasName("Y<,>")
+where
+  m.hasName("PrintTypes") and
+  e.getEnclosingCallable() = m and
+  e.getTypeAccess().getTarget().hasName("Y<,>")
 select m, e.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/exprorstmtparent/Property.ql b/csharp/ql/test/library-tests/exprorstmtparent/Property.ql
index 37878da888a3..ac44ebfdfddf 100644
--- a/csharp/ql/test/library-tests/exprorstmtparent/Property.ql
+++ b/csharp/ql/test/library-tests/exprorstmtparent/Property.ql
@@ -1,6 +1,8 @@
 import csharp
 
 from Property p, Expr e, string s
-where e = p.getExpressionBody() and s = "body"
-   or e = p.getInitializer() and s = "initializer"
+where
+  e = p.getExpressionBody() and s = "body"
+  or
+  e = p.getInitializer() and s = "initializer"
 select p, e, s
diff --git a/csharp/ql/test/library-tests/fields/Constants1.ql b/csharp/ql/test/library-tests/fields/Constants1.ql
index 7b0486d6a4fc..587a38b57313 100644
--- a/csharp/ql/test/library-tests/fields/Constants1.ql
+++ b/csharp/ql/test/library-tests/fields/Constants1.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for constants
  */
+
 import csharp
 
 from MemberConstant c
-where c.getName() = "X"
-  and c.getDeclaringType().hasQualifiedName("Constants.A")
-  and c.getType() instanceof IntType
-  and c.getInitializer() instanceof BinaryOperation
-  and c.isPublic()
-  and c.getValue() = "12"
+where
+  c.getName() = "X" and
+  c.getDeclaringType().hasQualifiedName("Constants.A") and
+  c.getType() instanceof IntType and
+  c.getInitializer() instanceof BinaryOperation and
+  c.isPublic() and
+  c.getValue() = "12"
 select c, c.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Constants2.ql b/csharp/ql/test/library-tests/fields/Constants2.ql
index 7dbe5f6b460c..908c1f7c5c90 100644
--- a/csharp/ql/test/library-tests/fields/Constants2.ql
+++ b/csharp/ql/test/library-tests/fields/Constants2.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for constants
  */
+
 import csharp
 
 from MemberConstant c
-where c.getName() = "Y"
-  and c.getDeclaringType().hasQualifiedName("Constants.A")
-  and c.getType() instanceof IntType
-  and c.getInitializer() instanceof IntLiteral
-  and c.isPublic()
-  and c.getValue() = "10"
+where
+  c.getName() = "Y" and
+  c.getDeclaringType().hasQualifiedName("Constants.A") and
+  c.getType() instanceof IntType and
+  c.getInitializer() instanceof IntLiteral and
+  c.isPublic() and
+  c.getValue() = "10"
 select c, c.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Constants3.ql b/csharp/ql/test/library-tests/fields/Constants3.ql
index f9e20557726a..e2bb2d9e34a1 100644
--- a/csharp/ql/test/library-tests/fields/Constants3.ql
+++ b/csharp/ql/test/library-tests/fields/Constants3.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for constants
  */
+
 import csharp
 
 from MemberConstant c
-where c.getName() = "Z"
-  and c.getDeclaringType().hasQualifiedName("Constants.B")
-  and c.getType() instanceof IntType
-  and c.getInitializer() instanceof BinaryOperation
-  and c.isPublic()
-  and c.getValue() = "11"
+where
+  c.getName() = "Z" and
+  c.getDeclaringType().hasQualifiedName("Constants.B") and
+  c.getType() instanceof IntType and
+  c.getInitializer() instanceof BinaryOperation and
+  c.isPublic() and
+  c.getValue() = "11"
 select c, c.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Constants4.ql b/csharp/ql/test/library-tests/fields/Constants4.ql
index c53981420210..6820548d825b 100644
--- a/csharp/ql/test/library-tests/fields/Constants4.ql
+++ b/csharp/ql/test/library-tests/fields/Constants4.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for constants
  */
+
 import csharp
 
 where forall(MemberConstant c | exists(c.getValue()))
diff --git a/csharp/ql/test/library-tests/fields/Constants5.ql b/csharp/ql/test/library-tests/fields/Constants5.ql
index f64c408457fc..0649edac835b 100644
--- a/csharp/ql/test/library-tests/fields/Constants5.ql
+++ b/csharp/ql/test/library-tests/fields/Constants5.ql
@@ -1,6 +1,7 @@
 /**
  * @name Count of accesses to constant
  */
+
 import csharp
 
 from MemberConstant c
diff --git a/csharp/ql/test/library-tests/fields/Fields1.ql b/csharp/ql/test/library-tests/fields/Fields1.ql
index 736fe716e714..7e7c5dfbc950 100644
--- a/csharp/ql/test/library-tests/fields/Fields1.ql
+++ b/csharp/ql/test/library-tests/fields/Fields1.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "X"
-  and f.getDeclaringType().hasQualifiedName("Fields.A")
-  and f.getType() instanceof IntType
-  and f.getInitializer().(IntLiteral).getValue() = "1"
-  and f.isPublic() and f.isStatic()
+where
+  f.getName() = "X" and
+  f.getDeclaringType().hasQualifiedName("Fields.A") and
+  f.getType() instanceof IntType and
+  f.getInitializer().(IntLiteral).getValue() = "1" and
+  f.isPublic() and
+  f.isStatic()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields10.ql b/csharp/ql/test/library-tests/fields/Fields10.ql
index 00d92e8886e2..fa17e74d69b5 100644
--- a/csharp/ql/test/library-tests/fields/Fields10.ql
+++ b/csharp/ql/test/library-tests/fields/Fields10.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f, SimpleType t
-where f.getName() = "MaxValue"
-  and f.getDeclaringType() = t
-  and t.hasQualifiedName("System.Decimal")
-  and f.isPublic()
+where
+  f.getName() = "MaxValue" and
+  f.getDeclaringType() = t and
+  t.hasQualifiedName("System.Decimal") and
+  f.isPublic()
 select f.toString(), f.getDeclaringType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields2.ql b/csharp/ql/test/library-tests/fields/Fields2.ql
index f0fb97560452..9a970e1eed96 100644
--- a/csharp/ql/test/library-tests/fields/Fields2.ql
+++ b/csharp/ql/test/library-tests/fields/Fields2.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "Y"
-  and f.getDeclaringType().hasQualifiedName("Fields.A")
-  and f.getType() instanceof IntType
-  and not exists(f.getInitializer())
-  and f.isPublic() and f.isStatic()
+where
+  f.getName() = "Y" and
+  f.getDeclaringType().hasQualifiedName("Fields.A") and
+  f.getType() instanceof IntType and
+  not exists(f.getInitializer()) and
+  f.isPublic() and
+  f.isStatic()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields3.ql b/csharp/ql/test/library-tests/fields/Fields3.ql
index f36fd52c2aad..a6a4fade7428 100644
--- a/csharp/ql/test/library-tests/fields/Fields3.ql
+++ b/csharp/ql/test/library-tests/fields/Fields3.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "Z"
-  and f.getDeclaringType().hasQualifiedName("Fields.A")
-  and f.getType() instanceof IntType
-  and f.getInitializer().(IntLiteral).getValue() = "100"
-  and f.isPublic() and f.isStatic()
+where
+  f.getName() = "Z" and
+  f.getDeclaringType().hasQualifiedName("Fields.A") and
+  f.getType() instanceof IntType and
+  f.getInitializer().(IntLiteral).getValue() = "100" and
+  f.isPublic() and
+  f.isStatic()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields4.ql b/csharp/ql/test/library-tests/fields/Fields4.ql
index 532f2c672be8..f6c01e4e3225 100644
--- a/csharp/ql/test/library-tests/fields/Fields4.ql
+++ b/csharp/ql/test/library-tests/fields/Fields4.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "X"
-  and f.getDeclaringType().hasQualifiedName("Fields.B")
-  and f.getType() instanceof IntType
-  and f.getInitializer().(IntLiteral).getValue() = "1"
-  and f.isPublic() and f.isStatic()
+where
+  f.getName() = "X" and
+  f.getDeclaringType().hasQualifiedName("Fields.B") and
+  f.getType() instanceof IntType and
+  f.getInitializer().(IntLiteral).getValue() = "1" and
+  f.isPublic() and
+  f.isStatic()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields5.ql b/csharp/ql/test/library-tests/fields/Fields5.ql
index 82afb6be0b87..eeaf4996e0c2 100644
--- a/csharp/ql/test/library-tests/fields/Fields5.ql
+++ b/csharp/ql/test/library-tests/fields/Fields5.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "Y"
-  and f.getDeclaringType().hasQualifiedName("Fields.B")
-  and f.getType() instanceof IntType
-  and not exists(f.getInitializer())
-  and f.isPublic() and f.isStatic()
+where
+  f.getName() = "Y" and
+  f.getDeclaringType().hasQualifiedName("Fields.B") and
+  f.getType() instanceof IntType and
+  not exists(f.getInitializer()) and
+  f.isPublic() and
+  f.isStatic()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields6.ql b/csharp/ql/test/library-tests/fields/Fields6.ql
index 66f7bd696570..8706c8292058 100644
--- a/csharp/ql/test/library-tests/fields/Fields6.ql
+++ b/csharp/ql/test/library-tests/fields/Fields6.ql
@@ -1,13 +1,16 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f
-where f.getName() = "finished"
-  and f.getDeclaringType().hasQualifiedName("Fields.Application")
-  and f.getType() instanceof BoolType
-  and not exists(f.getInitializer())
-  and f.isPublic() and f.isStatic() and f.isVolatile()
+where
+  f.getName() = "finished" and
+  f.getDeclaringType().hasQualifiedName("Fields.Application") and
+  f.getType() instanceof BoolType and
+  not exists(f.getInitializer()) and
+  f.isPublic() and
+  f.isStatic() and
+  f.isVolatile()
 select f, f.getType().toString()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields7.ql b/csharp/ql/test/library-tests/fields/Fields7.ql
index f190c4e5f985..5097de7923f7 100644
--- a/csharp/ql/test/library-tests/fields/Fields7.ql
+++ b/csharp/ql/test/library-tests/fields/Fields7.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f, UnboundGenericClass c
-where f.getName() = "count"
-  and f.getDeclaringType() = c
-  and c.hasQualifiedName("Fields.C<>")
-  and f.getType() instanceof IntType
-  and f.isStatic()
+where
+  f.getName() = "count" and
+  f.getDeclaringType() = c and
+  c.hasQualifiedName("Fields.C<>") and
+  f.getType() instanceof IntType and
+  f.isStatic()
 select f, f.getDeclaringType()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields8.ql b/csharp/ql/test/library-tests/fields/Fields8.ql
index f190c4e5f985..5097de7923f7 100644
--- a/csharp/ql/test/library-tests/fields/Fields8.ql
+++ b/csharp/ql/test/library-tests/fields/Fields8.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f, UnboundGenericClass c
-where f.getName() = "count"
-  and f.getDeclaringType() = c
-  and c.hasQualifiedName("Fields.C<>")
-  and f.getType() instanceof IntType
-  and f.isStatic()
+where
+  f.getName() = "count" and
+  f.getDeclaringType() = c and
+  c.hasQualifiedName("Fields.C<>") and
+  f.getType() instanceof IntType and
+  f.isStatic()
 select f, f.getDeclaringType()
-
diff --git a/csharp/ql/test/library-tests/fields/Fields9.ql b/csharp/ql/test/library-tests/fields/Fields9.ql
index b5f5139d1b66..24a601da86a9 100644
--- a/csharp/ql/test/library-tests/fields/Fields9.ql
+++ b/csharp/ql/test/library-tests/fields/Fields9.ql
@@ -1,13 +1,16 @@
 /**
  * @name Test for fields
  */
+
 import csharp
 
 from Field f, Class c
-where f.getName() = "Black"
-  and f.getDeclaringType() = c
-  and c.hasQualifiedName("Fields.Color")
-  and f.getType() = c
-  and f.isStatic() and f.isPublic() and f.isReadOnly()
+where
+  f.getName() = "Black" and
+  f.getDeclaringType() = c and
+  c.hasQualifiedName("Fields.Color") and
+  f.getType() = c and
+  f.isStatic() and
+  f.isPublic() and
+  f.isReadOnly()
 select f, f.getDeclaringType()
-
diff --git a/csharp/ql/test/library-tests/folding/Folding1.ql b/csharp/ql/test/library-tests/folding/Folding1.ql
index 302ed3f919bd..0f2fba9fb3bd 100644
--- a/csharp/ql/test/library-tests/folding/Folding1.ql
+++ b/csharp/ql/test/library-tests/folding/Folding1.ql
@@ -2,6 +2,7 @@
  * @name Test that the results of constant folding are recorded, but that the
  *       original AST is populated.
  */
+
 import csharp
 
 string lost(LocalVariable v) {
@@ -25,7 +26,8 @@ string correct(LocalVariable v) {
 }
 
 from LocalVariable v, string msg
-where msg = lost(v)
-   or msg = noValue(v)
-   or msg = correct(v)
+where
+  msg = lost(v) or
+  msg = noValue(v) or
+  msg = correct(v)
 select v, msg
diff --git a/csharp/ql/test/library-tests/frameworks/sql/Sql1.ql b/csharp/ql/test/library-tests/frameworks/sql/Sql1.ql
index 3c9688b04a9b..d81208b26a03 100644
--- a/csharp/ql/test/library-tests/frameworks/sql/Sql1.ql
+++ b/csharp/ql/test/library-tests/frameworks/sql/Sql1.ql
@@ -1,3 +1,4 @@
 import semmle.code.csharp.frameworks.Sql
 
-from SqlExpr se select se, se.getSql()
+from SqlExpr se
+select se, se.getSql()
diff --git a/csharp/ql/test/library-tests/frameworks/system/Dispose/Dispose.ql b/csharp/ql/test/library-tests/frameworks/system/Dispose/Dispose.ql
index 116cee2942e2..9b13e5b60459 100644
--- a/csharp/ql/test/library-tests/frameworks/system/Dispose/Dispose.ql
+++ b/csharp/ql/test/library-tests/frameworks/system/Dispose/Dispose.ql
@@ -2,6 +2,8 @@ import csharp
 import semmle.code.csharp.frameworks.System
 
 from ValueOrRefType t, Method m, boolean b
-where t.fromSource() and m = getInvokedDisposeMethod(t)
-  and if implementsDispose(t) then b = true else b = false
+where
+  t.fromSource() and
+  m = getInvokedDisposeMethod(t) and
+  if implementsDispose(t) then b = true else b = false
 select t, m.getQualifiedNameWithTypes(), b
diff --git a/csharp/ql/test/library-tests/frameworks/system/Equals/Equals.ql b/csharp/ql/test/library-tests/frameworks/system/Equals/Equals.ql
index 29eb54ee710d..921d3a5616c8 100644
--- a/csharp/ql/test/library-tests/frameworks/system/Equals/Equals.ql
+++ b/csharp/ql/test/library-tests/frameworks/system/Equals/Equals.ql
@@ -2,6 +2,8 @@ import csharp
 import semmle.code.csharp.frameworks.System
 
 from ValueOrRefType t, Method m, boolean b
-where t.fromSource() and m = getInvokedEqualsMethod(t)
-  and if implementsEquals(t) then b = true else b = false
+where
+  t.fromSource() and
+  m = getInvokedEqualsMethod(t) and
+  if implementsEquals(t) then b = true else b = false
 select t, m.getQualifiedNameWithTypes(), b
diff --git a/csharp/ql/test/library-tests/frameworks/system/System/System.ql b/csharp/ql/test/library-tests/frameworks/system/System/System.ql
index a3ecff01f6bb..eb6e4a08a93c 100644
--- a/csharp/ql/test/library-tests/frameworks/system/System/System.ql
+++ b/csharp/ql/test/library-tests/frameworks/system/System/System.ql
@@ -6,7 +6,8 @@ import semmle.code.csharp.frameworks.system.collections.Generic
 predicate implementsMethod(Method m, int i) {
   exists(Method other, Method imp |
     m.overridesOrImplementsOrEquals(imp) and
-    other = imp.getSourceDeclaration() |
+    other = imp.getSourceDeclaration()
+  |
     other = any(SystemObjectClass c).getEqualsMethod() and i = 1
     or
     other = any(SystemObjectClass c).getStaticEqualsMethod() and i = 2
@@ -29,10 +30,8 @@ predicate implementsMethod(Method m, int i) {
 
 from Element e, int i
 where
-  e.getFile().getStem()  = "System"
-  and
-  e.fromSource()
-  and
+  e.getFile().getStem() = "System" and
+  e.fromSource() and
   (
     implementsMethod(e, i)
     or
diff --git a/csharp/ql/test/library-tests/frameworks/test/Test.ql b/csharp/ql/test/library-tests/frameworks/test/Test.ql
index 0bab29a8fcf3..0075ba47b252 100644
--- a/csharp/ql/test/library-tests/frameworks/test/Test.ql
+++ b/csharp/ql/test/library-tests/frameworks/test/Test.ql
@@ -7,17 +7,11 @@ where
     framework = e.(TestClass).getAQlClass() and type = "TestClass"
     or
     framework = e.(TestMethod).getAQlClass() and type = "TestMethod"
-  )
-  and
-  not framework = "NonNestedType"
-  and
-  not framework = "SourceDeclarationType"
-  and
-  not framework = "SourceDeclarationCallable"
-  and
-  not framework = "SourceDeclarationMethod"
-  and
-  not framework = "NonConstructedMethod"
-  and
+  ) and
+  not framework = "NonNestedType" and
+  not framework = "SourceDeclarationType" and
+  not framework = "SourceDeclarationCallable" and
+  not framework = "SourceDeclarationMethod" and
+  not framework = "NonConstructedMethod" and
   not framework = "RuntimeInstanceMethod"
 select e, type, framework
diff --git a/csharp/ql/test/library-tests/generatedcode/generatedcode.ql b/csharp/ql/test/library-tests/generatedcode/generatedcode.ql
index 2a9151f826fc..58a50b941ef6 100644
--- a/csharp/ql/test/library-tests/generatedcode/generatedcode.ql
+++ b/csharp/ql/test/library-tests/generatedcode/generatedcode.ql
@@ -1,4 +1,3 @@
-
 import csharp
 import semmle.code.csharp.commons.GeneratedCode
 
diff --git a/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql b/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
index 4c4ba11af6d5..83f2597f8565 100644
--- a/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
+++ b/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
@@ -5,5 +5,5 @@
 import semmle.code.csharp.commons.ConsistencyChecks
 
 from Element e, string m
-where consistencyFailure(e,m)
+where consistencyFailure(e, m)
 select e, "Element class " + e.getAQlClass() + " has consistency check failed: " + m
diff --git a/csharp/ql/test/library-tests/generics/Generics1.ql b/csharp/ql/test/library-tests/generics/Generics1.ql
index 9de2d6edd1c5..5ca34d502707 100644
--- a/csharp/ql/test/library-tests/generics/Generics1.ql
+++ b/csharp/ql/test/library-tests/generics/Generics1.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from UnboundGenericDelegateType d
-where d.hasName("GenericDelegate<>")
-  and d.getTypeParameter(0).hasName("T")
-  and d.getParameter(0).getType().hasName("T")
+where
+  d.hasName("GenericDelegate<>") and
+  d.getTypeParameter(0).hasName("T") and
+  d.getParameter(0).getType().hasName("T")
 select d
diff --git a/csharp/ql/test/library-tests/generics/Generics10.ql b/csharp/ql/test/library-tests/generics/Generics10.ql
index fd0bc6e2d0cf..c87f61cc6619 100644
--- a/csharp/ql/test/library-tests/generics/Generics10.ql
+++ b/csharp/ql/test/library-tests/generics/Generics10.ql
@@ -1,14 +1,18 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass bString, Event e
-where bString.hasName("B<String>")
-  and e.getDeclaringType() = bString
-  and e.hasName("myEvent")
-  and e.getSourceDeclaration().getDeclaringType() = e.getDeclaringType().getSourceDeclaration()
-  and e.getType().(ConstructedDelegateType).getTypeArgument(0) instanceof StringType
-  and e.getAddEventAccessor().getSourceDeclaration() = e.getSourceDeclaration().getAddEventAccessor()
-  and e.getRemoveEventAccessor().getSourceDeclaration() = e.getSourceDeclaration().getRemoveEventAccessor()
+where
+  bString.hasName("B<String>") and
+  e.getDeclaringType() = bString and
+  e.hasName("myEvent") and
+  e.getSourceDeclaration().getDeclaringType() = e.getDeclaringType().getSourceDeclaration() and
+  e.getType().(ConstructedDelegateType).getTypeArgument(0) instanceof StringType and
+  e.getAddEventAccessor().getSourceDeclaration() = e.getSourceDeclaration().getAddEventAccessor() and
+  e.getRemoveEventAccessor().getSourceDeclaration() = e
+        .getSourceDeclaration()
+        .getRemoveEventAccessor()
 select bString, e
diff --git a/csharp/ql/test/library-tests/generics/Generics11.ql b/csharp/ql/test/library-tests/generics/Generics11.ql
index ba7484fa61cd..18625758c3e5 100644
--- a/csharp/ql/test/library-tests/generics/Generics11.ql
+++ b/csharp/ql/test/library-tests/generics/Generics11.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass bString, Operator o
-where bString.hasName("B<String>")
-  and o.getDeclaringType() = bString
-  and o instanceof IncrementOperator
-  and o.getSourceDeclaration().getDeclaringType() = o.getDeclaringType().getSourceDeclaration()
+where
+  bString.hasName("B<String>") and
+  o.getDeclaringType() = bString and
+  o instanceof IncrementOperator and
+  o.getSourceDeclaration().getDeclaringType() = o.getDeclaringType().getSourceDeclaration()
 select bString, o
diff --git a/csharp/ql/test/library-tests/generics/Generics12.ql b/csharp/ql/test/library-tests/generics/Generics12.ql
index 757e5175b3c6..c54f41c12e2c 100644
--- a/csharp/ql/test/library-tests/generics/Generics12.ql
+++ b/csharp/ql/test/library-tests/generics/Generics12.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass gridInt, Indexer i
-where gridInt.hasName("Grid<Int32>")
-  and i.getDeclaringType() = gridInt
-  and i.getSourceDeclaration().getDeclaringType() = i.getDeclaringType().getSourceDeclaration()
-  and i.getGetter().getSourceDeclaration() = i.getSourceDeclaration().getGetter()
-  and i.getSetter().getSourceDeclaration() = i.getSourceDeclaration().getSetter()
+where
+  gridInt.hasName("Grid<Int32>") and
+  i.getDeclaringType() = gridInt and
+  i.getSourceDeclaration().getDeclaringType() = i.getDeclaringType().getSourceDeclaration() and
+  i.getGetter().getSourceDeclaration() = i.getSourceDeclaration().getGetter() and
+  i.getSetter().getSourceDeclaration() = i.getSourceDeclaration().getSetter()
 select gridInt, i
diff --git a/csharp/ql/test/library-tests/generics/Generics13.ql b/csharp/ql/test/library-tests/generics/Generics13.ql
index 08e5d2965f64..338421c7d849 100644
--- a/csharp/ql/test/library-tests/generics/Generics13.ql
+++ b/csharp/ql/test/library-tests/generics/Generics13.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass gridInt, Indexer i
-where gridInt.hasName("Grid<Int32>")
-  and i.getDeclaringType() = gridInt
-  and i.getType() instanceof IntType
+where
+  gridInt.hasName("Grid<Int32>") and
+  i.getDeclaringType() = gridInt and
+  i.getType() instanceof IntType
 select gridInt, i
diff --git a/csharp/ql/test/library-tests/generics/Generics14.ql b/csharp/ql/test/library-tests/generics/Generics14.ql
index 68a8870dbec7..312e93649c23 100644
--- a/csharp/ql/test/library-tests/generics/Generics14.ql
+++ b/csharp/ql/test/library-tests/generics/Generics14.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from UnboundGenericClass gridInt, Indexer i
-where gridInt.hasName("Grid<>")
-  and i.getDeclaringType() = gridInt
-  and i.getType() instanceof IntType
+where
+  gridInt.hasName("Grid<>") and
+  i.getDeclaringType() = gridInt and
+  i.getType() instanceof IntType
 select gridInt, i
diff --git a/csharp/ql/test/library-tests/generics/Generics15.ql b/csharp/ql/test/library-tests/generics/Generics15.ql
index 3a9dc15ea351..0fbaeaa4caa2 100644
--- a/csharp/ql/test/library-tests/generics/Generics15.ql
+++ b/csharp/ql/test/library-tests/generics/Generics15.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedDelegateType d
-where d.hasName("GenericDelegate<String>")
-  and d.getTypeArgument(0) instanceof StringType
-  and d.getParameter(0).getType() instanceof StringType
+where
+  d.hasName("GenericDelegate<String>") and
+  d.getTypeArgument(0) instanceof StringType and
+  d.getParameter(0).getType() instanceof StringType
 select d
diff --git a/csharp/ql/test/library-tests/generics/Generics16.ql b/csharp/ql/test/library-tests/generics/Generics16.ql
index b99aac00a986..26930274ab80 100644
--- a/csharp/ql/test/library-tests/generics/Generics16.ql
+++ b/csharp/ql/test/library-tests/generics/Generics16.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from Class c
-where c.hasName("Subtle")
-  and count(c.getAMethod()) = 3
+where
+  c.hasName("Subtle") and
+  count(c.getAMethod()) = 3
 select c, c.getAMethod()
diff --git a/csharp/ql/test/library-tests/generics/Generics17.ql b/csharp/ql/test/library-tests/generics/Generics17.ql
index a10eeb40a78a..d09d726b41d7 100644
--- a/csharp/ql/test/library-tests/generics/Generics17.ql
+++ b/csharp/ql/test/library-tests/generics/Generics17.ql
@@ -1,13 +1,16 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from Class c, TypeParameter p, UnboundGenericMethod m, TypeParameter q, UnboundGenericMethod n
-where c.hasName("Subtle")
-  and m = c.getAMethod()
-  and m.getATypeParameter() = p
-  and n = c.getAMethod()
-  and n.getATypeParameter() = q
-  and m != n and p != q
+where
+  c.hasName("Subtle") and
+  m = c.getAMethod() and
+  m.getATypeParameter() = p and
+  n = c.getAMethod() and
+  n.getATypeParameter() = q and
+  m != n and
+  p != q
 select c, m, m.getNumberOfParameters(), p, n, q
diff --git a/csharp/ql/test/library-tests/generics/Generics18.ql b/csharp/ql/test/library-tests/generics/Generics18.ql
index e2b1b8d5a4d0..d024bbfc8c3a 100644
--- a/csharp/ql/test/library-tests/generics/Generics18.ql
+++ b/csharp/ql/test/library-tests/generics/Generics18.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for generic parameter types
  */
+
 import csharp
 
 from Class c, Method m
-where c.getName().matches("A<%")
-  and m = c.getAMethod()
+where
+  c.getName().matches("A<%") and
+  m = c.getAMethod()
 select c, m, m.getAParameter() as p, count(m.(ConstructedMethod).getATypeArgument()),
   p.getType().getName(), count(m.getAParameter()), count(m.getAParameter().getType())
diff --git a/csharp/ql/test/library-tests/generics/Generics19.ql b/csharp/ql/test/library-tests/generics/Generics19.ql
index 03fb2025ca60..f946bc75c0a0 100644
--- a/csharp/ql/test/library-tests/generics/Generics19.ql
+++ b/csharp/ql/test/library-tests/generics/Generics19.ql
@@ -6,10 +6,7 @@ import csharp
 
 from UnboundGenericMethod m, TypeParameter tp, int hasLoc
 where
-  m.hasName("fs")
-  and tp = m.getATypeParameter()
-  and if exists(tp.getLocation()) then
-    hasLoc = 1
-  else
-    hasLoc = 0
+  m.hasName("fs") and
+  tp = m.getATypeParameter() and
+  if exists(tp.getLocation()) then hasLoc = 1 else hasLoc = 0
 select m, tp, hasLoc
diff --git a/csharp/ql/test/library-tests/generics/Generics2.ql b/csharp/ql/test/library-tests/generics/Generics2.ql
index 1b6685dfd795..26f275747c50 100644
--- a/csharp/ql/test/library-tests/generics/Generics2.ql
+++ b/csharp/ql/test/library-tests/generics/Generics2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from Class c
-where c.hasName("A")
-  and not(c instanceof UnboundGenericClass)
+where
+  c.hasName("A") and
+  not (c instanceof UnboundGenericClass)
 select c
diff --git a/csharp/ql/test/library-tests/generics/Generics20.ql b/csharp/ql/test/library-tests/generics/Generics20.ql
index 0eee90b05334..f5da66d4c66c 100644
--- a/csharp/ql/test/library-tests/generics/Generics20.ql
+++ b/csharp/ql/test/library-tests/generics/Generics20.ql
@@ -5,5 +5,5 @@
 import csharp
 
 from UnboundGenericType t
-where type_location(t,_)
+where type_location(t, _)
 select 1
diff --git a/csharp/ql/test/library-tests/generics/Generics21.ql b/csharp/ql/test/library-tests/generics/Generics21.ql
index 4eb3ae3d452a..f3273b0384fd 100644
--- a/csharp/ql/test/library-tests/generics/Generics21.ql
+++ b/csharp/ql/test/library-tests/generics/Generics21.ql
@@ -1,15 +1,17 @@
 import csharp
 
-/*  This tests a regression in the extractor where the following failed to extract:
-
-    class Foo<T>
-    {
-        enum E { a };
-    }
-*/
+/*
+ *  This tests a regression in the extractor where the following failed to extract:
+ *
+ *    class Foo<T>
+ *    {
+ *        enum E { a };
+ *    }
+ */
 
 from Enum e, Class c
-where c.hasName("Param<>")
-and e.hasName("E")
-and e.getDeclaringType()=c
+where
+  c.hasName("Param<>") and
+  e.hasName("E") and
+  e.getDeclaringType() = c
 select c, e
diff --git a/csharp/ql/test/library-tests/generics/Generics22.ql b/csharp/ql/test/library-tests/generics/Generics22.ql
index 601434b91023..313317b7c3cb 100644
--- a/csharp/ql/test/library-tests/generics/Generics22.ql
+++ b/csharp/ql/test/library-tests/generics/Generics22.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from ConstructedMethod m, ValueOrRefType tp
-where m.getName().matches("CM%")
-and tp=m.getATypeArgument()
+where
+  m.getName().matches("CM%") and
+  tp = m.getATypeArgument()
 select m, tp.getName()
diff --git a/csharp/ql/test/library-tests/generics/Generics23.ql b/csharp/ql/test/library-tests/generics/Generics23.ql
index b1884ef8d96e..2fde708af4d8 100644
--- a/csharp/ql/test/library-tests/generics/Generics23.ql
+++ b/csharp/ql/test/library-tests/generics/Generics23.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Class c, Interface i
-where c.getName().matches("Inheritance%")
-and i=c.getABaseInterface()
+where
+  c.getName().matches("Inheritance%") and
+  i = c.getABaseInterface()
 select c, i
diff --git a/csharp/ql/test/library-tests/generics/Generics24.ql b/csharp/ql/test/library-tests/generics/Generics24.ql
index 88d3703494b3..33ca571722b6 100644
--- a/csharp/ql/test/library-tests/generics/Generics24.ql
+++ b/csharp/ql/test/library-tests/generics/Generics24.ql
@@ -2,10 +2,8 @@ import csharp
 
 from UnboundGenericInterface ugi, TypeParameter tp, string s
 where
-  ugi.fromSource()
-  and
-  ugi.getATypeParameter() = tp
-  and
+  ugi.fromSource() and
+  ugi.getATypeParameter() = tp and
   (
     tp.isOut() and s = "out"
     or
diff --git a/csharp/ql/test/library-tests/generics/Generics25.ql b/csharp/ql/test/library-tests/generics/Generics25.ql
index a5af592eb313..46743cdf4670 100644
--- a/csharp/ql/test/library-tests/generics/Generics25.ql
+++ b/csharp/ql/test/library-tests/generics/Generics25.ql
@@ -2,31 +2,20 @@ import csharp
 
 from ConstructedMethod cm
 where
-  cm.hasName("CM3")
-  and
-  cm.getParameter(0).getType() instanceof DoubleType
-  and
-  cm.getParameter(1).getType() instanceof IntType
-  and
-  cm.getReturnType() instanceof DoubleType
-  and
+  cm.hasName("CM3") and
+  cm.getParameter(0).getType() instanceof DoubleType and
+  cm.getParameter(1).getType() instanceof IntType and
+  cm.getReturnType() instanceof DoubleType and
   exists(Method sourceDeclaration |
-    sourceDeclaration = cm.getSourceDeclaration()
-    and
-    sourceDeclaration.getParameter(0).getType().(TypeParameter).hasName("T2")
-    and
-    sourceDeclaration.getParameter(1).getType().(TypeParameter).hasName("T1")
-    and
+    sourceDeclaration = cm.getSourceDeclaration() and
+    sourceDeclaration.getParameter(0).getType().(TypeParameter).hasName("T2") and
+    sourceDeclaration.getParameter(1).getType().(TypeParameter).hasName("T1") and
     sourceDeclaration.getReturnType().(TypeParameter).hasName("T2")
-  )
-  and
+  ) and
   exists(Method unbound |
-    unbound = cm.getUnboundGeneric()
-    and
-    unbound.getParameter(0).getType().(TypeParameter).hasName("T2")
-    and
-    unbound.getParameter(1).getType() instanceof IntType
-    and
+    unbound = cm.getUnboundGeneric() and
+    unbound.getParameter(0).getType().(TypeParameter).hasName("T2") and
+    unbound.getParameter(1).getType() instanceof IntType and
     unbound.getReturnType().(TypeParameter).hasName("T2")
   )
 select cm
diff --git a/csharp/ql/test/library-tests/generics/Generics26.ql b/csharp/ql/test/library-tests/generics/Generics26.ql
index 136f940c243f..bb1ae00efaca 100644
--- a/csharp/ql/test/library-tests/generics/Generics26.ql
+++ b/csharp/ql/test/library-tests/generics/Generics26.ql
@@ -1,8 +1,9 @@
 import csharp
 
 // Source declaration and unbound generic must be unique
-where not exists(ConstructedGeneric cg |
-  strictcount(cg.getSourceDeclaration+()) > 1 or
-  strictcount(cg.getUnboundGeneric()) > 1
-)
+where
+  not exists(ConstructedGeneric cg |
+    strictcount(cg.getSourceDeclaration+()) > 1 or
+    strictcount(cg.getUnboundGeneric()) > 1
+  )
 select "Test passed"
diff --git a/csharp/ql/test/library-tests/generics/Generics27.ql b/csharp/ql/test/library-tests/generics/Generics27.ql
index 7cd35980f0b4..c07497a2aabf 100644
--- a/csharp/ql/test/library-tests/generics/Generics27.ql
+++ b/csharp/ql/test/library-tests/generics/Generics27.ql
@@ -1,8 +1,9 @@
 import csharp
 
 from ConstructedType ct, UnboundGenericType ugt, UnboundGenericType sourceDecl
-where ct instanceof NestedType
-  and ugt = ct.getUnboundGeneric()
-  and sourceDecl = ct.getSourceDeclaration()
-  and ugt != sourceDecl
+where
+  ct instanceof NestedType and
+  ugt = ct.getUnboundGeneric() and
+  sourceDecl = ct.getSourceDeclaration() and
+  ugt != sourceDecl
 select ct, ugt, sourceDecl
diff --git a/csharp/ql/test/library-tests/generics/Generics3.ql b/csharp/ql/test/library-tests/generics/Generics3.ql
index 426ec82d9d65..2b9da24a8e6f 100644
--- a/csharp/ql/test/library-tests/generics/Generics3.ql
+++ b/csharp/ql/test/library-tests/generics/Generics3.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass c, UnboundGenericClass d
-where c.hasName("A<X>")
-  and d.hasName("A<>")
-  and c.getTypeArgument(0).hasName("X")
-  and c.getTypeArgument(0) instanceof TypeParameter
-  and c.getUnboundGeneric() = d
+where
+  c.hasName("A<X>") and
+  d.hasName("A<>") and
+  c.getTypeArgument(0).hasName("X") and
+  c.getTypeArgument(0) instanceof TypeParameter and
+  c.getUnboundGeneric() = d
 select c, d
diff --git a/csharp/ql/test/library-tests/generics/Generics4.ql b/csharp/ql/test/library-tests/generics/Generics4.ql
index d48bd0049186..fb627b8ef956 100644
--- a/csharp/ql/test/library-tests/generics/Generics4.ql
+++ b/csharp/ql/test/library-tests/generics/Generics4.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 where forex(UnboundGenericClass c | c.fromSource() | c.getName().matches("%<%>"))
diff --git a/csharp/ql/test/library-tests/generics/Generics5.ql b/csharp/ql/test/library-tests/generics/Generics5.ql
index db7309e36f51..c694ecb576c3 100644
--- a/csharp/ql/test/library-tests/generics/Generics5.ql
+++ b/csharp/ql/test/library-tests/generics/Generics5.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 where forex(ConstructedClass c | c.getName().matches("%<%>"))
diff --git a/csharp/ql/test/library-tests/generics/Generics6.ql b/csharp/ql/test/library-tests/generics/Generics6.ql
index e3388a3424f4..c3a3ab4786dc 100644
--- a/csharp/ql/test/library-tests/generics/Generics6.ql
+++ b/csharp/ql/test/library-tests/generics/Generics6.ql
@@ -1,16 +1,18 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass at, UnboundGenericClass b, ConstructedClass bt, Field f
-where at.hasName("A<T>")
-  and b.hasName("B<>")
-  and bt.hasName("B<X>")
-  and at.getTypeArgument(0).hasName("T")
-  and at.getTypeArgument(0) instanceof TypeParameter
-  and at.getTypeArgument(0) = b.getTypeParameter(0)
-  and bt.getUnboundGeneric() = b
-  and f.getDeclaringType() = b
-  and f.getType() = at
+where
+  at.hasName("A<T>") and
+  b.hasName("B<>") and
+  bt.hasName("B<X>") and
+  at.getTypeArgument(0).hasName("T") and
+  at.getTypeArgument(0) instanceof TypeParameter and
+  at.getTypeArgument(0) = b.getTypeParameter(0) and
+  bt.getUnboundGeneric() = b and
+  f.getDeclaringType() = b and
+  f.getType() = at
 select b, bt, f, at
diff --git a/csharp/ql/test/library-tests/generics/Generics7.ql b/csharp/ql/test/library-tests/generics/Generics7.ql
index 3a0191687ac6..60ac39bbc774 100644
--- a/csharp/ql/test/library-tests/generics/Generics7.ql
+++ b/csharp/ql/test/library-tests/generics/Generics7.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass aString, ConstructedClass bString
-where aString.hasName("A<String>")
-  and bString.hasName("B<String>")
-  and aString.getSourceDeclaration().hasName("A<>")
-  and bString.getSourceDeclaration().hasName("B<>")
+where
+  aString.hasName("A<String>") and
+  bString.hasName("B<String>") and
+  aString.getSourceDeclaration().hasName("A<>") and
+  bString.getSourceDeclaration().hasName("B<>")
 select aString, bString
diff --git a/csharp/ql/test/library-tests/generics/Generics8.ql b/csharp/ql/test/library-tests/generics/Generics8.ql
index 8c694dca06e0..7bcba49bb117 100644
--- a/csharp/ql/test/library-tests/generics/Generics8.ql
+++ b/csharp/ql/test/library-tests/generics/Generics8.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass bString, Method m
-where bString.hasName("B<String>")
-  and m.getDeclaringType() = bString
-  and m.hasName("fooParams")
-  and m.getParameter(0).getType().(ArrayType).getElementType() instanceof StringType
-  and m.getSourceDeclaration().getDeclaringType() = m.getDeclaringType().getSourceDeclaration()
+where
+  bString.hasName("B<String>") and
+  m.getDeclaringType() = bString and
+  m.hasName("fooParams") and
+  m.getParameter(0).getType().(ArrayType).getElementType() instanceof StringType and
+  m.getSourceDeclaration().getDeclaringType() = m.getDeclaringType().getSourceDeclaration()
 select bString, m
diff --git a/csharp/ql/test/library-tests/generics/Generics9.ql b/csharp/ql/test/library-tests/generics/Generics9.ql
index 1825a46f4fb2..88d7404a72cb 100644
--- a/csharp/ql/test/library-tests/generics/Generics9.ql
+++ b/csharp/ql/test/library-tests/generics/Generics9.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for generics
  */
+
 import csharp
 
 from ConstructedClass bString, Property p
-where bString.hasName("B<String>")
-  and p.getDeclaringType() = bString
-  and p.hasName("Name")
-  and p.getSourceDeclaration().getDeclaringType() = p.getDeclaringType().getSourceDeclaration()
-  and p.getSetter().getParameter(0).getType() instanceof StringType
-  and p.getSetter().getSourceDeclaration() = p.getSourceDeclaration().getSetter()
-  and p.getGetter().getSourceDeclaration() = p.getSourceDeclaration().getGetter()
+where
+  bString.hasName("B<String>") and
+  p.getDeclaringType() = bString and
+  p.hasName("Name") and
+  p.getSourceDeclaration().getDeclaringType() = p.getDeclaringType().getSourceDeclaration() and
+  p.getSetter().getParameter(0).getType() instanceof StringType and
+  p.getSetter().getSourceDeclaration() = p.getSourceDeclaration().getSetter() and
+  p.getGetter().getSourceDeclaration() = p.getSourceDeclaration().getGetter()
 select bString, p.getSourceDeclaration().getSetter(), p.getSetter()
diff --git a/csharp/ql/test/library-tests/goto/Goto1.ql b/csharp/ql/test/library-tests/goto/Goto1.ql
index 82ce415accd9..e7ee0b3ff8a8 100644
--- a/csharp/ql/test/library-tests/goto/Goto1.ql
+++ b/csharp/ql/test/library-tests/goto/Goto1.ql
@@ -1,8 +1,7 @@
 import csharp
 
 query predicate edges(ControlFlow::Node node, ControlFlow::Node successor, string attr, string val) {
-  exists(ControlFlow::SuccessorType t |
-    successor = node.getASuccessorByType(t) |
+  exists(ControlFlow::SuccessorType t | successor = node.getASuccessorByType(t) |
     attr = "semmle.label" and
     val = t.toString()
   )
diff --git a/csharp/ql/test/library-tests/indexers/Indexers1.ql b/csharp/ql/test/library-tests/indexers/Indexers1.ql
index 37a44fa290ba..e7b06b1be804 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers1.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers1.ql
@@ -1,9 +1,8 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 where forall(Indexer i | i.fromSource() | i.hasName("Item"))
 select 1
-
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers10.ql b/csharp/ql/test/library-tests/indexers/Indexers10.ql
index c69743681dfb..a83295233150 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers10.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers10.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.Grid")
-  and i.getType() instanceof IntType
-  and i.isPublic()
-  and i.isReadWrite()
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.Grid") and
+  i.getType() instanceof IntType and
+  i.isPublic() and
+  i.isReadWrite()
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers11.ql b/csharp/ql/test/library-tests/indexers/Indexers11.ql
index 923911a6a281..78e942201fb4 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers11.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers11.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Parameter p
 select count(p.getDeclaringElement())
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers2.ql b/csharp/ql/test/library-tests/indexers/Indexers2.ql
index c371482f64a8..6065ae9abb8d 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers2.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.BitArray")
-  and i.getType() instanceof BoolType
-  and i.getDimension() = 1
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.BitArray") and
+  i.getType() instanceof BoolType and
+  i.getDimension() = 1
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers3.ql b/csharp/ql/test/library-tests/indexers/Indexers3.ql
index 56ed8ee9ef01..9b38e6f67510 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers3.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers3.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.BitArray")
-  and i.getType() instanceof BoolType
-  and i.getParameter(0).getName() = "index"
-  and i.getParameter(0).getType() instanceof IntType
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.BitArray") and
+  i.getType() instanceof BoolType and
+  i.getParameter(0).getName() = "index" and
+  i.getParameter(0).getType() instanceof IntType
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers4.ql b/csharp/ql/test/library-tests/indexers/Indexers4.ql
index 3a19c64ea147..5eeb3808a531 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers4.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers4.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Class c
-where c.hasQualifiedName("Indexers.BitArray")
-  and count(Indexer i | i.getDeclaringType() = c) = 1
+where
+  c.hasQualifiedName("Indexers.BitArray") and
+  count(Indexer i | i.getDeclaringType() = c) = 1
 select c
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers5.ql b/csharp/ql/test/library-tests/indexers/Indexers5.ql
index c1613fa7cc78..f264e130711e 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers5.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers5.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.BitArray")
-  and i.getType() instanceof BoolType
-  and i.isPublic()
-  and i.isReadWrite()
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.BitArray") and
+  i.getType() instanceof BoolType and
+  i.isPublic() and
+  i.isReadWrite()
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers6.ql b/csharp/ql/test/library-tests/indexers/Indexers6.ql
index 0dd4ab5a2515..148a896e5159 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers6.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers6.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.BitArray")
-  and i.getType() instanceof BoolType
-  and i.getGetter().hasBody()
-  and i.getSetter().hasBody()
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.BitArray") and
+  i.getType() instanceof BoolType and
+  i.getGetter().hasBody() and
+  i.getSetter().hasBody()
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers7.ql b/csharp/ql/test/library-tests/indexers/Indexers7.ql
index e9babc7c7e50..74dc80fa6246 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers7.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers7.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.Grid")
-  and i.getType() instanceof IntType
-  and i.getDimension() = 2
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.Grid") and
+  i.getType() instanceof IntType and
+  i.getDimension() = 2
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers8.ql b/csharp/ql/test/library-tests/indexers/Indexers8.ql
index 03b78353d34d..abaf258fafe1 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers8.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers8.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.Grid")
-  and i.getType() instanceof IntType
-  and i.getParameter(0).getName() = "c"
-  and i.getParameter(0).getType() instanceof CharType
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.Grid") and
+  i.getType() instanceof IntType and
+  i.getParameter(0).getName() = "c" and
+  i.getParameter(0).getType() instanceof CharType
 select i
-
diff --git a/csharp/ql/test/library-tests/indexers/Indexers9.ql b/csharp/ql/test/library-tests/indexers/Indexers9.ql
index 539c6bd8b039..a50719af9122 100644
--- a/csharp/ql/test/library-tests/indexers/Indexers9.ql
+++ b/csharp/ql/test/library-tests/indexers/Indexers9.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for indexers
  */
+
 import csharp
 
 from Indexer i
-where i.getDeclaringType().hasQualifiedName("Indexers.Grid")
-  and i.getType() instanceof IntType
-  and i.getParameter(1).getName() = "col"
-  and i.getParameter(1).getType() instanceof IntType
+where
+  i.getDeclaringType().hasQualifiedName("Indexers.Grid") and
+  i.getType() instanceof IntType and
+  i.getParameter(1).getName() = "col" and
+  i.getParameter(1).getType() instanceof IntType
 select i
-
diff --git a/csharp/ql/test/library-tests/initializers/CollectionInitializer.ql b/csharp/ql/test/library-tests/initializers/CollectionInitializer.ql
index cea793e0487d..0564a543c38e 100644
--- a/csharp/ql/test/library-tests/initializers/CollectionInitializer.ql
+++ b/csharp/ql/test/library-tests/initializers/CollectionInitializer.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from CollectionInitializer i, int n, int arg, ElementInitializer e
-where e=i.getElementInitializer(n)
+where e = i.getElementInitializer(n)
 select i, n, e, e.getTarget(), arg, e.getArgument(arg)
diff --git a/csharp/ql/test/library-tests/linq/Linq1.ql b/csharp/ql/test/library-tests/linq/Linq1.ql
index db93984e5f97..8969e1a15547 100644
--- a/csharp/ql/test/library-tests/linq/Linq1.ql
+++ b/csharp/ql/test/library-tests/linq/Linq1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for Linq calls
  */
+
 import csharp
 
 from MethodCall mc, int a1
diff --git a/csharp/ql/test/library-tests/linq/Linq2.ql b/csharp/ql/test/library-tests/linq/Linq2.ql
index 632cfc96a709..b3909f88b70f 100644
--- a/csharp/ql/test/library-tests/linq/Linq2.ql
+++ b/csharp/ql/test/library-tests/linq/Linq2.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for Linq expressions
  */
+
 import csharp
 
 from BinaryOperation e
diff --git a/csharp/ql/test/library-tests/members/AccessModifiers.ql b/csharp/ql/test/library-tests/members/AccessModifiers.ql
index 0a69c6240f86..40127f858151 100644
--- a/csharp/ql/test/library-tests/members/AccessModifiers.ql
+++ b/csharp/ql/test/library-tests/members/AccessModifiers.ql
@@ -2,8 +2,7 @@ import csharp
 
 from Modifiable d, string s
 where
-  d.fromSource()
-  and
+  d.fromSource() and
   (
     d.isPrivate() and s = "private"
     or
diff --git a/csharp/ql/test/library-tests/methods/ExtensionMethods.ql b/csharp/ql/test/library-tests/methods/ExtensionMethods.ql
index fd50e5f51023..f504ebfdd3f4 100644
--- a/csharp/ql/test/library-tests/methods/ExtensionMethods.ql
+++ b/csharp/ql/test/library-tests/methods/ExtensionMethods.ql
@@ -1,6 +1,11 @@
 import csharp
 
 from MethodCall mc, int i, Expr e
-where mc.getTarget() instanceof ExtensionMethod
-  and (e = mc.getArgument(i) or e = mc.getQualifier() and i = -1)
+where
+  mc.getTarget() instanceof ExtensionMethod and
+  (
+    e = mc.getArgument(i)
+    or
+    e = mc.getQualifier() and i = -1
+  )
 select mc, i, e
diff --git a/csharp/ql/test/library-tests/methods/Methods1.ql b/csharp/ql/test/library-tests/methods/Methods1.ql
index 54933356abb7..fb8c2d4cdf9a 100644
--- a/csharp/ql/test/library-tests/methods/Methods1.ql
+++ b/csharp/ql/test/library-tests/methods/Methods1.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for methods
  */
+
 import csharp
 
 from Method s
-where s.hasName("Swap")
-  and s.isStatic()
+where
+  s.hasName("Swap") and
+  s.isStatic()
 select s
-
diff --git a/csharp/ql/test/library-tests/methods/Methods2.ql b/csharp/ql/test/library-tests/methods/Methods2.ql
index 942b2b07410a..65481b595081 100644
--- a/csharp/ql/test/library-tests/methods/Methods2.ql
+++ b/csharp/ql/test/library-tests/methods/Methods2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for methods
  */
+
 import csharp
 
 from Method s
-where s.hasName("Divide")
-  and s.isStatic()
-  and s.isPublic()
-  and s.getReturnType() instanceof VoidType
+where
+  s.hasName("Divide") and
+  s.isStatic() and
+  s.isPublic() and
+  s.getReturnType() instanceof VoidType
 select s
-
diff --git a/csharp/ql/test/library-tests/methods/Methods3.ql b/csharp/ql/test/library-tests/methods/Methods3.ql
index 08a5c5d51195..152ed307b077 100644
--- a/csharp/ql/test/library-tests/methods/Methods3.ql
+++ b/csharp/ql/test/library-tests/methods/Methods3.ql
@@ -1,10 +1,13 @@
 /**
  * @name Test for methods
  */
+
 import csharp
 
 from Class c
-where c.hasName("TestOverloading")
-  and count(Method m | m.getDeclaringType() = c and m.hasName("F") and not m instanceof ConstructedMethod) = 6
+where
+  c.hasName("TestOverloading") and
+  count(Method m |
+    m.getDeclaringType() = c and m.hasName("F") and not m instanceof ConstructedMethod
+  ) = 6
 select c
-
diff --git a/csharp/ql/test/library-tests/methods/Methods4.ql b/csharp/ql/test/library-tests/methods/Methods4.ql
index 9f948f033e80..2d5806c8e9f1 100644
--- a/csharp/ql/test/library-tests/methods/Methods4.ql
+++ b/csharp/ql/test/library-tests/methods/Methods4.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for methods
  */
+
 import csharp
 
 from Class c, Method m
-where c.hasName("TestOverloading")
-  and m.getDeclaringType() = c
-  and m.hasName("F")
-  and m.getParameter(0).getType() instanceof ObjectType
+where
+  c.hasName("TestOverloading") and
+  m.getDeclaringType() = c and
+  m.hasName("F") and
+  m.getParameter(0).getType() instanceof ObjectType
 select c, m, m.getParameter(0).getType().toString()
-
diff --git a/csharp/ql/test/library-tests/methods/Methods5.ql b/csharp/ql/test/library-tests/methods/Methods5.ql
index a5659224f00c..b7c74d24d133 100644
--- a/csharp/ql/test/library-tests/methods/Methods5.ql
+++ b/csharp/ql/test/library-tests/methods/Methods5.ql
@@ -5,6 +5,7 @@
 import csharp
 
 from Callable src, Callable dest
-where dest.fromSource()
-and src.calls(dest)
+where
+  dest.fromSource() and
+  src.calls(dest)
 select src, dest, src.getDeclaringType()
diff --git a/csharp/ql/test/library-tests/methods/Parameters1.ql b/csharp/ql/test/library-tests/methods/Parameters1.ql
index 7abacb61e788..d4b1939bfe7b 100644
--- a/csharp/ql/test/library-tests/methods/Parameters1.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters1.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for parameters
  */
+
 import csharp
 
 from Method m
-where m.hasName("Swap")
-  and m.getDeclaringType().hasQualifiedName("Methods.TestRef")
-  and m.getParameter(0).isRef()
-  and m.getParameter(0).hasName("x")
-  and m.getParameter(0).getType() instanceof IntType
-  and m.getParameter(1).isRef()
-  and m.getParameter(1).hasName("y")
-  and m.getParameter(1).getType() instanceof IntType
+where
+  m.hasName("Swap") and
+  m.getDeclaringType().hasQualifiedName("Methods.TestRef") and
+  m.getParameter(0).isRef() and
+  m.getParameter(0).hasName("x") and
+  m.getParameter(0).getType() instanceof IntType and
+  m.getParameter(1).isRef() and
+  m.getParameter(1).hasName("y") and
+  m.getParameter(1).getType() instanceof IntType
 select m, m.getAParameter()
-
diff --git a/csharp/ql/test/library-tests/methods/Parameters2.ql b/csharp/ql/test/library-tests/methods/Parameters2.ql
index 2e691af24e8c..eb992f2c7f08 100644
--- a/csharp/ql/test/library-tests/methods/Parameters2.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters2.ql
@@ -1,22 +1,23 @@
 /**
  * @name Test for parameters
  */
+
 import csharp
 
 from Method m
-where m.hasName("Divide")
-  and m.getDeclaringType().hasQualifiedName("Methods.TestOut")
-  and m.getParameter(0).isValue()
-  and m.getParameter(0).hasName("x")
-  and m.getParameter(0).getType() instanceof IntType
-  and m.getParameter(1).isValue()
-  and m.getParameter(1).hasName("y")
-  and m.getParameter(1).getType() instanceof IntType
-  and m.getParameter(2).isOut()
-  and m.getParameter(2).hasName("result")
-  and m.getParameter(2).getType() instanceof IntType
-  and m.getParameter(3).isOut()
-  and m.getParameter(3).hasName("remainder")
-  and m.getParameter(3).getType() instanceof IntType
+where
+  m.hasName("Divide") and
+  m.getDeclaringType().hasQualifiedName("Methods.TestOut") and
+  m.getParameter(0).isValue() and
+  m.getParameter(0).hasName("x") and
+  m.getParameter(0).getType() instanceof IntType and
+  m.getParameter(1).isValue() and
+  m.getParameter(1).hasName("y") and
+  m.getParameter(1).getType() instanceof IntType and
+  m.getParameter(2).isOut() and
+  m.getParameter(2).hasName("result") and
+  m.getParameter(2).getType() instanceof IntType and
+  m.getParameter(3).isOut() and
+  m.getParameter(3).hasName("remainder") and
+  m.getParameter(3).getType() instanceof IntType
 select m, m.getAParameter()
-
diff --git a/csharp/ql/test/library-tests/methods/Parameters3.ql b/csharp/ql/test/library-tests/methods/Parameters3.ql
index 7d96d1d27c36..0c69218be581 100644
--- a/csharp/ql/test/library-tests/methods/Parameters3.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters3.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for parameters
  */
+
 import csharp
 
 from Method m
-where m.hasName("Write")
-  and m.getDeclaringType().hasQualifiedName("Methods.Console")
-  and m.getParameter(0).isValue()
-  and m.getParameter(0).hasName("fmt")
-  and m.getParameter(0).getType() instanceof StringType
-  and m.getParameter(1).isParams()
-  and m.getParameter(1).hasName("args")
-  and m.getParameter(1).getType().(ArrayType).getElementType() instanceof ObjectType
+where
+  m.hasName("Write") and
+  m.getDeclaringType().hasQualifiedName("Methods.Console") and
+  m.getParameter(0).isValue() and
+  m.getParameter(0).hasName("fmt") and
+  m.getParameter(0).getType() instanceof StringType and
+  m.getParameter(1).isParams() and
+  m.getParameter(1).hasName("args") and
+  m.getParameter(1).getType().(ArrayType).getElementType() instanceof ObjectType
 select m, m.getAParameter().getType().toString()
-
diff --git a/csharp/ql/test/library-tests/methods/Parameters4.ql b/csharp/ql/test/library-tests/methods/Parameters4.ql
index bd8f48586812..aa103547f86a 100644
--- a/csharp/ql/test/library-tests/methods/Parameters4.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters4.ql
@@ -1,8 +1,8 @@
 /**
  * @name Test for parameters
  */
+
 import csharp
 
 where forall(Parameter p | p.isParams() | p.getType() instanceof ArrayType)
 select 1
-
diff --git a/csharp/ql/test/library-tests/methods/Parameters5.ql b/csharp/ql/test/library-tests/methods/Parameters5.ql
index 81f1691dff33..46f80d634cb4 100644
--- a/csharp/ql/test/library-tests/methods/Parameters5.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters5.ql
@@ -1,9 +1,10 @@
 import csharp
 
 from Callable m, Parameter p, Expr v, string value
-where m.getDeclaringType().hasName("TestDefaultParameters")
-and p=m.getAParameter()
-and v=p.getDefaultValue()
-and p.hasDefaultValue()
-and if exists(v.getValue()) then value=v.getValue() else value=""
+where
+  m.getDeclaringType().hasName("TestDefaultParameters") and
+  p = m.getAParameter() and
+  v = p.getDefaultValue() and
+  p.hasDefaultValue() and
+  if exists(v.getValue()) then value = v.getValue() else value = ""
 select p, v, value
diff --git a/csharp/ql/test/library-tests/methods/Parameters6.ql b/csharp/ql/test/library-tests/methods/Parameters6.ql
index eafdf93f46cc..3216912b39d5 100644
--- a/csharp/ql/test/library-tests/methods/Parameters6.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters6.ql
@@ -1,9 +1,10 @@
 import csharp
 
 from DelegateType m, Parameter p, Expr v, string value
-where m.getDeclaringType().hasName("TestDefaultParameters")
-and p=m.getAParameter()
-and v=p.getDefaultValue()
-and p.hasDefaultValue()
-and if exists(v.getValue()) then value=v.getValue() else value=""
+where
+  m.getDeclaringType().hasName("TestDefaultParameters") and
+  p = m.getAParameter() and
+  v = p.getDefaultValue() and
+  p.hasDefaultValue() and
+  if exists(v.getValue()) then value = v.getValue() else value = ""
 select p, v, value
diff --git a/csharp/ql/test/library-tests/methods/Parameters8.ql b/csharp/ql/test/library-tests/methods/Parameters8.ql
index d5e662ea7a71..52fe2eb81031 100644
--- a/csharp/ql/test/library-tests/methods/Parameters8.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters8.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Method m, Parameter p
-where p = m.getAParameter()
-  and m.fromSource()
+where
+  p = m.getAParameter() and
+  m.fromSource()
 select m, p
diff --git a/csharp/ql/test/library-tests/methods/Parameters9.ql b/csharp/ql/test/library-tests/methods/Parameters9.ql
index 87c73cb45434..090a252a561a 100644
--- a/csharp/ql/test/library-tests/methods/Parameters9.ql
+++ b/csharp/ql/test/library-tests/methods/Parameters9.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from Method m, Parameter p, Expr default
-where p = m.getAParameter()
-  and default = p.getDefaultValue()
-  and m.fromSource()
+where
+  p = m.getAParameter() and
+  default = p.getDefaultValue() and
+  m.fromSource()
 select p, default, m.toStringWithTypes()
diff --git a/csharp/ql/test/library-tests/modifiers/Effectively.ql b/csharp/ql/test/library-tests/modifiers/Effectively.ql
index 19ea1babbd04..9e2ef8b66fc9 100644
--- a/csharp/ql/test/library-tests/modifiers/Effectively.ql
+++ b/csharp/ql/test/library-tests/modifiers/Effectively.ql
@@ -1,7 +1,11 @@
 import csharp
 
 from Modifiable m, string s
-where m.fromSource()
-  and (m.isEffectivelyInternal() and not m.isInternal() and s = "internal" or
-       m.isEffectivelyPrivate() and not m.isPrivate() and s = "private")
+where
+  m.fromSource() and
+  (
+    m.isEffectivelyInternal() and not m.isInternal() and s = "internal"
+    or
+    m.isEffectivelyPrivate() and not m.isPrivate() and s = "private"
+  )
 select m, s
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces1.ql b/csharp/ql/test/library-tests/namespaces/Namespaces1.ql
index 481cb2b027ad..0a1e1e965b73 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces1.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces1.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n
-where n.hasQualifiedName("N1.N2")
-  and n.getAClass().hasName("A")
-  and n.getAClass().hasName("B")
+where
+  n.hasQualifiedName("N1.N2") and
+  n.getAClass().hasName("A") and
+  n.getAClass().hasName("B")
 select n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces10.ql b/csharp/ql/test/library-tests/namespaces/Namespaces10.ql
index 596a639d4e7a..c45a49cbd39a 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces10.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces10.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n, UnboundGenericClass ga, Class a
-where n.hasQualifiedName("R1")
-  and ga.hasQualifiedName("R1","A<>")
-  and ga.getATypeParameter().hasName("T")
-  and ga.getNamespace() = n
-  and a.hasQualifiedName("R1.A")
-  and n.getAClass() = a
-  and n.getAClass() = ga
+where
+  n.hasQualifiedName("R1") and
+  ga.hasQualifiedName("R1", "A<>") and
+  ga.getATypeParameter().hasName("T") and
+  ga.getNamespace() = n and
+  a.hasQualifiedName("R1.A") and
+  n.getAClass() = a and
+  n.getAClass() = ga
 select n, ga, a
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces11.ql b/csharp/ql/test/library-tests/namespaces/Namespaces11.ql
index bd8dc77fb414..3aea83ac0cf6 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces11.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces11.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from UsingNamespaceDirective u
-where u.getParentNamespaceDeclaration().getNamespace().hasQualifiedName("S3")
-  and u.getImportedNamespace().hasQualifiedName("S1.S2")
-  and u.getFile().getBaseName() = "namespaces.cs"
+where
+  u.getParentNamespaceDeclaration().getNamespace().hasQualifiedName("S3") and
+  u.getImportedNamespace().hasQualifiedName("S1.S2") and
+  u.getFile().getBaseName() = "namespaces.cs"
 select u
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces12.ql b/csharp/ql/test/library-tests/namespaces/Namespaces12.ql
index b5b39c4f8808..73d66435b9d3 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces12.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces12.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from UsingNamespaceDirective u
-where u.getFile().getBaseName() = "namespaces.cs"
-  and u.getImportedNamespace().hasQualifiedName("System.Collections.Generic")
-  and not exists(u.getParentNamespaceDeclaration())
+where
+  u.getFile().getBaseName() = "namespaces.cs" and
+  u.getImportedNamespace().hasQualifiedName("System.Collections.Generic") and
+  not exists(u.getParentNamespaceDeclaration())
 select u
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces2.ql b/csharp/ql/test/library-tests/namespaces/Namespaces2.ql
index 9d4070763ec6..f176ad89d3db 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces2.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n
-where n.hasQualifiedName("M1.M2")
-  and n.getAClass().hasName("A")
-  and n.getAClass().hasName("B")
+where
+  n.hasQualifiedName("M1.M2") and
+  n.getAClass().hasName("A") and
+  n.getAClass().hasName("B")
 select n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces3.ql b/csharp/ql/test/library-tests/namespaces/Namespaces3.ql
index df0e52a40bcb..60acfc8bce59 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces3.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n
-where n.hasQualifiedName("P1.P2")
-  and n.getAClass().hasName("A")
-  and n.getAClass().hasName("B")
-  and n.getAStruct().hasName("S")
-  and n.getAnInterface().hasName("I")
+where
+  n.hasQualifiedName("P1.P2") and
+  n.getAClass().hasName("A") and
+  n.getAClass().hasName("B") and
+  n.getAStruct().hasName("S") and
+  n.getAnInterface().hasName("I")
 select n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces4.ql b/csharp/ql/test/library-tests/namespaces/Namespaces4.ql
index 59897ddfe4d5..81313001412d 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces4.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces4.ql
@@ -1,15 +1,16 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n, Class a, Class b
-where n.hasQualifiedName("M1.M2")
-  and a = n.getAClass()
-  and a.hasName("A")
-  and a.isPublic()
-  and b = n.getAClass()
-  and b.hasName("B")
-  and b.isInternal()
+where
+  n.hasQualifiedName("M1.M2") and
+  a = n.getAClass() and
+  a.hasName("A") and
+  a.isPublic() and
+  b = n.getAClass() and
+  b.hasName("B") and
+  b.isInternal()
 select n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces5.ql b/csharp/ql/test/library-tests/namespaces/Namespaces5.ql
index f26ed853f6b0..95c51ca1e375 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces5.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces5.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n
-where n.hasQualifiedName("Empty")
-  and not exists(n.getATypeDeclaration())
+where
+  n.hasQualifiedName("Empty") and
+  not exists(n.getATypeDeclaration())
 select n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces6.ql b/csharp/ql/test/library-tests/namespaces/Namespaces6.ql
index 86c1557e7e51..d89e2a998fa2 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces6.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces6.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n, Namespace p
-where n.hasQualifiedName("Q1.Q2")
-  and n.hasName("Q2")
-  and p = n.getParentNamespace()
-  and p.hasName("Q1")
-  and p.hasQualifiedName("Q1")
+where
+  n.hasQualifiedName("Q1.Q2") and
+  n.hasName("Q2") and
+  p = n.getParentNamespace() and
+  p.hasName("Q1") and
+  p.hasQualifiedName("Q1")
 select p, n
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces7.ql b/csharp/ql/test/library-tests/namespaces/Namespaces7.ql
index 7d703a156091..4593ddef8c47 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces7.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces7.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n, Class b, Class a
-where n.hasQualifiedName("Q3")
-  and a.hasQualifiedName("Q1.Q2","A")
-  and b.hasName("B")
-  and b.getNamespace() = n
-  and b.getBaseClass() = a
+where
+  n.hasQualifiedName("Q3") and
+  a.hasQualifiedName("Q1.Q2", "A") and
+  b.hasName("B") and
+  b.getNamespace() = n and
+  b.getBaseClass() = a
 select n, b, a
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces8.ql b/csharp/ql/test/library-tests/namespaces/Namespaces8.ql
index 3d161db489e5..870f0c397b13 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces8.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces8.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from Namespace n, Class c, Class a
-where n.hasQualifiedName("Q3")
-  and a.hasQualifiedName("Q1.Q2","A")
-  and c.hasName("C")
-  and c.getNamespace() = n
-  and c.getBaseClass() = a
+where
+  n.hasQualifiedName("Q3") and
+  a.hasQualifiedName("Q1.Q2", "A") and
+  c.hasName("C") and
+  c.getNamespace() = n and
+  c.getBaseClass() = a
 select n, c, a
-
diff --git a/csharp/ql/test/library-tests/namespaces/Namespaces9.ql b/csharp/ql/test/library-tests/namespaces/Namespaces9.ql
index 0951915af06b..047524c1f55a 100644
--- a/csharp/ql/test/library-tests/namespaces/Namespaces9.ql
+++ b/csharp/ql/test/library-tests/namespaces/Namespaces9.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for namespaces
  */
+
 import csharp
 
 from UnboundGenericClass a, Class b
-where a.hasQualifiedName("R1","A<>")
-  and a.getATypeParameter().hasName("T")
-  and a.getANestedType() = b
-  and b.getName() = "B"
-  and b.hasQualifiedName("R1.A<>.B")
+where
+  a.hasQualifiedName("R1", "A<>") and
+  a.getATypeParameter().hasName("T") and
+  a.getANestedType() = b and
+  b.getName() = "B" and
+  b.hasQualifiedName("R1.A<>.B")
 select a, b
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes1.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes1.ql
index a457427ccab3..0bd3610f2d95 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes1.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes1.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from Class c, Struct s
-where c.hasQualifiedName("NestedTypes.Base")
-  and s.hasQualifiedName("NestedTypes.Base.S")
-  and s = c.getANestedType()
-  and s.(NestedType).isProtected()
-  and c.isPublic()
+where
+  c.hasQualifiedName("NestedTypes.Base") and
+  s.hasQualifiedName("NestedTypes.Base.S") and
+  s = c.getANestedType() and
+  s.(NestedType).isProtected() and
+  c.isPublic()
 select c, s
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes2.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes2.ql
index 37b5b51db68d..1222441765de 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes2.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes2.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from Class c, Interface i
-where c.hasQualifiedName("NestedTypes.Base")
-  and i.hasQualifiedName("NestedTypes.Base.I")
-  and i.(NestedType).isPrivate()
-  and i = c.getANestedType()
+where
+  c.hasQualifiedName("NestedTypes.Base") and
+  i.hasQualifiedName("NestedTypes.Base.I") and
+  i.(NestedType).isPrivate() and
+  i = c.getANestedType()
 select c, i
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes3.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes3.ql
index 1c030e2bd88d..989bff15dbe1 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes3.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes3.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from Class c, DelegateType d
-where c.hasQualifiedName("NestedTypes.Base")
-  and d.hasQualifiedName("NestedTypes.Base.MyDelegate")
-  and d.(NestedType).isPrivate()
-  and d = c.getANestedType()
+where
+  c.hasQualifiedName("NestedTypes.Base") and
+  d.hasQualifiedName("NestedTypes.Base.MyDelegate") and
+  d.(NestedType).isPrivate() and
+  d = c.getANestedType()
 select c, d
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes4.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes4.ql
index 30a22b9f1dbb..16b853d8a9e6 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes4.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes4.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from Class base, Class derived, Class nested
-where base.hasQualifiedName("NestedTypes.Base")
-  and derived.hasQualifiedName("NestedTypes.Derived")
-  and nested.hasQualifiedName("NestedTypes.Derived.Nested")
-  and nested.getNamespace().hasName("NestedTypes")
-  and derived.getBaseClass() = base
-  and derived.isInternal()
-  and nested.isPublic()
-  and base.isPublic()
+where
+  base.hasQualifiedName("NestedTypes.Base") and
+  derived.hasQualifiedName("NestedTypes.Derived") and
+  nested.hasQualifiedName("NestedTypes.Derived.Nested") and
+  nested.getNamespace().hasName("NestedTypes") and
+  derived.getBaseClass() = base and
+  derived.isInternal() and
+  nested.isPublic() and
+  base.isPublic()
 select base, derived, nested
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes5.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes5.ql
index 01778087d61a..d6b48f928c6f 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes5.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes5.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from Class base, Class derived, Class nested
-where base.hasQualifiedName("NestedTypes.Base")
-  and derived.hasQualifiedName("NestedTypes.Derived")
-  and nested.hasQualifiedName("NestedTypes.Derived.Nested")
-  and nested.getNamespace().hasName("NestedTypes")
-  and nested.getDeclaringType() = derived
+where
+  base.hasQualifiedName("NestedTypes.Base") and
+  derived.hasQualifiedName("NestedTypes.Derived") and
+  nested.hasQualifiedName("NestedTypes.Derived.Nested") and
+  nested.getNamespace().hasName("NestedTypes") and
+  nested.getDeclaringType() = derived
 select base, derived, nested
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes6.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes6.ql
index 504bc2541543..dcce4ac68654 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes6.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes6.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from UnboundGenericClass o, UnboundGenericClass i
-where o.hasQualifiedName("NestedTypes.Outer<>")
-  and i.hasQualifiedName("NestedTypes.Outer<>.Inner<>")
-  and i = o.getANestedType()
+where
+  o.hasQualifiedName("NestedTypes.Outer<>") and
+  i.hasQualifiedName("NestedTypes.Outer<>.Inner<>") and
+  i = o.getANestedType()
 select o, i
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes7.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes7.ql
index e46b90283818..484052bb248a 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes7.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes7.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from UnboundGenericClass o, UnboundGenericClass i
-where o.hasQualifiedName("NestedTypes.Outer2<>")
-  and i.hasQualifiedName("NestedTypes.Outer2<>.Inner2<>")
-  and i = o.getANestedType()
-  and i.getTypeParameter(0).getName() = o.getTypeParameter(0).getName()
+where
+  o.hasQualifiedName("NestedTypes.Outer2<>") and
+  i.hasQualifiedName("NestedTypes.Outer2<>.Inner2<>") and
+  i = o.getANestedType() and
+  i.getTypeParameter(0).getName() = o.getTypeParameter(0).getName()
 select o, i
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes8.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes8.ql
index 6563122e0446..9cb2c5c58de0 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes8.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes8.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from ConstructedClass o, ConstructedClass i
-where o.hasQualifiedName("NestedTypes.Outer<Int32>")
-  and i.hasQualifiedName("NestedTypes.Outer<Int32>.Inner<String>")
-  and i = o.getANestedType()
-  and o.getTypeArgument(0) instanceof IntType
-  and i.getTypeArgument(0) instanceof StringType
+where
+  o.hasQualifiedName("NestedTypes.Outer<Int32>") and
+  i.hasQualifiedName("NestedTypes.Outer<Int32>.Inner<String>") and
+  i = o.getANestedType() and
+  o.getTypeArgument(0) instanceof IntType and
+  i.getTypeArgument(0) instanceof StringType
 select o, i
-
diff --git a/csharp/ql/test/library-tests/nestedtypes/NestedTypes9.ql b/csharp/ql/test/library-tests/nestedtypes/NestedTypes9.ql
index 98bbb69c91c0..908d9fe59343 100644
--- a/csharp/ql/test/library-tests/nestedtypes/NestedTypes9.ql
+++ b/csharp/ql/test/library-tests/nestedtypes/NestedTypes9.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for nested types
  */
+
 import csharp
 
 from UnboundGenericClass o, ConstructedClass i
-where o.hasQualifiedName("NestedTypes.Outer<>")
-  and i.hasQualifiedName("NestedTypes.Outer<>.Inner<String>")
-  and i.getUnboundGeneric() = o.getANestedType()
-  and i.getTypeArgument(0) instanceof StringType
+where
+  o.hasQualifiedName("NestedTypes.Outer<>") and
+  i.hasQualifiedName("NestedTypes.Outer<>.Inner<String>") and
+  i.getUnboundGeneric() = o.getANestedType() and
+  i.getTypeArgument(0) instanceof StringType
 select o, i
-
diff --git a/csharp/ql/test/library-tests/nullable/NullableExpressions.ql b/csharp/ql/test/library-tests/nullable/NullableExpressions.ql
index 3f6c815f2189..3fb177e2025a 100644
--- a/csharp/ql/test/library-tests/nullable/NullableExpressions.ql
+++ b/csharp/ql/test/library-tests/nullable/NullableExpressions.ql
@@ -2,5 +2,4 @@ import csharp
 
 from Expr e, Location loc
 where e.getLocation() = loc
-select loc.getStartLine(), loc.getStartColumn(),
-  e.getParent(), e, e.getType().toString()
+select loc.getStartLine(), loc.getStartColumn(), e.getParent(), e, e.getType().toString()
diff --git a/csharp/ql/test/library-tests/operators/Operators1.ql b/csharp/ql/test/library-tests/operators/Operators1.ql
index 5bd2757880b6..f2620eb594ec 100644
--- a/csharp/ql/test/library-tests/operators/Operators1.ql
+++ b/csharp/ql/test/library-tests/operators/Operators1.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for operators
  */
+
 import csharp
 
 from IncrementOperator o
-where o.getDeclaringType().hasQualifiedName("Operators", "IntVector")
-  and o.getReturnType() = o.getDeclaringType()
-  and o.getParameter(0).getType() = o.getDeclaringType()
+where
+  o.getDeclaringType().hasQualifiedName("Operators", "IntVector") and
+  o.getReturnType() = o.getDeclaringType() and
+  o.getParameter(0).getType() = o.getDeclaringType()
 select o, o.getReturnType()
-
diff --git a/csharp/ql/test/library-tests/operators/Operators2.ql b/csharp/ql/test/library-tests/operators/Operators2.ql
index 67baf519e1a5..1ec777d85237 100644
--- a/csharp/ql/test/library-tests/operators/Operators2.ql
+++ b/csharp/ql/test/library-tests/operators/Operators2.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for operators
  */
+
 import csharp
 
 from IncrementOperator o
-where o.getDeclaringType().hasQualifiedName("Operators", "IntVector")
-  and o.getStatementBody().getStmt(2) instanceof ReturnStmt
+where
+  o.getDeclaringType().hasQualifiedName("Operators", "IntVector") and
+  o.getStatementBody().getStmt(2) instanceof ReturnStmt
 select o, o.getReturnType()
-
diff --git a/csharp/ql/test/library-tests/operators/Operators3.ql b/csharp/ql/test/library-tests/operators/Operators3.ql
index 10836db674d4..5b61bf72d4b1 100644
--- a/csharp/ql/test/library-tests/operators/Operators3.ql
+++ b/csharp/ql/test/library-tests/operators/Operators3.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for operators
  */
+
 import csharp
 
 from ImplicitConversionOperator o
-where o.getSourceType() = o.getDeclaringType()
-  and o.getTargetType() instanceof ByteType
+where
+  o.getSourceType() = o.getDeclaringType() and
+  o.getTargetType() instanceof ByteType
 select o
-
diff --git a/csharp/ql/test/library-tests/operators/Operators4.ql b/csharp/ql/test/library-tests/operators/Operators4.ql
index 42a57134512b..6262beb58ff7 100644
--- a/csharp/ql/test/library-tests/operators/Operators4.ql
+++ b/csharp/ql/test/library-tests/operators/Operators4.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for operators
  */
+
 import csharp
 
 from ExplicitConversionOperator o
-where o.getTargetType() = o.getDeclaringType()
-  and o.getSourceType() instanceof ByteType
+where
+  o.getTargetType() = o.getDeclaringType() and
+  o.getSourceType() instanceof ByteType
 select o
-
diff --git a/csharp/ql/test/library-tests/overrides/Implements.ql b/csharp/ql/test/library-tests/overrides/Implements.ql
index d0924894a62e..8b85d5622135 100644
--- a/csharp/ql/test/library-tests/overrides/Implements.ql
+++ b/csharp/ql/test/library-tests/overrides/Implements.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from Virtualizable v1, Virtualizable v2
-where v1 = v2.getAnUltimateImplementor()
-  and v1.fromSource()
-  and v2.fromSource()
+where
+  v1 = v2.getAnUltimateImplementor() and
+  v1.fromSource() and
+  v2.fromSource()
 select v1, v2
diff --git a/csharp/ql/test/library-tests/overrides/Overrides1.ql b/csharp/ql/test/library-tests/overrides/Overrides1.ql
index 957bd4a73c28..c1ac63e4ec25 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides1.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides1.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method bf2, Method cf2
-where bf2.hasName("f2") and bf2.getDeclaringType().hasName("B")
-  and cf2.hasName("f2") and cf2.getDeclaringType().hasName("C")
-  and not bf2.getOverridee() = cf2
+where
+  bf2.hasName("f2") and
+  bf2.getDeclaringType().hasName("B") and
+  cf2.hasName("f2") and
+  cf2.getDeclaringType().hasName("C") and
+  not bf2.getOverridee() = cf2
 select bf2, cf2
diff --git a/csharp/ql/test/library-tests/overrides/Overrides10.ql b/csharp/ql/test/library-tests/overrides/Overrides10.ql
index 4f5033d6d2c9..30521f231f37 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides10.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides10.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af1, Method bf1
-where af1.hasName("f1") and af1.getDeclaringType().hasName("A")
-  and bf1.hasName("f1") and bf1.getDeclaringType().hasName("B")
-  and not af1.getOverridee() = bf1
+where
+  af1.hasName("f1") and
+  af1.getDeclaringType().hasName("A") and
+  bf1.hasName("f1") and
+  bf1.getDeclaringType().hasName("B") and
+  not af1.getOverridee() = bf1
 select af1, bf1
diff --git a/csharp/ql/test/library-tests/overrides/Overrides11.ql b/csharp/ql/test/library-tests/overrides/Overrides11.ql
index 81e9b22985d7..8c2bcb68e35c 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides11.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides11.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Property ap1, Property bp1
-where ap1.hasName("P1") and ap1.getDeclaringType().hasName("A")
-  and bp1.hasName("P1") and bp1.getDeclaringType().hasName("B")
-  and ap1.getOverridee() = bp1
+where
+  ap1.hasName("P1") and
+  ap1.getDeclaringType().hasName("A") and
+  bp1.hasName("P1") and
+  bp1.getDeclaringType().hasName("B") and
+  ap1.getOverridee() = bp1
 select ap1, bp1
diff --git a/csharp/ql/test/library-tests/overrides/Overrides12.ql b/csharp/ql/test/library-tests/overrides/Overrides12.ql
index 836ce2f2b8e9..c336a28bc601 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides12.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides12.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Property ap2, Property bp2
-where ap2.hasName("P2") and ap2.getDeclaringType().hasName("A")
-  and bp2.hasName("P2") and bp2.getDeclaringType().hasName("B")
-  and ap2.getOverridee() = bp2
+where
+  ap2.hasName("P2") and
+  ap2.getDeclaringType().hasName("A") and
+  bp2.hasName("P2") and
+  bp2.getDeclaringType().hasName("B") and
+  ap2.getOverridee() = bp2
 select ap2, bp2
diff --git a/csharp/ql/test/library-tests/overrides/Overrides13.ql b/csharp/ql/test/library-tests/overrides/Overrides13.ql
index cc5a97493deb..d42cd0525c23 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides13.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides13.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Property ap3, Property bp3
-where ap3.hasName("P3") and ap3.getDeclaringType().hasName("A")
-  and bp3.hasName("P3") and bp3.getDeclaringType().hasName("B")
-  and ap3.getOverridee() = bp3
+where
+  ap3.hasName("P3") and
+  ap3.getDeclaringType().hasName("A") and
+  bp3.hasName("P3") and
+  bp3.getDeclaringType().hasName("B") and
+  ap3.getOverridee() = bp3
 select ap3, bp3
diff --git a/csharp/ql/test/library-tests/overrides/Overrides14.ql b/csharp/ql/test/library-tests/overrides/Overrides14.ql
index 597e53a2e39a..22de83499293 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides14.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides14.ql
@@ -1,12 +1,17 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Property ap4, Property bp4, Property cp4
-where ap4.hasName("P4") and ap4.getDeclaringType().hasName("A")
-  and bp4.hasName("P4") and bp4.getDeclaringType().hasName("B")
-  and cp4.hasName("P4") and cp4.getDeclaringType().hasName("C")
-  and not ap4.getOverridee() = bp4
-  and ap4.getOverridee() = cp4
+where
+  ap4.hasName("P4") and
+  ap4.getDeclaringType().hasName("A") and
+  bp4.hasName("P4") and
+  bp4.getDeclaringType().hasName("B") and
+  cp4.hasName("P4") and
+  cp4.getDeclaringType().hasName("C") and
+  not ap4.getOverridee() = bp4 and
+  ap4.getOverridee() = cp4
 select ap4, bp4
diff --git a/csharp/ql/test/library-tests/overrides/Overrides15.ql b/csharp/ql/test/library-tests/overrides/Overrides15.ql
index e11681aa55d2..225fa2bb598c 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides15.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides15.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method m, Method n
-where m.hasName("ToString") and m.getDeclaringType().hasName("C")
-  and n.hasName("ToString") and n.getDeclaringType() instanceof ObjectType
-  and m.getOverridee() = n
+where
+  m.hasName("ToString") and
+  m.getDeclaringType().hasName("C") and
+  n.hasName("ToString") and
+  n.getDeclaringType() instanceof ObjectType and
+  m.getOverridee() = n
 select m, n.toString()
diff --git a/csharp/ql/test/library-tests/overrides/Overrides16.ql b/csharp/ql/test/library-tests/overrides/Overrides16.ql
index 183331974182..3fc690ae80e7 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides16.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides16.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method m, Method n
-where m.hasName("Add") and m.getDeclaringType().hasName("List<>")
-  and n.hasName("Add") and n.getDeclaringType().hasName("ICollection<T>")
-  and m.getImplementee() = n
+where
+  m.hasName("Add") and
+  m.getDeclaringType().hasName("List<>") and
+  n.hasName("Add") and
+  n.getDeclaringType().hasName("ICollection<T>") and
+  m.getImplementee() = n
 select m.toString(), n.toString()
diff --git a/csharp/ql/test/library-tests/overrides/Overrides17.ql b/csharp/ql/test/library-tests/overrides/Overrides17.ql
index a3d2b98a6fed..f3d0aebdba23 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides17.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides17.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Event ae1, Event be1
-where ae1.hasName("E1") and ae1.getDeclaringType().hasName("A")
-  and be1.hasName("E1") and be1.getDeclaringType().hasName("B")
-  and ae1.getOverridee() = be1
+where
+  ae1.hasName("E1") and
+  ae1.getDeclaringType().hasName("A") and
+  be1.hasName("E1") and
+  be1.getDeclaringType().hasName("B") and
+  ae1.getOverridee() = be1
 select ae1, be1
diff --git a/csharp/ql/test/library-tests/overrides/Overrides18.ql b/csharp/ql/test/library-tests/overrides/Overrides18.ql
index 591bac77c6da..7d1fb760c52c 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides18.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides18.ql
@@ -1,12 +1,13 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Class c, Method m
 where
- m.fromSource() and
- not m.isAbstract() and
- c.hasMethod(m) and
- c.getName() = "D"
+  m.fromSource() and
+  not m.isAbstract() and
+  c.hasMethod(m) and
+  c.getName() = "D"
 select m, m.getDeclaringType().getName()
diff --git a/csharp/ql/test/library-tests/overrides/Overrides19.ql b/csharp/ql/test/library-tests/overrides/Overrides19.ql
index eb717e19c0fc..4e15b919801f 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides19.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides19.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method m, Method m2
-where m.getName() = "M"
-  and (m.getOverridee() = m2 or m.getImplementee() = m2)
+where
+  m.getName() = "M" and
+  (m.getOverridee() = m2 or m.getImplementee() = m2)
 select m, m.getDeclaringType(), m2, m2.getDeclaringType()
diff --git a/csharp/ql/test/library-tests/overrides/Overrides2.ql b/csharp/ql/test/library-tests/overrides/Overrides2.ql
index 4059a189f064..91d8024092f1 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides2.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides2.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method bf3, Method cf3
-where bf3.hasName("f3") and bf3.getDeclaringType().hasName("B")
-  and cf3.hasName("f3") and cf3.getDeclaringType().hasName("C")
-  and not bf3.getOverridee() = cf3
+where
+  bf3.hasName("f3") and
+  bf3.getDeclaringType().hasName("B") and
+  cf3.hasName("f3") and
+  cf3.getDeclaringType().hasName("C") and
+  not bf3.getOverridee() = cf3
 select bf3, cf3
diff --git a/csharp/ql/test/library-tests/overrides/Overrides20.ql b/csharp/ql/test/library-tests/overrides/Overrides20.ql
index eb7bc1f1e833..dd19f3143daa 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides20.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides20.ql
@@ -1,8 +1,11 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Property p1, Property p2
-where (p1.getOverridee() = p2 or p1.getImplementee() = p2) and p2.hasName("Prop")
+where
+  (p1.getOverridee() = p2 or p1.getImplementee() = p2) and
+  p2.hasName("Prop")
 select p1, p2
diff --git a/csharp/ql/test/library-tests/overrides/Overrides21.ql b/csharp/ql/test/library-tests/overrides/Overrides21.ql
index 46a81eccadf8..78c60195e7ca 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides21.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides21.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from MethodCall mc, Method m
-where mc.getTarget() = m
-and m.fromSource()
+where
+  mc.getTarget() = m and
+  m.fromSource()
 select mc, m
diff --git a/csharp/ql/test/library-tests/overrides/Overrides22.ql b/csharp/ql/test/library-tests/overrides/Overrides22.ql
index 08614da3b011..3369e0d3df40 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides22.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides22.ql
@@ -1,7 +1,12 @@
 import csharp
 
 from Virtualizable v1, Virtualizable v2, string kind
-where (v1.getOverridee() = v2 and kind = "overrides" or v1.getImplementee() = v2 and kind = "implements")
-  and v1.fromSource()
-  and v2.fromSource()
+where
+  (
+    v1.getOverridee() = v2 and kind = "overrides"
+    or
+    v1.getImplementee() = v2 and kind = "implements"
+  ) and
+  v1.fromSource() and
+  v2.fromSource()
 select v1.getQualifiedNameWithTypes(), v2.getQualifiedNameWithTypes(), kind
diff --git a/csharp/ql/test/library-tests/overrides/Overrides3.ql b/csharp/ql/test/library-tests/overrides/Overrides3.ql
index fbe008665558..71954f16930d 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides3.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides3.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method bf4, Method cf4
-where bf4.hasName("f4") and bf4.getDeclaringType().hasName("B")
-  and cf4.hasName("f4") and cf4.getDeclaringType().hasName("C")
-  and not bf4.getOverridee() = cf4
+where
+  bf4.hasName("f4") and
+  bf4.getDeclaringType().hasName("B") and
+  cf4.hasName("f4") and
+  cf4.getDeclaringType().hasName("C") and
+  not bf4.getOverridee() = cf4
 select bf4, cf4
diff --git a/csharp/ql/test/library-tests/overrides/Overrides4.ql b/csharp/ql/test/library-tests/overrides/Overrides4.ql
index 05c1062e5b22..8960eee14d04 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides4.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides4.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method bf5, Method cf5
-where bf5.hasName("f5") and bf5.getDeclaringType().hasName("B")
-  and cf5.hasName("f5") and cf5.getDeclaringType().hasName("C")
-  and bf5.getOverridee() = cf5
+where
+  bf5.hasName("f5") and
+  bf5.getDeclaringType().hasName("B") and
+  cf5.hasName("f5") and
+  cf5.getDeclaringType().hasName("C") and
+  bf5.getOverridee() = cf5
 select bf5, cf5
diff --git a/csharp/ql/test/library-tests/overrides/Overrides5.ql b/csharp/ql/test/library-tests/overrides/Overrides5.ql
index ae7907997135..5ee1ad7ea512 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides5.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides5.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af2, Method bf2
-where af2.hasName("f2") and af2.getDeclaringType().hasName("A")
-  and af2.hasName("f2") and bf2.getDeclaringType().hasName("B")
-  and af2.getOverridee() = bf2
+where
+  af2.hasName("f2") and
+  af2.getDeclaringType().hasName("A") and
+  af2.hasName("f2") and
+  bf2.getDeclaringType().hasName("B") and
+  af2.getOverridee() = bf2
 select af2, bf2
diff --git a/csharp/ql/test/library-tests/overrides/Overrides6.ql b/csharp/ql/test/library-tests/overrides/Overrides6.ql
index 39042bb2a07d..5368515abd1a 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides6.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides6.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af3, Method bf3
-where af3.hasName("f3") and af3.getDeclaringType().hasName("A")
-  and bf3.hasName("f3") and bf3.getDeclaringType().hasName("B")
-  and af3.getOverridee() = bf3
+where
+  af3.hasName("f3") and
+  af3.getDeclaringType().hasName("A") and
+  bf3.hasName("f3") and
+  bf3.getDeclaringType().hasName("B") and
+  af3.getOverridee() = bf3
 select af3, bf3
diff --git a/csharp/ql/test/library-tests/overrides/Overrides7.ql b/csharp/ql/test/library-tests/overrides/Overrides7.ql
index 1229419842ce..2935830ed803 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides7.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides7.ql
@@ -1,12 +1,17 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af4, Method bf4, Method cf4
-where af4.hasName("f4") and af4.getDeclaringType().hasName("A")
-  and bf4.hasName("f4") and bf4.getDeclaringType().hasName("B")
-  and cf4.hasName("f4") and cf4.getDeclaringType().hasName("C")
-  and not af4.getOverridee() = bf4
-  and af4.getOverridee() = cf4
+where
+  af4.hasName("f4") and
+  af4.getDeclaringType().hasName("A") and
+  bf4.hasName("f4") and
+  bf4.getDeclaringType().hasName("B") and
+  cf4.hasName("f4") and
+  cf4.getDeclaringType().hasName("C") and
+  not af4.getOverridee() = bf4 and
+  af4.getOverridee() = cf4
 select af4, bf4, cf4
diff --git a/csharp/ql/test/library-tests/overrides/Overrides8.ql b/csharp/ql/test/library-tests/overrides/Overrides8.ql
index 5ef530a2f4a0..6e8c84e6ef02 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides8.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides8.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af5, Method bf5
-where af5.hasName("f5") and af5.getDeclaringType().hasName("A")
-  and bf5.hasName("f5") and bf5.getDeclaringType().hasName("B")
-  and af5.getOverridee() = bf5
+where
+  af5.hasName("f5") and
+  af5.getDeclaringType().hasName("A") and
+  bf5.hasName("f5") and
+  bf5.getDeclaringType().hasName("B") and
+  af5.getOverridee() = bf5
 select af5, bf5
diff --git a/csharp/ql/test/library-tests/overrides/Overrides9.ql b/csharp/ql/test/library-tests/overrides/Overrides9.ql
index fa9eba1e47c9..962523e19238 100644
--- a/csharp/ql/test/library-tests/overrides/Overrides9.ql
+++ b/csharp/ql/test/library-tests/overrides/Overrides9.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for overrides
  */
+
 import csharp
 
 from Method af6, Method bf6
-where af6.hasName("f6") and af6.getDeclaringType().hasName("A")
-  and bf6.hasName("f6") and bf6.getDeclaringType().hasName("B")
-  and af6.getOverridee() = bf6
+where
+  af6.hasName("f6") and
+  af6.getDeclaringType().hasName("A") and
+  bf6.hasName("f6") and
+  bf6.getDeclaringType().hasName("B") and
+  af6.getOverridee() = bf6
 select af6, bf6
diff --git a/csharp/ql/test/library-tests/properties/Properties1.ql b/csharp/ql/test/library-tests/properties/Properties1.ql
index 9cbc06f51400..ce5998f18f7c 100644
--- a/csharp/ql/test/library-tests/properties/Properties1.ql
+++ b/csharp/ql/test/library-tests/properties/Properties1.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p, Field f
-where p.hasName("Caption")
-  and p.isReadWrite()
-  and p.isPublic()
-  and f.isPrivate()
-  and f.getType() instanceof StringType
-  and p.getType() = f.getType()
-  and p.getDeclaringType() = f.getDeclaringType()
-  and p.getGetter().getStatementBody().getStmt(0) instanceof ReturnStmt
+where
+  p.hasName("Caption") and
+  p.isReadWrite() and
+  p.isPublic() and
+  f.isPrivate() and
+  f.getType() instanceof StringType and
+  p.getType() = f.getType() and
+  p.getDeclaringType() = f.getDeclaringType() and
+  p.getGetter().getStatementBody().getStmt(0) instanceof ReturnStmt
 select p, f
-
diff --git a/csharp/ql/test/library-tests/properties/Properties10.ql b/csharp/ql/test/library-tests/properties/Properties10.ql
index 589deb1e81e9..7f2fae74da5a 100644
--- a/csharp/ql/test/library-tests/properties/Properties10.ql
+++ b/csharp/ql/test/library-tests/properties/Properties10.ql
@@ -1,12 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Y")
-  and p.getDeclaringType().hasQualifiedName("Properties.A")
-  and p.isReadWrite()
-  and not p.isAutoImplemented()
-  and p.isVirtual() and p.isPublic()
+where
+  p.hasName("Y") and
+  p.getDeclaringType().hasQualifiedName("Properties.A") and
+  p.isReadWrite() and
+  not p.isAutoImplemented() and
+  p.isVirtual() and
+  p.isPublic()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties11.ql b/csharp/ql/test/library-tests/properties/Properties11.ql
index ef0838e0f98f..ca1696d61521 100644
--- a/csharp/ql/test/library-tests/properties/Properties11.ql
+++ b/csharp/ql/test/library-tests/properties/Properties11.ql
@@ -1,12 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Y")
-  and p.getDeclaringType().hasQualifiedName("Properties.B")
-  and p.isReadWrite() // overrides a property that is readwrite
-  and not p.isAutoImplemented()
-  and p.isOverride() and p.isPublic()
+where
+  p.hasName("Y") and
+  p.getDeclaringType().hasQualifiedName("Properties.B") and
+  p.isReadWrite() and // overrides a property that is readwrite
+  not p.isAutoImplemented() and
+  p.isOverride() and
+  p.isPublic()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties12.ql b/csharp/ql/test/library-tests/properties/Properties12.ql
index 5bba1efa678d..a8334485efce 100644
--- a/csharp/ql/test/library-tests/properties/Properties12.ql
+++ b/csharp/ql/test/library-tests/properties/Properties12.ql
@@ -1,12 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("X")
-  and p.getDeclaringType().hasQualifiedName("Properties.B")
-  and p.isReadOnly()
-  and not p.isAutoImplemented()
-  and p.isOverride() and p.isPublic()
+where
+  p.hasName("X") and
+  p.getDeclaringType().hasQualifiedName("Properties.B") and
+  p.isReadOnly() and
+  not p.isAutoImplemented() and
+  p.isOverride() and
+  p.isPublic()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties13.ql b/csharp/ql/test/library-tests/properties/Properties13.ql
index 15e660736aa3..f0bf658d1f9f 100644
--- a/csharp/ql/test/library-tests/properties/Properties13.ql
+++ b/csharp/ql/test/library-tests/properties/Properties13.ql
@@ -1,14 +1,17 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Z")
-  and p.getDeclaringType().hasQualifiedName("Properties.B")
-  and p.isReadWrite()
-  and not p.isAutoImplemented()
-  and p.isOverride() and p.isPublic()
-  and p.getGetter().hasBody()
-  and p.getSetter().hasBody()
+where
+  p.hasName("Z") and
+  p.getDeclaringType().hasQualifiedName("Properties.B") and
+  p.isReadWrite() and
+  not p.isAutoImplemented() and
+  p.isOverride() and
+  p.isPublic() and
+  p.getGetter().hasBody() and
+  p.getSetter().hasBody()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties14.ql b/csharp/ql/test/library-tests/properties/Properties14.ql
index 01176e7b2eac..c6c3568e1b87 100644
--- a/csharp/ql/test/library-tests/properties/Properties14.ql
+++ b/csharp/ql/test/library-tests/properties/Properties14.ql
@@ -1,12 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Count")
-  and p.getDeclaringType().hasQualifiedName("System.Collections.Generic.List<>")
-  and not p.isAutoImplemented()
-  and not p.isStatic() and p.isPublic()
-  and p.getType() instanceof IntType
+where
+  p.hasName("Count") and
+  p.getDeclaringType().hasQualifiedName("System.Collections.Generic.List<>") and
+  not p.isAutoImplemented() and
+  not p.isStatic() and
+  p.isPublic() and
+  p.getType() instanceof IntType
 select p.toString()
diff --git a/csharp/ql/test/library-tests/properties/Properties15.ql b/csharp/ql/test/library-tests/properties/Properties15.ql
index dee05bcf559c..af729d492759 100644
--- a/csharp/ql/test/library-tests/properties/Properties15.ql
+++ b/csharp/ql/test/library-tests/properties/Properties15.ql
@@ -1,14 +1,17 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Init")
-  and p.getDeclaringType().hasQualifiedName("Properties.Test")
-  and p.isWriteOnly()
-  and not p.isAutoImplemented()
-  and p.isStatic() and p.isPrivate()
-  and p.getType() instanceof IntType
-  and p.getSetter().getStatementBody().isEmpty()
+where
+  p.hasName("Init") and
+  p.getDeclaringType().hasQualifiedName("Properties.Test") and
+  p.isWriteOnly() and
+  not p.isAutoImplemented() and
+  p.isStatic() and
+  p.isPrivate() and
+  p.getType() instanceof IntType and
+  p.getSetter().getStatementBody().isEmpty()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties16.ql b/csharp/ql/test/library-tests/properties/Properties16.ql
index e3aa3abad346..4ef2776d39ff 100644
--- a/csharp/ql/test/library-tests/properties/Properties16.ql
+++ b/csharp/ql/test/library-tests/properties/Properties16.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Init")
-  and p.getDeclaringType().hasQualifiedName("Properties.Test")
-  and p.getSetter().getNumberOfParameters() = 1
-  and p.getSetter().getParameter(0) instanceof ImplicitAccessorParameter
+where
+  p.hasName("Init") and
+  p.getDeclaringType().hasQualifiedName("Properties.Test") and
+  p.getSetter().getNumberOfParameters() = 1 and
+  p.getSetter().getParameter(0) instanceof ImplicitAccessorParameter
 select p, p.getSetter().getParameter(0)
diff --git a/csharp/ql/test/library-tests/properties/Properties17.ql b/csharp/ql/test/library-tests/properties/Properties17.ql
index ac2f355ba00c..ca53f5423aa2 100644
--- a/csharp/ql/test/library-tests/properties/Properties17.ql
+++ b/csharp/ql/test/library-tests/properties/Properties17.ql
@@ -1,9 +1,9 @@
 /**
  * @name Test that there are no backing fields
  */
+
 import csharp
 
 from Field f
 where f.fromSource()
-select f.getName() as name
-order by name
+select f.getName() as name order by name
diff --git a/csharp/ql/test/library-tests/properties/Properties18.ql b/csharp/ql/test/library-tests/properties/Properties18.ql
index 660afc86bfdc..0006aeef009c 100644
--- a/csharp/ql/test/library-tests/properties/Properties18.ql
+++ b/csharp/ql/test/library-tests/properties/Properties18.ql
@@ -1,6 +1,7 @@
 import csharp
 
 from Property property, Accessor accessor
-where property.getDeclaringType().hasName("ImplementsProperties")
-  and property.getAnAccessor() = accessor
+where
+  property.getDeclaringType().hasName("ImplementsProperties") and
+  property.getAnAccessor() = accessor
 select property, accessor
diff --git a/csharp/ql/test/library-tests/properties/Properties2.ql b/csharp/ql/test/library-tests/properties/Properties2.ql
index aeebe5cc4388..de1301442f1d 100644
--- a/csharp/ql/test/library-tests/properties/Properties2.ql
+++ b/csharp/ql/test/library-tests/properties/Properties2.ql
@@ -1,11 +1,12 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Caption")
-  and p.isReadWrite()
-  and p.isPublic()
+where
+  p.hasName("Caption") and
+  p.isReadWrite() and
+  p.isPublic()
 select p, p.getGetter(), p.getSetter()
-
diff --git a/csharp/ql/test/library-tests/properties/Properties3.ql b/csharp/ql/test/library-tests/properties/Properties3.ql
index 3ed1fc882381..a0052004c3e1 100644
--- a/csharp/ql/test/library-tests/properties/Properties3.ql
+++ b/csharp/ql/test/library-tests/properties/Properties3.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Caption")
-  and p.isReadWrite()
-  and p.isPublic()
-  and p.getGetter().getAssemblyName() = "get_Caption"
-  and p.getSetter().getAssemblyName() = "set_Caption"
+where
+  p.hasName("Caption") and
+  p.isReadWrite() and
+  p.isPublic() and
+  p.getGetter().getAssemblyName() = "get_Caption" and
+  p.getSetter().getAssemblyName() = "set_Caption"
 select p, p.getGetter(), p.getSetter()
-
diff --git a/csharp/ql/test/library-tests/properties/Properties4.ql b/csharp/ql/test/library-tests/properties/Properties4.ql
index 01c5b71b0b4e..89a0b03f5b46 100644
--- a/csharp/ql/test/library-tests/properties/Properties4.ql
+++ b/csharp/ql/test/library-tests/properties/Properties4.ql
@@ -1,14 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Next")
-  and p.isReadOnly()
-  and p.isPublic()
-  and p.getGetter().hasBody()
-  and p.getDeclaringType().hasQualifiedName("Properties.Counter")
-  and not exists(p.getSetter())
+where
+  p.hasName("Next") and
+  p.isReadOnly() and
+  p.isPublic() and
+  p.getGetter().hasBody() and
+  p.getDeclaringType().hasQualifiedName("Properties.Counter") and
+  not exists(p.getSetter())
 select p, p.getGetter()
-
diff --git a/csharp/ql/test/library-tests/properties/Properties5.ql b/csharp/ql/test/library-tests/properties/Properties5.ql
index 0d41b4e2af8b..7c86e26a5c4e 100644
--- a/csharp/ql/test/library-tests/properties/Properties5.ql
+++ b/csharp/ql/test/library-tests/properties/Properties5.ql
@@ -1,16 +1,17 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("X")
-  and p.getDeclaringType().hasQualifiedName("Properties.Point")
-  and p.isReadWrite()
-  and p.isPublic()
-  and exists(p.getGetter())
-  and not p.getGetter().hasBody()
-  and exists(p.getSetter())
-  and not p.getSetter().hasBody()
+where
+  p.hasName("X") and
+  p.getDeclaringType().hasQualifiedName("Properties.Point") and
+  p.isReadWrite() and
+  p.isPublic() and
+  exists(p.getGetter()) and
+  not p.getGetter().hasBody() and
+  exists(p.getSetter()) and
+  not p.getSetter().hasBody()
 select p
-
diff --git a/csharp/ql/test/library-tests/properties/Properties6.ql b/csharp/ql/test/library-tests/properties/Properties6.ql
index 3595cf2adee7..3e81cdc04e26 100644
--- a/csharp/ql/test/library-tests/properties/Properties6.ql
+++ b/csharp/ql/test/library-tests/properties/Properties6.ql
@@ -1,13 +1,14 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Y")
-  and p.getDeclaringType().hasQualifiedName("Properties.Point")
-  and p.isReadWrite()
-  and p.isPublic()
-  and p.isAutoImplemented()
+where
+  p.hasName("Y") and
+  p.getDeclaringType().hasQualifiedName("Properties.Point") and
+  p.isReadWrite() and
+  p.isPublic() and
+  p.isAutoImplemented()
 select p
-
diff --git a/csharp/ql/test/library-tests/properties/Properties7.ql b/csharp/ql/test/library-tests/properties/Properties7.ql
index ce46f081efd4..8ad1f8a37e35 100644
--- a/csharp/ql/test/library-tests/properties/Properties7.ql
+++ b/csharp/ql/test/library-tests/properties/Properties7.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("X")
-  and p.getDeclaringType().hasQualifiedName("Properties.ReadOnlyPoint")
-  and p.isReadWrite()
-  and p.isPublic()
-  and p.isAutoImplemented()
-  and p.getSetter().isPrivate()
+where
+  p.hasName("X") and
+  p.getDeclaringType().hasQualifiedName("Properties.ReadOnlyPoint") and
+  p.isReadWrite() and
+  p.isPublic() and
+  p.isAutoImplemented() and
+  p.getSetter().isPrivate()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties8.ql b/csharp/ql/test/library-tests/properties/Properties8.ql
index 6c72e0c7f3c5..eeb6bd41dc28 100644
--- a/csharp/ql/test/library-tests/properties/Properties8.ql
+++ b/csharp/ql/test/library-tests/properties/Properties8.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("X")
-  and p.getDeclaringType().hasQualifiedName("Properties.A")
-  and p.isReadOnly()
-  and p.isVirtual()
+where
+  p.hasName("X") and
+  p.getDeclaringType().hasQualifiedName("Properties.A") and
+  p.isReadOnly() and
+  p.isVirtual()
 select p
diff --git a/csharp/ql/test/library-tests/properties/Properties9.ql b/csharp/ql/test/library-tests/properties/Properties9.ql
index cca327171372..5b22b9d53945 100644
--- a/csharp/ql/test/library-tests/properties/Properties9.ql
+++ b/csharp/ql/test/library-tests/properties/Properties9.ql
@@ -1,14 +1,17 @@
 /**
  * @name Test for properties
  */
+
 import csharp
 
 from Property p
-where p.hasName("Z")
-  and p.getDeclaringType().hasQualifiedName("Properties.A")
-  and p.isReadWrite()
-  and not p.isAutoImplemented()
-  and p.isAbstract() and p.isPublic()
-  and not p.getGetter().hasBody()
-  and not p.getSetter().hasBody()
+where
+  p.hasName("Z") and
+  p.getDeclaringType().hasQualifiedName("Properties.A") and
+  p.isReadWrite() and
+  not p.isAutoImplemented() and
+  p.isAbstract() and
+  p.isPublic() and
+  not p.getGetter().hasBody() and
+  not p.getSetter().hasBody()
 select p
diff --git a/csharp/ql/test/library-tests/regressions/CheckExtractionSucceeded.ql b/csharp/ql/test/library-tests/regressions/CheckExtractionSucceeded.ql
index 496037a75c73..6d7b1b7b9210 100644
--- a/csharp/ql/test/library-tests/regressions/CheckExtractionSucceeded.ql
+++ b/csharp/ql/test/library-tests/regressions/CheckExtractionSucceeded.ql
@@ -1,5 +1,4 @@
 import csharp
 
 from MethodCall mc
-select mc.getLocation().getStartLine(),
-  mc, mc.getTarget().getParameter(0).getType().toString()
+select mc.getLocation().getStartLine(), mc, mc.getTarget().getParameter(0).getType().toString()
diff --git a/csharp/ql/test/library-tests/security/dataflow/flowsources/StoredFlowSources.ql b/csharp/ql/test/library-tests/security/dataflow/flowsources/StoredFlowSources.ql
index ad3a2263bb37..9e01577b3cc9 100644
--- a/csharp/ql/test/library-tests/security/dataflow/flowsources/StoredFlowSources.ql
+++ b/csharp/ql/test/library-tests/security/dataflow/flowsources/StoredFlowSources.ql
@@ -1,17 +1,11 @@
 import semmle.code.csharp.security.dataflow.flowsources.Stored
 
 class StoredConfig extends TaintTracking::Configuration {
-  StoredConfig() {
-    this = "stored"
-  }
+  StoredConfig() { this = "stored" }
 
-  override predicate isSource(DataFlow::Node s) {
-    s instanceof StoredFlowSource
-  }
+  override predicate isSource(DataFlow::Node s) { s instanceof StoredFlowSource }
 
-  override predicate isSink(DataFlow::Node s) {
-    s.asExpr().fromSource()
-  }
+  override predicate isSink(DataFlow::Node s) { s.asExpr().fromSource() }
 }
 
 from StoredConfig s, DataFlow::Node sink
diff --git a/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql b/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
index 5e659ecbc80b..ff1be0976a36 100644
--- a/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
+++ b/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
@@ -12,6 +12,4 @@ class UnknownCall extends MethodCall {
   override string toString() { result = "Call to unknown method" }
 }
 
-query predicate edges(ControlFlow::Node n1, ControlFlow::Node n2) {
-  n2 = n1.getASuccessor()
-}
+query predicate edges(ControlFlow::Node n1, ControlFlow::Node n2) { n2 = n1.getASuccessor() }
diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorCalls.ql b/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorCalls.ql
index 1e4747b00d78..87b884ff822f 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorCalls.ql
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/ErrorCalls.ql
@@ -1,16 +1,9 @@
 import csharp
 
-string elementToString(Element e)
-{
-  if exists(e.toString())
-  then result = e.toString()
-  else result = "unknown"
+string elementToString(Element e) {
+  if exists(e.toString()) then result = e.toString() else result = "unknown"
 }
 
 from Call c, string target
-where
-  if exists(c.getTarget())
-  then target = c.getTarget().toString()
-  else
-  target = "none"
+where if exists(c.getTarget()) then target = c.getTarget().toString() else target = "none"
 select c.getLocation(), elementToString(c), target
diff --git a/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.ql b/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.ql
index 7b990b607d50..5bc2995f78f2 100644
--- a/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.ql
+++ b/csharp/ql/test/library-tests/standalone/errorrecovery/Methods.ql
@@ -2,4 +2,4 @@ import csharp
 
 from Callable c
 where c.fromSource()
-select c, count(Call call | call.getTarget()=c)
+select c, count(Call call | call.getTarget() = c)
diff --git a/csharp/ql/test/library-tests/standalone/normalmode/normal.ql b/csharp/ql/test/library-tests/standalone/normalmode/normal.ql
index ad767c4e544d..7294a6f2af89 100644
--- a/csharp/ql/test/library-tests/standalone/normalmode/normal.ql
+++ b/csharp/ql/test/library-tests/standalone/normalmode/normal.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from SourceFile f, int mode
-where not f.extractedStandalone()
-and not extractionIsStandalone()
-and file_extraction_mode(f,mode)
+where
+  not f.extractedStandalone() and
+  not extractionIsStandalone() and
+  file_extraction_mode(f, mode)
 select f, mode
diff --git a/csharp/ql/test/library-tests/standalone/regressions/QualifierAccess.ql b/csharp/ql/test/library-tests/standalone/regressions/QualifierAccess.ql
index 6d4e9bebe929..c5051e6610d0 100644
--- a/csharp/ql/test/library-tests/standalone/regressions/QualifierAccess.ql
+++ b/csharp/ql/test/library-tests/standalone/regressions/QualifierAccess.ql
@@ -1,7 +1,11 @@
 import csharp
 
 from LocalVariableAccess access, string type
-where access.getTarget().hasName("x")
-  and (access instanceof LocalVariableRead and type="read" or
-       access instanceof LocalVariableWrite and type="write")
+where
+  access.getTarget().hasName("x") and
+  (
+    access instanceof LocalVariableRead and type = "read"
+    or
+    access instanceof LocalVariableWrite and type = "write"
+  )
 select access, type
diff --git a/csharp/ql/test/library-tests/standalone/standalonemode/standalone.ql b/csharp/ql/test/library-tests/standalone/standalonemode/standalone.ql
index 7badd0d44e7a..b93c87c56f4a 100644
--- a/csharp/ql/test/library-tests/standalone/standalonemode/standalone.ql
+++ b/csharp/ql/test/library-tests/standalone/standalonemode/standalone.ql
@@ -1,7 +1,8 @@
 import csharp
 
 from SourceFile f, int mode
-where f.extractedStandalone()
-and extractionIsStandalone()
-and file_extraction_mode(f, mode)
+where
+  f.extractedStandalone() and
+  extractionIsStandalone() and
+  file_extraction_mode(f, mode)
 select f, mode
diff --git a/csharp/ql/test/library-tests/statements/Block1.ql b/csharp/ql/test/library-tests/statements/Block1.ql
index 84161ecb997c..35c474b226a8 100644
--- a/csharp/ql/test/library-tests/statements/Block1.ql
+++ b/csharp/ql/test/library-tests/statements/Block1.ql
@@ -1,9 +1,15 @@
 /**
  * @name Test for exactly one body per source method
  */
+
 import csharp
 
-where forall(Method m | m.fromSource()
-                    and not m.isAbstract()
-                    and not m.isExtern() | count(m.getBody()) = 1)
+where
+  forall(Method m |
+    m.fromSource() and
+    not m.isAbstract() and
+    not m.isExtern()
+  |
+    count(m.getBody()) = 1
+  )
 select 1
diff --git a/csharp/ql/test/library-tests/statements/Block2.ql b/csharp/ql/test/library-tests/statements/Block2.ql
index 004a9b744038..c9b8e2cf5dd1 100644
--- a/csharp/ql/test/library-tests/statements/Block2.ql
+++ b/csharp/ql/test/library-tests/statements/Block2.ql
@@ -1,10 +1,11 @@
 /**
  * @name Test for labeled block statement
  */
+
 import csharp
 
 from LabeledStmt stmt
-where stmt.getLabel() = "block"
-  and stmt.getStmt() instanceof BlockStmt
+where
+  stmt.getLabel() = "block" and
+  stmt.getStmt() instanceof BlockStmt
 select 1
-
diff --git a/csharp/ql/test/library-tests/statements/Block3.ql b/csharp/ql/test/library-tests/statements/Block3.ql
index e01971ffe9d7..24358e9405f5 100644
--- a/csharp/ql/test/library-tests/statements/Block3.ql
+++ b/csharp/ql/test/library-tests/statements/Block3.ql
@@ -1,9 +1,9 @@
 /**
  * @name Test for indices of block children
  */
+
 import csharp
 
-where forall(BlockStmt b |
-         forall(int n | n in [0..b.getNumberOfStmts()-1] | exists(b.getChild(n))))
+where
+  forall(BlockStmt b | forall(int n | n in [0 .. b.getNumberOfStmts() - 1] | exists(b.getChild(n))))
 select 1
-
diff --git a/csharp/ql/test/library-tests/statements/Block4.ql b/csharp/ql/test/library-tests/statements/Block4.ql
index 6820f1862175..a8f35c572f32 100644
--- a/csharp/ql/test/library-tests/statements/Block4.ql
+++ b/csharp/ql/test/library-tests/statements/Block4.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for empty blocks
  */
+
 import csharp
 
 from Method m
-where m.getName() = "Main"
-  and count(BlockStmt b | b.getEnclosingCallable() = m and b.isEmpty()) = 2
+where
+  m.getName() = "Main" and
+  count(BlockStmt b | b.getEnclosingCallable() = m and b.isEmpty()) = 2
 select m
diff --git a/csharp/ql/test/library-tests/statements/Break1.ql b/csharp/ql/test/library-tests/statements/Break1.ql
index 515e7e7aa725..6c2206548de5 100644
--- a/csharp/ql/test/library-tests/statements/Break1.ql
+++ b/csharp/ql/test/library-tests/statements/Break1.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for breaks
  */
+
 import csharp
 
 from Method m, BreakStmt s
-where m.getName() = "MainBreak"
-  and s.getEnclosingCallable() = m
-  and s.getParent().(IfStmt).getThen() = s
+where
+  m.getName() = "MainBreak" and
+  s.getEnclosingCallable() = m and
+  s.getParent().(IfStmt).getThen() = s
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/Checked1.ql b/csharp/ql/test/library-tests/statements/Checked1.ql
index c63945702192..20eb59fe0037 100644
--- a/csharp/ql/test/library-tests/statements/Checked1.ql
+++ b/csharp/ql/test/library-tests/statements/Checked1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for checked statements
  */
+
 import csharp
 
 from Method m, CheckedStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainCheckedUnchecked"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainCheckedUnchecked"
 select s, s.getBlock()
diff --git a/csharp/ql/test/library-tests/statements/Continue1.ql b/csharp/ql/test/library-tests/statements/Continue1.ql
index a338a3eddb03..bbdfaa479942 100644
--- a/csharp/ql/test/library-tests/statements/Continue1.ql
+++ b/csharp/ql/test/library-tests/statements/Continue1.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for continues
  */
+
 import csharp
 
 from Method m, ContinueStmt s
-where m.getName() = "MainContinue"
-  and s.getEnclosingCallable() = m
-  and s.getParent().(IfStmt).getThen() = s
+where
+  m.getName() = "MainContinue" and
+  s.getEnclosingCallable() = m and
+  s.getParent().(IfStmt).getThen() = s
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/Do1.ql b/csharp/ql/test/library-tests/statements/Do1.ql
index 6829d74d8f5a..42a2415a219c 100644
--- a/csharp/ql/test/library-tests/statements/Do1.ql
+++ b/csharp/ql/test/library-tests/statements/Do1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for well-formed dos
  */
+
 import csharp
 
 where forall(DoStmt s | exists(s.getCondition()) and exists(s.getBody()))
diff --git a/csharp/ql/test/library-tests/statements/Do2.ql b/csharp/ql/test/library-tests/statements/Do2.ql
index 4b5ec3f5c475..bac2015852e2 100644
--- a/csharp/ql/test/library-tests/statements/Do2.ql
+++ b/csharp/ql/test/library-tests/statements/Do2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for dos
  */
+
 import csharp
 
 from Method m, DoStmt s
-where m.getName() = "MainDo"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainDo" and
+  s.getEnclosingCallable() = m
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/Expr1.ql b/csharp/ql/test/library-tests/statements/Expr1.ql
index 3b40351690e8..738aa33f7366 100644
--- a/csharp/ql/test/library-tests/statements/Expr1.ql
+++ b/csharp/ql/test/library-tests/statements/Expr1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for expression statements
  */
+
 import csharp
 
 from Method m
-where m.getName() = "MainExpr"
-  and count(ExprStmt s | s.getEnclosingCallable() = m) = 4
+where
+  m.getName() = "MainExpr" and
+  count(ExprStmt s | s.getEnclosingCallable() = m) = 4
 select m
diff --git a/csharp/ql/test/library-tests/statements/Fixed2.ql b/csharp/ql/test/library-tests/statements/Fixed2.ql
index 4f7b46a743cc..a4f338a59955 100644
--- a/csharp/ql/test/library-tests/statements/Fixed2.ql
+++ b/csharp/ql/test/library-tests/statements/Fixed2.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from FixedStmt fixed, LocalVariableDeclExpr decl
-where decl=fixed.getAVariableDeclExpr()
+where decl = fixed.getAVariableDeclExpr()
 select fixed, decl, decl.getVariable(), decl.getInitializer()
diff --git a/csharp/ql/test/library-tests/statements/For1.ql b/csharp/ql/test/library-tests/statements/For1.ql
index 83bd164a3eac..bf4e93421e40 100644
--- a/csharp/ql/test/library-tests/statements/For1.ql
+++ b/csharp/ql/test/library-tests/statements/For1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for well-formed fors
  */
+
 import csharp
 
 where forall(ForStmt s | exists(s.getBody()))
diff --git a/csharp/ql/test/library-tests/statements/For2.ql b/csharp/ql/test/library-tests/statements/For2.ql
index 3f0ec6331ada..00feb4302195 100644
--- a/csharp/ql/test/library-tests/statements/For2.ql
+++ b/csharp/ql/test/library-tests/statements/For2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for well-formed fors
  */
+
 import csharp
 
 from Method m, ForStmt s
-where m.getName() = "MainFor"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainFor" and
+  s.getEnclosingCallable() = m
 select s, s.getCondition()
diff --git a/csharp/ql/test/library-tests/statements/For3.ql b/csharp/ql/test/library-tests/statements/For3.ql
index bc78b54f31d3..bd3ee86cd5c0 100644
--- a/csharp/ql/test/library-tests/statements/For3.ql
+++ b/csharp/ql/test/library-tests/statements/For3.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for well-formed fors
  */
+
 import csharp
 
 from Method m, ForStmt s
-where m.getName() = "MainFor"
-  and s.getEnclosingCallable() = m
-  and count(s.getAnUpdate()) = 1
+where
+  m.getName() = "MainFor" and
+  s.getEnclosingCallable() = m and
+  count(s.getAnUpdate()) = 1
 select s, s.getUpdate(0)
diff --git a/csharp/ql/test/library-tests/statements/For4.ql b/csharp/ql/test/library-tests/statements/For4.ql
index b7f3ca32415f..eb9c612874bc 100644
--- a/csharp/ql/test/library-tests/statements/For4.ql
+++ b/csharp/ql/test/library-tests/statements/For4.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for well-formed fors
  */
+
 import csharp
 
 from Method m, ForStmt s
-where m.getName() = "MainFor"
-  and s.getEnclosingCallable() = m
-  and count(s.getAnInitializer()) = 1
+where
+  m.getName() = "MainFor" and
+  s.getEnclosingCallable() = m and
+  count(s.getAnInitializer()) = 1
 select s, s.getInitializer(0)
diff --git a/csharp/ql/test/library-tests/statements/Foreach1.ql b/csharp/ql/test/library-tests/statements/Foreach1.ql
index 8e91b048fade..3f70956d9ca6 100644
--- a/csharp/ql/test/library-tests/statements/Foreach1.ql
+++ b/csharp/ql/test/library-tests/statements/Foreach1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for well-formed foreachs
  */
+
 import csharp
 
 where forall(ForeachStmt s | exists(s.getBody()) and exists(s.getIterableExpr()))
diff --git a/csharp/ql/test/library-tests/statements/Foreach2.ql b/csharp/ql/test/library-tests/statements/Foreach2.ql
index 22b69dd791bc..8a3987b03fb4 100644
--- a/csharp/ql/test/library-tests/statements/Foreach2.ql
+++ b/csharp/ql/test/library-tests/statements/Foreach2.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for well-formed foreachs
  */
+
 import csharp
 
 from Method m
-where m.getName() = "MainForeach"
-  and count(LocalVariable v | v.getVariableDeclExpr().getEnclosingCallable() = m
-                          and v.getName() = "s") = 1
+where
+  m.getName() = "MainForeach" and
+  count(LocalVariable v |
+    v.getVariableDeclExpr().getEnclosingCallable() = m and
+    v.getName() = "s"
+  ) = 1
 select m
diff --git a/csharp/ql/test/library-tests/statements/Foreach3.ql b/csharp/ql/test/library-tests/statements/Foreach3.ql
index 1c7e45d4f33e..9dfe5ba6a4e9 100644
--- a/csharp/ql/test/library-tests/statements/Foreach3.ql
+++ b/csharp/ql/test/library-tests/statements/Foreach3.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for well-formed foreachs
  */
+
 import csharp
 
 from Method m, ForeachStmt s
-where m.getName() = "MainForeach"
-  and s.getEnclosingCallable() = m
-  and s.getVariable().getName() = "s"
-  and s.getVariable().getType() instanceof StringType
+where
+  m.getName() = "MainForeach" and
+  s.getEnclosingCallable() = m and
+  s.getVariable().getName() = "s" and
+  s.getVariable().getType() instanceof StringType
 select s, s.getVariable()
diff --git a/csharp/ql/test/library-tests/statements/Goto1.ql b/csharp/ql/test/library-tests/statements/Goto1.ql
index d868c260bfe3..f1dd67fc0e28 100644
--- a/csharp/ql/test/library-tests/statements/Goto1.ql
+++ b/csharp/ql/test/library-tests/statements/Goto1.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for gotos
  */
+
 import csharp
 
 from Method m, GotoLabelStmt s
-where m.getName() = "MainGoto"
-  and s.getLabel() = "check"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainGoto" and
+  s.getLabel() = "check" and
+  s.getEnclosingCallable() = m
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/Goto2.ql b/csharp/ql/test/library-tests/statements/Goto2.ql
index 95b13d2e6dc8..0d063d4be86a 100644
--- a/csharp/ql/test/library-tests/statements/Goto2.ql
+++ b/csharp/ql/test/library-tests/statements/Goto2.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for continues
  */
+
 import csharp
 
 from Method m, GotoLabelStmt s
-where m.getName() = "MainGoto"
-  and s.getLabel() = "loop"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainGoto" and
+  s.getLabel() = "loop" and
+  s.getEnclosingCallable() = m
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/If1.ql b/csharp/ql/test/library-tests/statements/If1.ql
index 2d2547c41eeb..cdf080ccc294 100644
--- a/csharp/ql/test/library-tests/statements/If1.ql
+++ b/csharp/ql/test/library-tests/statements/If1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for well-formed ifs
  */
+
 import csharp
 
 where forall(IfStmt m | exists(m.getCondition()) and exists(m.getThen()))
diff --git a/csharp/ql/test/library-tests/statements/If2.ql b/csharp/ql/test/library-tests/statements/If2.ql
index b0e902d4c3f5..5c76cdb72ffa 100644
--- a/csharp/ql/test/library-tests/statements/If2.ql
+++ b/csharp/ql/test/library-tests/statements/If2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for else branch
  */
+
 import csharp
 
 from Method m, IfStmt i
-where m.getName() = "MainIf"
-  and i = m.getBody().getChild(0)
-select i, (BlockStmt)i.getElse()
+where
+  m.getName() = "MainIf" and
+  i = m.getBody().getChild(0)
+select i, i.getElse().(BlockStmt)
diff --git a/csharp/ql/test/library-tests/statements/Labeled1.ql b/csharp/ql/test/library-tests/statements/Labeled1.ql
index 74bfaa22c874..38439ad24925 100644
--- a/csharp/ql/test/library-tests/statements/Labeled1.ql
+++ b/csharp/ql/test/library-tests/statements/Labeled1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for labeled statements
  */
+
 import csharp
 
 from Method m, LabeledStmt s
-where m.getName() = "MainLabeled"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainLabeled" and
+  s.getEnclosingCallable() = m
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/LocalConstDecl1.ql b/csharp/ql/test/library-tests/statements/LocalConstDecl1.ql
index 96e38aa96d03..d8edf6b81630 100644
--- a/csharp/ql/test/library-tests/statements/LocalConstDecl1.ql
+++ b/csharp/ql/test/library-tests/statements/LocalConstDecl1.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalConstantDeclStmt s, LocalConstantDeclExpr e
-where m.getName() = "MainLocalConstDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "pi"
-  and e.getVariable().getType() instanceof FloatType
-  and e.getInitializer() instanceof FloatLiteral
-  and e.getVariable().getValue() = "3.141593"
+where
+  m.getName() = "MainLocalConstDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "pi" and
+  e.getVariable().getType() instanceof FloatType and
+  e.getInitializer() instanceof FloatLiteral and
+  e.getVariable().getValue() = "3.141593"
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalConstDecl2.ql b/csharp/ql/test/library-tests/statements/LocalConstDecl2.ql
index 399154e3995a..3809a0996fd6 100644
--- a/csharp/ql/test/library-tests/statements/LocalConstDecl2.ql
+++ b/csharp/ql/test/library-tests/statements/LocalConstDecl2.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalConstantDeclStmt s, LocalConstantDeclExpr e
-where m.getName() = "MainLocalConstDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "r"
-  and e.getVariable().getType() instanceof IntType
-  and e.getVariable().getValue() = "25"
+where
+  m.getName() = "MainLocalConstDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "r" and
+  e.getVariable().getType() instanceof IntType and
+  e.getVariable().getValue() = "25"
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalConstDecl3.ql b/csharp/ql/test/library-tests/statements/LocalConstDecl3.ql
index b9beb2af9941..bbad51b62a60 100644
--- a/csharp/ql/test/library-tests/statements/LocalConstDecl3.ql
+++ b/csharp/ql/test/library-tests/statements/LocalConstDecl3.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalConstantDeclStmt s, LocalConstantDeclExpr e
-where m.getName() = "MainLocalConstDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "r"
-  and e.getVariable().getInitializer() instanceof AddExpr
+where
+  m.getName() = "MainLocalConstDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "r" and
+  e.getVariable().getInitializer() instanceof AddExpr
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalVarDecl1.ql b/csharp/ql/test/library-tests/statements/LocalVarDecl1.ql
index 678ae3394d01..570fd0f254b8 100644
--- a/csharp/ql/test/library-tests/statements/LocalVarDecl1.ql
+++ b/csharp/ql/test/library-tests/statements/LocalVarDecl1.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalVariableDeclStmt s, LocalVariableDeclExpr e
-where m.getName() = "MainLocalVarDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "a"
-  and not e.getVariable().isImplicitlyTyped()
+where
+  m.getName() = "MainLocalVarDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "a" and
+  not e.getVariable().isImplicitlyTyped()
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalVarDecl2.ql b/csharp/ql/test/library-tests/statements/LocalVarDecl2.ql
index 007cf374c33c..fd54c72e53c4 100644
--- a/csharp/ql/test/library-tests/statements/LocalVarDecl2.ql
+++ b/csharp/ql/test/library-tests/statements/LocalVarDecl2.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalVariableDeclStmt s, LocalVariableDeclExpr e
-where m.getName() = "MainLocalVarDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "b"
-  and e.getInitializer() instanceof IntLiteral
+where
+  m.getName() = "MainLocalVarDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "b" and
+  e.getInitializer() instanceof IntLiteral
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalVarDecl3.ql b/csharp/ql/test/library-tests/statements/LocalVarDecl3.ql
index b5bf3d4fce42..2fd64d311f0f 100644
--- a/csharp/ql/test/library-tests/statements/LocalVarDecl3.ql
+++ b/csharp/ql/test/library-tests/statements/LocalVarDecl3.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalVariableDeclStmt s, LocalVariableDeclExpr b, LocalVariableDeclExpr c
-where m.getName() = "MainLocalVarDecl"
-  and s.getEnclosingCallable() = m
-  and s.getVariableDeclExpr(0) = b
-  and b.getVariable().getName() = "b"
-  and s.getVariableDeclExpr(1) = c
-  and c.getVariable().getName() = "c"
+where
+  m.getName() = "MainLocalVarDecl" and
+  s.getEnclosingCallable() = m and
+  s.getVariableDeclExpr(0) = b and
+  b.getVariable().getName() = "b" and
+  s.getVariableDeclExpr(1) = c and
+  c.getVariable().getName() = "c"
 select m, s, b, c
diff --git a/csharp/ql/test/library-tests/statements/LocalVarDecl4.ql b/csharp/ql/test/library-tests/statements/LocalVarDecl4.ql
index 85a9280fe0b3..12959869d527 100644
--- a/csharp/ql/test/library-tests/statements/LocalVarDecl4.ql
+++ b/csharp/ql/test/library-tests/statements/LocalVarDecl4.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalVariableDeclStmt s, LocalVariableDeclExpr e
-where m.getName() = "MainLocalVarDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "a"
-  and e.getVariable().getType() instanceof IntType
+where
+  m.getName() = "MainLocalVarDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "a" and
+  e.getVariable().getType() instanceof IntType
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/LocalVarDecl5.ql b/csharp/ql/test/library-tests/statements/LocalVarDecl5.ql
index 9da1bd65cbed..c492dfaec9d0 100644
--- a/csharp/ql/test/library-tests/statements/LocalVarDecl5.ql
+++ b/csharp/ql/test/library-tests/statements/LocalVarDecl5.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for local variable declaration statement
  */
+
 import csharp
 
 from Method m, LocalVariableDeclStmt s, LocalVariableDeclExpr e
-where m.getName() = "MainLocalVarDecl"
-  and s.getEnclosingCallable() = m
-  and s.getAVariableDeclExpr() = e
-  and e.getVariable().getName() = "y"
-  and e.getVariable().getType() instanceof StringType
-  and e.getVariable().isImplicitlyTyped()
+where
+  m.getName() = "MainLocalVarDecl" and
+  s.getEnclosingCallable() = m and
+  s.getAVariableDeclExpr() = e and
+  e.getVariable().getName() = "y" and
+  e.getVariable().getType() instanceof StringType and
+  e.getVariable().isImplicitlyTyped()
 select m, s, e
diff --git a/csharp/ql/test/library-tests/statements/Lock1.ql b/csharp/ql/test/library-tests/statements/Lock1.ql
index c79c6ff62313..cade5d3bcab2 100644
--- a/csharp/ql/test/library-tests/statements/Lock1.ql
+++ b/csharp/ql/test/library-tests/statements/Lock1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for locks
  */
+
 import csharp
 
 where forall(LockStmt s | exists(s.getExpr()) and exists(s.getBlock()))
diff --git a/csharp/ql/test/library-tests/statements/Lock2.ql b/csharp/ql/test/library-tests/statements/Lock2.ql
index 96a3ab06ea23..b6223b39a192 100644
--- a/csharp/ql/test/library-tests/statements/Lock2.ql
+++ b/csharp/ql/test/library-tests/statements/Lock2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for locks
  */
+
 import csharp
 
 from Method m, LockStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "Withdraw"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "Withdraw"
 select s, s.getExpr(), s.getBlock()
diff --git a/csharp/ql/test/library-tests/statements/Return1.ql b/csharp/ql/test/library-tests/statements/Return1.ql
index c83e9e9020a1..51b8ba46780e 100644
--- a/csharp/ql/test/library-tests/statements/Return1.ql
+++ b/csharp/ql/test/library-tests/statements/Return1.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for continues
  */
+
 import csharp
 
 from Method m, ReturnStmt s
-where m.getName() = "MainReturn"
-  and s = m.getBody().getChild(1)
-  and s.getEnclosingCallable() = m
-  and not exists(s.getExpr())
+where
+  m.getName() = "MainReturn" and
+  s = m.getBody().getChild(1) and
+  s.getEnclosingCallable() = m and
+  not exists(s.getExpr())
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/Return2.ql b/csharp/ql/test/library-tests/statements/Return2.ql
index d304bc0a6b5a..172e4d5ac556 100644
--- a/csharp/ql/test/library-tests/statements/Return2.ql
+++ b/csharp/ql/test/library-tests/statements/Return2.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for continues
  */
+
 import csharp
 
 from Method m, ReturnStmt s
-where m.getName() = "Add"
-  and s = m.getBody().getChild(0)
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "Add" and
+  s = m.getBody().getChild(0) and
+  s.getEnclosingCallable() = m
 select m, s, s.getExpr()
diff --git a/csharp/ql/test/library-tests/statements/Switch1.ql b/csharp/ql/test/library-tests/statements/Switch1.ql
index 35672bf2965b..9ee1bcb6907d 100644
--- a/csharp/ql/test/library-tests/statements/Switch1.ql
+++ b/csharp/ql/test/library-tests/statements/Switch1.ql
@@ -1,7 +1,9 @@
 /**
  * @name Test for well-formed switches
  */
+
 import csharp
 
 from SwitchStmt s
-select s, s.getCondition(), count(s.getAConstCase()), count(s.getDefaultCase()), count(s.getAChildStmt())
+select s, s.getCondition(), count(s.getAConstCase()), count(s.getDefaultCase()),
+  count(s.getAChildStmt())
diff --git a/csharp/ql/test/library-tests/statements/Switch2.ql b/csharp/ql/test/library-tests/statements/Switch2.ql
index 12b574a16a86..b51ab454a1ae 100644
--- a/csharp/ql/test/library-tests/statements/Switch2.ql
+++ b/csharp/ql/test/library-tests/statements/Switch2.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for switch cases
  */
+
 import csharp
 
 from Method m, SwitchStmt s
diff --git a/csharp/ql/test/library-tests/statements/Switch3.ql b/csharp/ql/test/library-tests/statements/Switch3.ql
index bc2cf8ffc021..e2cdf438bef7 100644
--- a/csharp/ql/test/library-tests/statements/Switch3.ql
+++ b/csharp/ql/test/library-tests/statements/Switch3.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for default switch cases
  */
+
 import csharp
 
 from Method m, SwitchStmt s
diff --git a/csharp/ql/test/library-tests/statements/Switch4.ql b/csharp/ql/test/library-tests/statements/Switch4.ql
index cfd2820a2f56..742190ad4d52 100644
--- a/csharp/ql/test/library-tests/statements/Switch4.ql
+++ b/csharp/ql/test/library-tests/statements/Switch4.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test the implicit switch field isn't populated.
  */
+
 import csharp
 
 from Field f
diff --git a/csharp/ql/test/library-tests/statements/Throw1.ql b/csharp/ql/test/library-tests/statements/Throw1.ql
index 8f6b1f94b23b..e695776e57a2 100644
--- a/csharp/ql/test/library-tests/statements/Throw1.ql
+++ b/csharp/ql/test/library-tests/statements/Throw1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for throws
  */
+
 import csharp
 
 from Method m, ThrowStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "Divide"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "Divide"
 select 1, s.getExpr()
diff --git a/csharp/ql/test/library-tests/statements/TryCatch1.ql b/csharp/ql/test/library-tests/statements/TryCatch1.ql
index 9abfc0982b9c..291da5f9a337 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch1.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch1.ql
@@ -1,8 +1,12 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
-where forall (TryStmt s | exists(s.getBlock()) and
- (exists(s.getACatchClause()) or exists(s.getFinally())))
+where
+  forall(TryStmt s |
+    exists(s.getBlock()) and
+    (exists(s.getACatchClause()) or exists(s.getFinally()))
+  )
 select 1
diff --git a/csharp/ql/test/library-tests/statements/TryCatch2.ql b/csharp/ql/test/library-tests/statements/TryCatch2.ql
index b1220acac522..e20de0e5274e 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch2.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch2.ql
@@ -1,10 +1,12 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and count(s.getACatchClause()) = 2
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  count(s.getACatchClause()) = 2
 select s, s.getACatchClause()
diff --git a/csharp/ql/test/library-tests/statements/TryCatch3.ql b/csharp/ql/test/library-tests/statements/TryCatch3.ql
index 44f339c44c50..4b0b12e98a99 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch3.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch3.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and count((GeneralCatchClause)s.getACatchClause()) = 1
-  and count((SpecificCatchClause)s.getACatchClause()) = 1
-  and s.getCatchClause(0) instanceof SpecificCatchClause
-  and s.getCatchClause(1) instanceof GeneralCatchClause
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  count(s.getACatchClause().(GeneralCatchClause)) = 1 and
+  count(s.getACatchClause().(SpecificCatchClause)) = 1 and
+  s.getCatchClause(0) instanceof SpecificCatchClause and
+  s.getCatchClause(1) instanceof GeneralCatchClause
 select s, s.getACatchClause()
diff --git a/csharp/ql/test/library-tests/statements/TryCatch4.ql b/csharp/ql/test/library-tests/statements/TryCatch4.ql
index a168a79649ce..85cd639d8410 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch4.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch4.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s, SpecificCatchClause c
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and s.getCatchClause(0) = c
-  and c.getCaughtExceptionType().getName() = "Exception"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  s.getCatchClause(0) = c and
+  c.getCaughtExceptionType().getName() = "Exception"
 select c, c.getCaughtExceptionType().toString()
diff --git a/csharp/ql/test/library-tests/statements/TryCatch5.ql b/csharp/ql/test/library-tests/statements/TryCatch5.ql
index 5b2920e7a7fa..d970f353701d 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch5.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch5.ql
@@ -1,13 +1,15 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s, SpecificCatchClause c, LocalVariable v
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and s.getCatchClause(0) = c
-  and c.getVariable() = v
-  and v.getName() = "e"
-  and v.getType().getName() = "Exception"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  s.getCatchClause(0) = c and
+  c.getVariable() = v and
+  v.getName() = "e" and
+  v.getType().getName() = "Exception"
 select c, c.getCaughtExceptionType().toString()
diff --git a/csharp/ql/test/library-tests/statements/TryCatch6.ql b/csharp/ql/test/library-tests/statements/TryCatch6.ql
index dbe49ca0c288..e77a88cae939 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch6.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch6.ql
@@ -1,14 +1,16 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s, LocalVariable v, LocalVariableAccess a
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and s.getCatchClause(0).(SpecificCatchClause).getVariable() = v
-  and v.getName() = "e"
-  and v.getType().getName() = "Exception"
-  and a.getTarget() = v
-  and a.getEnclosingStmt().getParent() = s.getCatchClause(0).getBlock()
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  s.getCatchClause(0).(SpecificCatchClause).getVariable() = v and
+  v.getName() = "e" and
+  v.getType().getName() = "Exception" and
+  a.getTarget() = v and
+  a.getEnclosingStmt().getParent() = s.getCatchClause(0).getBlock()
 select v, a
diff --git a/csharp/ql/test/library-tests/statements/TryCatch7.ql b/csharp/ql/test/library-tests/statements/TryCatch7.ql
index f233b6e10910..71bb20d68c9c 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch7.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch7.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m
-where m.getName() = "MainTryThrow"
-  and count(LocalVariable v | v.getEnclosingCallable() = m
-                          and v.getName() = "e") = 1
+where
+  m.getName() = "MainTryThrow" and
+  count(LocalVariable v |
+    v.getEnclosingCallable() = m and
+    v.getName() = "e"
+  ) = 1
 select m
diff --git a/csharp/ql/test/library-tests/statements/TryCatch8.ql b/csharp/ql/test/library-tests/statements/TryCatch8.ql
index 467d83eee28b..95b6fde541de 100644
--- a/csharp/ql/test/library-tests/statements/TryCatch8.ql
+++ b/csharp/ql/test/library-tests/statements/TryCatch8.ql
@@ -1,11 +1,13 @@
 /**
  * @name Test for try catches
  */
+
 import csharp
 
 from Method m, TryStmt s, GeneralCatchClause c
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
-  and s.getCatchClause(1) = c
-  and c.getCaughtExceptionType().getName() = "Exception"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow" and
+  s.getCatchClause(1) = c and
+  c.getCaughtExceptionType().getName() = "Exception"
 select c, c.getCaughtExceptionType().toString()
diff --git a/csharp/ql/test/library-tests/statements/TryFinally1.ql b/csharp/ql/test/library-tests/statements/TryFinally1.ql
index 898967dc01ce..6949e751def3 100644
--- a/csharp/ql/test/library-tests/statements/TryFinally1.ql
+++ b/csharp/ql/test/library-tests/statements/TryFinally1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for try finallys
  */
+
 import csharp
 
 from Method m, TryStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainTryThrow"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainTryThrow"
 select s.getFinally()
diff --git a/csharp/ql/test/library-tests/statements/Unchecked1.ql b/csharp/ql/test/library-tests/statements/Unchecked1.ql
index 187545239145..78bbef048bef 100644
--- a/csharp/ql/test/library-tests/statements/Unchecked1.ql
+++ b/csharp/ql/test/library-tests/statements/Unchecked1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for unchecked statements
  */
+
 import csharp
 
 from Method m, UncheckedStmt s
-where s.getEnclosingCallable() = m
-  and m.getName() = "MainCheckedUnchecked"
+where
+  s.getEnclosingCallable() = m and
+  m.getName() = "MainCheckedUnchecked"
 select s, s.getBlock()
diff --git a/csharp/ql/test/library-tests/statements/Using1.ql b/csharp/ql/test/library-tests/statements/Using1.ql
index 1be4e98cf2f4..7274aa4a0e07 100644
--- a/csharp/ql/test/library-tests/statements/Using1.ql
+++ b/csharp/ql/test/library-tests/statements/Using1.ql
@@ -1,8 +1,12 @@
 /**
  * @name Test for usings
  */
+
 import csharp
 
-where forall(UsingStmt s | exists(s.getAnExpr())
-          and exists(s.getBody()))
+where
+  forall(UsingStmt s |
+    exists(s.getAnExpr()) and
+    exists(s.getBody())
+  )
 select 1
diff --git a/csharp/ql/test/library-tests/statements/Using2.ql b/csharp/ql/test/library-tests/statements/Using2.ql
index d55e6f547cb6..ab73e2c50005 100644
--- a/csharp/ql/test/library-tests/statements/Using2.ql
+++ b/csharp/ql/test/library-tests/statements/Using2.ql
@@ -1,10 +1,14 @@
 /**
  * @name Test for usings
  */
+
 import csharp
 
 from Method m
-where m.hasName("MainUsing")
-  and count(LocalVariable v | v.getVariableDeclExpr().getEnclosingCallable() = m
-                          and v.hasName("w")) = 1
+where
+  m.hasName("MainUsing") and
+  count(LocalVariable v |
+    v.getVariableDeclExpr().getEnclosingCallable() = m and
+    v.hasName("w")
+  ) = 1
 select m
diff --git a/csharp/ql/test/library-tests/statements/Using3.ql b/csharp/ql/test/library-tests/statements/Using3.ql
index c7218980dc1a..511eb9661274 100644
--- a/csharp/ql/test/library-tests/statements/Using3.ql
+++ b/csharp/ql/test/library-tests/statements/Using3.ql
@@ -1,12 +1,14 @@
 /**
  * @name Test for usings
  */
+
 import csharp
 
 from Method m, LocalVariable v
-where m.hasName("MainUsing")
-  and v.getVariableDeclExpr().getEnclosingCallable() = m
-  and v.getVariableDeclExpr().getParent() instanceof UsingStmt
-  and v.hasName("w")
-  and v.getType().hasName("TextWriter")
+where
+  m.hasName("MainUsing") and
+  v.getVariableDeclExpr().getEnclosingCallable() = m and
+  v.getVariableDeclExpr().getParent() instanceof UsingStmt and
+  v.hasName("w") and
+  v.getType().hasName("TextWriter")
 select m, v
diff --git a/csharp/ql/test/library-tests/statements/While1.ql b/csharp/ql/test/library-tests/statements/While1.ql
index a6dfa43d8760..caa9f58c180a 100644
--- a/csharp/ql/test/library-tests/statements/While1.ql
+++ b/csharp/ql/test/library-tests/statements/While1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for well-formed whiles
  */
+
 import csharp
 
 where forall(WhileStmt s | exists(s.getCondition()) and exists(s.getBody()))
diff --git a/csharp/ql/test/library-tests/statements/While2.ql b/csharp/ql/test/library-tests/statements/While2.ql
index 53f5bbd930a8..d9775b4d9177 100644
--- a/csharp/ql/test/library-tests/statements/While2.ql
+++ b/csharp/ql/test/library-tests/statements/While2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for whiles
  */
+
 import csharp
 
 from Method m, WhileStmt s
-where m.getName() = "MainWhile"
-  and s.getEnclosingCallable() = m
+where
+  m.getName() = "MainWhile" and
+  s.getEnclosingCallable() = m
 select m, s
diff --git a/csharp/ql/test/library-tests/statements/YieldBreak1.ql b/csharp/ql/test/library-tests/statements/YieldBreak1.ql
index 96b925e90726..123b5aa8f08f 100644
--- a/csharp/ql/test/library-tests/statements/YieldBreak1.ql
+++ b/csharp/ql/test/library-tests/statements/YieldBreak1.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for yield breaks
  */
+
 import csharp
 
 from Method m, YieldBreakStmt yr
-where yr.getEnclosingCallable() = m
-  and m.getName() = "Range"
+where
+  yr.getEnclosingCallable() = m and
+  m.getName() = "Range"
 select 1
diff --git a/csharp/ql/test/library-tests/statements/YieldReturn1.ql b/csharp/ql/test/library-tests/statements/YieldReturn1.ql
index ef33f1e98474..b6c2ba37ce3b 100644
--- a/csharp/ql/test/library-tests/statements/YieldReturn1.ql
+++ b/csharp/ql/test/library-tests/statements/YieldReturn1.ql
@@ -1,6 +1,7 @@
 /**
  * @name Test for yield returns
  */
+
 import csharp
 
 where forex(YieldReturnStmt yr | exists(yr.getExpr()))
diff --git a/csharp/ql/test/library-tests/statements/YieldReturn2.ql b/csharp/ql/test/library-tests/statements/YieldReturn2.ql
index 56e56d1d39f3..a65a8e358a19 100644
--- a/csharp/ql/test/library-tests/statements/YieldReturn2.ql
+++ b/csharp/ql/test/library-tests/statements/YieldReturn2.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test for yield returns
  */
+
 import csharp
 
 from Method m, YieldReturnStmt yr
-where yr.getEnclosingCallable() = m
-  and m.getName() = "Range"
+where
+  yr.getEnclosingCallable() = m and
+  m.getName() = "Range"
 select 1
diff --git a/csharp/ql/test/library-tests/statements/YieldReturn3.ql b/csharp/ql/test/library-tests/statements/YieldReturn3.ql
index 288917d02ed1..80c0cebb8c1f 100644
--- a/csharp/ql/test/library-tests/statements/YieldReturn3.ql
+++ b/csharp/ql/test/library-tests/statements/YieldReturn3.ql
@@ -1,9 +1,11 @@
 /**
  * @name Test yielded expressions
  */
+
 import csharp
 
 from YieldReturnStmt yr, LocalVariable i
-where yr.getExpr() = i.getAnAccess()
-  and i.getName() = "i"
+where
+  yr.getExpr() = i.getAnAccess() and
+  i.getName() = "i"
 select 1
diff --git a/csharp/ql/test/library-tests/types/Types1.ql b/csharp/ql/test/library-tests/types/Types1.ql
index 8c447356419c..71dad941b407 100644
--- a/csharp/ql/test/library-tests/types/Types1.ql
+++ b/csharp/ql/test/library-tests/types/Types1.ql
@@ -2,9 +2,11 @@
  * @name Test for bool type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "BoolType"
-  and m.getReturnType() instanceof BoolType
+where
+  m.getName() = "BoolType" and
+  m.getReturnType() instanceof BoolType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types10.ql b/csharp/ql/test/library-tests/types/Types10.ql
index 9683b879e4f8..d2e43249d04d 100644
--- a/csharp/ql/test/library-tests/types/Types10.ql
+++ b/csharp/ql/test/library-tests/types/Types10.ql
@@ -2,9 +2,11 @@
  * @name Test for uint type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "UIntType"
-  and m.getReturnType() instanceof UIntType
+where
+  m.getName() = "UIntType" and
+  m.getReturnType() instanceof UIntType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types11.ql b/csharp/ql/test/library-tests/types/Types11.ql
index 48552bb10bfe..bc5b3f04a478 100644
--- a/csharp/ql/test/library-tests/types/Types11.ql
+++ b/csharp/ql/test/library-tests/types/Types11.ql
@@ -2,9 +2,11 @@
  * @name Test for ulong type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ULongType"
-  and m.getReturnType() instanceof ULongType
+where
+  m.getName() = "ULongType" and
+  m.getReturnType() instanceof ULongType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types12.ql b/csharp/ql/test/library-tests/types/Types12.ql
index 9d2a745ce2d0..b9dd6f2f6cdf 100644
--- a/csharp/ql/test/library-tests/types/Types12.ql
+++ b/csharp/ql/test/library-tests/types/Types12.ql
@@ -2,9 +2,11 @@
  * @name Test for float type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "FloatType"
-  and m.getReturnType() instanceof FloatType
+where
+  m.getName() = "FloatType" and
+  m.getReturnType() instanceof FloatType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types13.ql b/csharp/ql/test/library-tests/types/Types13.ql
index a78c70884e82..19c803a8c827 100644
--- a/csharp/ql/test/library-tests/types/Types13.ql
+++ b/csharp/ql/test/library-tests/types/Types13.ql
@@ -2,9 +2,11 @@
  * @name Test for double type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "DoubleType"
-  and m.getReturnType() instanceof DoubleType
+where
+  m.getName() = "DoubleType" and
+  m.getReturnType() instanceof DoubleType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types14.ql b/csharp/ql/test/library-tests/types/Types14.ql
index 6e9ee20ebbe9..8a251ee4e0d2 100644
--- a/csharp/ql/test/library-tests/types/Types14.ql
+++ b/csharp/ql/test/library-tests/types/Types14.ql
@@ -2,9 +2,11 @@
  * @name Test for nullable type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "NullableType"
-  and m.getReturnType() instanceof NullableType
+where
+  m.getName() = "NullableType" and
+  m.getReturnType() instanceof NullableType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types15.ql b/csharp/ql/test/library-tests/types/Types15.ql
index 52870058578f..5ff4e392e111 100644
--- a/csharp/ql/test/library-tests/types/Types15.ql
+++ b/csharp/ql/test/library-tests/types/Types15.ql
@@ -2,9 +2,11 @@
  * @name Test for void type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "VoidType"
-  and m.getReturnType() instanceof VoidType
+where
+  m.getName() = "VoidType" and
+  m.getReturnType() instanceof VoidType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types16.ql b/csharp/ql/test/library-tests/types/Types16.ql
index b92a91e8fd57..ba6efa28d8e6 100644
--- a/csharp/ql/test/library-tests/types/Types16.ql
+++ b/csharp/ql/test/library-tests/types/Types16.ql
@@ -2,9 +2,11 @@
  * @name Test for array type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ArrayType"
-  and m.getReturnType() instanceof ArrayType
+where
+  m.getName() = "ArrayType" and
+  m.getReturnType() instanceof ArrayType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types17.ql b/csharp/ql/test/library-tests/types/Types17.ql
index 127f38f837bf..80c0b783a536 100644
--- a/csharp/ql/test/library-tests/types/Types17.ql
+++ b/csharp/ql/test/library-tests/types/Types17.ql
@@ -2,6 +2,7 @@
  * @name Test for enum type
  * @kind table
  */
+
 import csharp
 
 from Enum e
diff --git a/csharp/ql/test/library-tests/types/Types18.ql b/csharp/ql/test/library-tests/types/Types18.ql
index cbc4cdf9e025..3d15ac88d277 100644
--- a/csharp/ql/test/library-tests/types/Types18.ql
+++ b/csharp/ql/test/library-tests/types/Types18.ql
@@ -2,6 +2,7 @@
  * @name Test for struct type
  * @kind table
  */
+
 import csharp
 
 from Struct s
diff --git a/csharp/ql/test/library-tests/types/Types19.ql b/csharp/ql/test/library-tests/types/Types19.ql
index 5821ef0ce96b..e0352d8b5478 100644
--- a/csharp/ql/test/library-tests/types/Types19.ql
+++ b/csharp/ql/test/library-tests/types/Types19.ql
@@ -2,6 +2,7 @@
  * @name Test for class type
  * @kind table
  */
+
 import csharp
 
 from Class c
diff --git a/csharp/ql/test/library-tests/types/Types2.ql b/csharp/ql/test/library-tests/types/Types2.ql
index bec16458c63d..7970d2d286e2 100644
--- a/csharp/ql/test/library-tests/types/Types2.ql
+++ b/csharp/ql/test/library-tests/types/Types2.ql
@@ -2,9 +2,11 @@
  * @name Test for char type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "CharType"
-  and m.getReturnType() instanceof CharType
+where
+  m.getName() = "CharType" and
+  m.getReturnType() instanceof CharType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types20.ql b/csharp/ql/test/library-tests/types/Types20.ql
index 4c9d8c667605..a7bc8e814747 100644
--- a/csharp/ql/test/library-tests/types/Types20.ql
+++ b/csharp/ql/test/library-tests/types/Types20.ql
@@ -2,6 +2,7 @@
  * @name Test for interface type
  * @kind table
  */
+
 import csharp
 
 from Interface i
diff --git a/csharp/ql/test/library-tests/types/Types21.ql b/csharp/ql/test/library-tests/types/Types21.ql
index e2bf820d9402..b111f959d20d 100644
--- a/csharp/ql/test/library-tests/types/Types21.ql
+++ b/csharp/ql/test/library-tests/types/Types21.ql
@@ -2,6 +2,7 @@
  * @name Test for unbound generic class type
  * @kind table
  */
+
 import csharp
 
 from UnboundGenericClass c
diff --git a/csharp/ql/test/library-tests/types/Types22.ql b/csharp/ql/test/library-tests/types/Types22.ql
index 3233260d2a5c..b539167d66a1 100644
--- a/csharp/ql/test/library-tests/types/Types22.ql
+++ b/csharp/ql/test/library-tests/types/Types22.ql
@@ -2,6 +2,7 @@
  * @name Test for unbound generic interface type
  * @kind table
  */
+
 import csharp
 
 from UnboundGenericInterface c
diff --git a/csharp/ql/test/library-tests/types/Types23.ql b/csharp/ql/test/library-tests/types/Types23.ql
index 4ee8bddf8bd1..05a214086abe 100644
--- a/csharp/ql/test/library-tests/types/Types23.ql
+++ b/csharp/ql/test/library-tests/types/Types23.ql
@@ -2,6 +2,7 @@
  * @name Test for unbound generic struct type
  * @kind table
  */
+
 import csharp
 
 from UnboundGenericStruct c
diff --git a/csharp/ql/test/library-tests/types/Types24.ql b/csharp/ql/test/library-tests/types/Types24.ql
index 66b775a7b70c..b81b5d520e67 100644
--- a/csharp/ql/test/library-tests/types/Types24.ql
+++ b/csharp/ql/test/library-tests/types/Types24.ql
@@ -2,9 +2,11 @@
  * @name Test for constructed class type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ConstructedClassType"
-  and m.getReturnType() instanceof ConstructedClass
+where
+  m.getName() = "ConstructedClassType" and
+  m.getReturnType() instanceof ConstructedClass
 select m
diff --git a/csharp/ql/test/library-tests/types/Types25.ql b/csharp/ql/test/library-tests/types/Types25.ql
index 524d0f2b7517..422e9c65917d 100644
--- a/csharp/ql/test/library-tests/types/Types25.ql
+++ b/csharp/ql/test/library-tests/types/Types25.ql
@@ -2,9 +2,11 @@
  * @name Test for constructed interface type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ConstructedInterfaceType"
-  and m.getReturnType() instanceof ConstructedInterface
+where
+  m.getName() = "ConstructedInterfaceType" and
+  m.getReturnType() instanceof ConstructedInterface
 select m
diff --git a/csharp/ql/test/library-tests/types/Types26.ql b/csharp/ql/test/library-tests/types/Types26.ql
index c790fdfb7c05..9c13fb3f1191 100644
--- a/csharp/ql/test/library-tests/types/Types26.ql
+++ b/csharp/ql/test/library-tests/types/Types26.ql
@@ -2,9 +2,11 @@
  * @name Test for constructed struct type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ConstructedStructType"
-  and m.getReturnType() instanceof ConstructedStruct
+where
+  m.getName() = "ConstructedStructType" and
+  m.getReturnType() instanceof ConstructedStruct
 select m
diff --git a/csharp/ql/test/library-tests/types/Types27.ql b/csharp/ql/test/library-tests/types/Types27.ql
index 1a754750a444..a7fe48cbb515 100644
--- a/csharp/ql/test/library-tests/types/Types27.ql
+++ b/csharp/ql/test/library-tests/types/Types27.ql
@@ -2,6 +2,7 @@
  * @name Test for null type
  * @kind table
  */
+
 import csharp
 
 from NullLiteral l
diff --git a/csharp/ql/test/library-tests/types/Types28.ql b/csharp/ql/test/library-tests/types/Types28.ql
index a0301f6fc91a..6579fa274441 100644
--- a/csharp/ql/test/library-tests/types/Types28.ql
+++ b/csharp/ql/test/library-tests/types/Types28.ql
@@ -2,9 +2,11 @@
  * @name Test for delegate type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "DelegateType"
-  and m.getReturnType() instanceof DelegateType
+where
+  m.getName() = "DelegateType" and
+  m.getReturnType() instanceof DelegateType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types29.ql b/csharp/ql/test/library-tests/types/Types29.ql
index d6de5f187e20..bde41d010067 100644
--- a/csharp/ql/test/library-tests/types/Types29.ql
+++ b/csharp/ql/test/library-tests/types/Types29.ql
@@ -2,9 +2,11 @@
  * @name Test for pointer type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "PointerType"
-  and m.getReturnType() instanceof PointerType
+where
+  m.getName() = "PointerType" and
+  m.getReturnType() instanceof PointerType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types3.ql b/csharp/ql/test/library-tests/types/Types3.ql
index 66db0179fadc..a0ea71c3b8f7 100644
--- a/csharp/ql/test/library-tests/types/Types3.ql
+++ b/csharp/ql/test/library-tests/types/Types3.ql
@@ -2,9 +2,11 @@
  * @name Test for decimal type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "DecimalType"
-  and m.getReturnType() instanceof DecimalType
+where
+  m.getName() = "DecimalType" and
+  m.getReturnType() instanceof DecimalType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types30.ql b/csharp/ql/test/library-tests/types/Types30.ql
index 91e44925d20b..1d00aa27e10c 100644
--- a/csharp/ql/test/library-tests/types/Types30.ql
+++ b/csharp/ql/test/library-tests/types/Types30.ql
@@ -2,12 +2,14 @@
  * @name Test for type parameter type
  * @kind table
  */
+
 import csharp
 
 from UnboundGenericClass c, TypeParameter p1, TypeParameter p2
-where c.getQualifiedName() = "Types.Map<,>"
-  and c.getTypeParameter(0) = p1
-  and c.getTypeParameter(1) = p2
-  and p1.getName() = "U"
-  and p2.getName() = "V"
+where
+  c.getQualifiedName() = "Types.Map<,>" and
+  c.getTypeParameter(0) = p1 and
+  c.getTypeParameter(1) = p2 and
+  p1.getName() = "U" and
+  p2.getName() = "V"
 select c, p1, p2
diff --git a/csharp/ql/test/library-tests/types/Types31.ql b/csharp/ql/test/library-tests/types/Types31.ql
index 7ea43627a5ba..204123bb779e 100644
--- a/csharp/ql/test/library-tests/types/Types31.ql
+++ b/csharp/ql/test/library-tests/types/Types31.ql
@@ -2,13 +2,15 @@
  * @name Test for type arguments to constructed types
  * @kind table
  */
+
 import csharp
 
 from Method m, ConstructedClass t, RefType arg1, RefType arg2
-where m.getName() = "Map"
-  and m.getReturnType() = t
-  and t.getTypeArgument(0) = arg1
-  and t.getTypeArgument(1) = arg2
-  and arg1.getQualifiedName() = "System.String"
-  and arg2.getQualifiedName() = "Types.Class"
+where
+  m.getName() = "Map" and
+  m.getReturnType() = t and
+  t.getTypeArgument(0) = arg1 and
+  t.getTypeArgument(1) = arg2 and
+  arg1.getQualifiedName() = "System.String" and
+  arg2.getQualifiedName() = "Types.Class"
 select t, arg1.toString(), arg2
diff --git a/csharp/ql/test/library-tests/types/Types32.ql b/csharp/ql/test/library-tests/types/Types32.ql
index c69179f4a2fa..289a7429226a 100644
--- a/csharp/ql/test/library-tests/types/Types32.ql
+++ b/csharp/ql/test/library-tests/types/Types32.ql
@@ -2,10 +2,12 @@
  * @name Test for linking constructed types to unbound generic types
  * @kind table
  */
+
 import csharp
 
 from Method m, ConstructedClass t, UnboundGenericClass u
-where m.getName() = "Map"
-  and m.getReturnType() = t
-  and t.getUnboundGeneric() = u
+where
+  m.getName() = "Map" and
+  m.getReturnType() = t and
+  t.getUnboundGeneric() = u
 select t, u
diff --git a/csharp/ql/test/library-tests/types/Types33.ql b/csharp/ql/test/library-tests/types/Types33.ql
index e5a34775f971..e806204cd2f0 100644
--- a/csharp/ql/test/library-tests/types/Types33.ql
+++ b/csharp/ql/test/library-tests/types/Types33.ql
@@ -2,11 +2,13 @@
  * @name Test for binding pointer types
  * @kind table
  */
+
 import csharp
 
 from Method m, PointerType p1, PointerType p2
-where m.getName() = "PointerPointerType"
-  and m.getReturnType() = p1
-  and p1.getReferentType() = p2
-  and p2.getReferentType() instanceof ByteType
+where
+  m.getName() = "PointerPointerType" and
+  m.getReturnType() = p1 and
+  p1.getReferentType() = p2 and
+  p2.getReferentType() instanceof ByteType
 select p1.toString(), p2.toString()
diff --git a/csharp/ql/test/library-tests/types/Types34.ql b/csharp/ql/test/library-tests/types/Types34.ql
index 2de285c35da9..1763387a54ba 100644
--- a/csharp/ql/test/library-tests/types/Types34.ql
+++ b/csharp/ql/test/library-tests/types/Types34.ql
@@ -2,11 +2,15 @@
  * @name Test for binding array types
  * @kind table
  */
+
 import csharp
 
 from Method m, ArrayType t1, ArrayType t2
-where m.getName() = "ArrayArrayType"
-  and m.getReturnType() = t1
-  and t1.getDimension() = 2 and t1.getElementType() = t2
-  and t2.getDimension() = 1 and t2.getElementType().(Class).getQualifiedName() = "Types.Class"
+where
+  m.getName() = "ArrayArrayType" and
+  m.getReturnType() = t1 and
+  t1.getDimension() = 2 and
+  t1.getElementType() = t2 and
+  t2.getDimension() = 1 and
+  t2.getElementType().(Class).getQualifiedName() = "Types.Class"
 select t1, t2
diff --git a/csharp/ql/test/library-tests/types/Types35.ql b/csharp/ql/test/library-tests/types/Types35.ql
index 1018c5fce431..3f55fcd81976 100644
--- a/csharp/ql/test/library-tests/types/Types35.ql
+++ b/csharp/ql/test/library-tests/types/Types35.ql
@@ -2,11 +2,13 @@
  * @name Test for binding nullable types
  * @kind table
  */
+
 import csharp
 
 from Method m, NullableType t1, Struct t2
-where m.getName() = "NullableType"
-  and m.getReturnType() = t1
-  and t1.getUnderlyingType() = t2
-  and t2.getQualifiedName() = "Types.Struct"
+where
+  m.getName() = "NullableType" and
+  m.getReturnType() = t1 and
+  t1.getUnderlyingType() = t2 and
+  t2.getQualifiedName() = "Types.Struct"
 select t1
diff --git a/csharp/ql/test/library-tests/types/Types36.ql b/csharp/ql/test/library-tests/types/Types36.ql
index e451cf3bbe8e..80535ddf54fb 100644
--- a/csharp/ql/test/library-tests/types/Types36.ql
+++ b/csharp/ql/test/library-tests/types/Types36.ql
@@ -1,5 +1,4 @@
 /* Ensure that built-in types can be interfaces */
-
 import csharp
 
 from Interface i
diff --git a/csharp/ql/test/library-tests/types/Types4.ql b/csharp/ql/test/library-tests/types/Types4.ql
index b06c6ee3d4ba..3fb73508dde0 100644
--- a/csharp/ql/test/library-tests/types/Types4.ql
+++ b/csharp/ql/test/library-tests/types/Types4.ql
@@ -2,9 +2,11 @@
  * @name Test for sbyte type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "SByteType"
-  and m.getReturnType() instanceof SByteType
+where
+  m.getName() = "SByteType" and
+  m.getReturnType() instanceof SByteType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types5.ql b/csharp/ql/test/library-tests/types/Types5.ql
index 7c31a4ff289d..f7bb8525a02b 100644
--- a/csharp/ql/test/library-tests/types/Types5.ql
+++ b/csharp/ql/test/library-tests/types/Types5.ql
@@ -2,9 +2,11 @@
  * @name Test for short type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ShortType"
-  and m.getReturnType() instanceof ShortType
+where
+  m.getName() = "ShortType" and
+  m.getReturnType() instanceof ShortType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types6.ql b/csharp/ql/test/library-tests/types/Types6.ql
index 146e6566cdaf..7475dd21328d 100644
--- a/csharp/ql/test/library-tests/types/Types6.ql
+++ b/csharp/ql/test/library-tests/types/Types6.ql
@@ -2,9 +2,11 @@
  * @name Test for int type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "IntType"
-  and m.getReturnType() instanceof IntType
+where
+  m.getName() = "IntType" and
+  m.getReturnType() instanceof IntType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types7.ql b/csharp/ql/test/library-tests/types/Types7.ql
index 43e31699a4ad..c5efcc7417ea 100644
--- a/csharp/ql/test/library-tests/types/Types7.ql
+++ b/csharp/ql/test/library-tests/types/Types7.ql
@@ -2,9 +2,11 @@
  * @name Test for long type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "LongType"
-  and m.getReturnType() instanceof LongType
+where
+  m.getName() = "LongType" and
+  m.getReturnType() instanceof LongType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types8.ql b/csharp/ql/test/library-tests/types/Types8.ql
index 1a3352df348d..49b811279407 100644
--- a/csharp/ql/test/library-tests/types/Types8.ql
+++ b/csharp/ql/test/library-tests/types/Types8.ql
@@ -2,9 +2,11 @@
  * @name Test for byte type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "ByteType"
-  and m.getReturnType() instanceof ByteType
+where
+  m.getName() = "ByteType" and
+  m.getReturnType() instanceof ByteType
 select m
diff --git a/csharp/ql/test/library-tests/types/Types9.ql b/csharp/ql/test/library-tests/types/Types9.ql
index e1821b442b86..d54e45ab1549 100644
--- a/csharp/ql/test/library-tests/types/Types9.ql
+++ b/csharp/ql/test/library-tests/types/Types9.ql
@@ -2,9 +2,11 @@
  * @name Test for ushort type
  * @kind table
  */
+
 import csharp
 
 from Method m
-where m.getName() = "UShortType"
-  and m.getReturnType() instanceof UShortType
+where
+  m.getName() = "UShortType" and
+  m.getReturnType() instanceof UShortType
 select m

From c66f67dfac2dbfc822d6463f0890c5b6cae75db4 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Thu, 20 Dec 2018 14:49:56 +0100
Subject: [PATCH 55/69] C#: Address review comment

---
 csharp/ql/src/semmle/code/csharp/Element.qll                  | 4 ++--
 csharp/ql/src/semmle/code/csharp/Enclosing.qll                | 4 ++--
 csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll         | 4 ++--
 .../src/semmle/code/csharp/controlflow/ControlFlowElement.qll | 4 ++--
 .../src/semmle/code/csharp/controlflow/ControlFlowGraph.qll   | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Element.qll b/csharp/ql/src/semmle/code/csharp/Element.qll
index 361319098898..8bcff46054f2 100644
--- a/csharp/ql/src/semmle/code/csharp/Element.qll
+++ b/csharp/ql/src/semmle/code/csharp/Element.qll
@@ -22,10 +22,10 @@ class Element extends DotNet::Element, @element {
    * Where an element has multiple locations (for example a source file and an assembly),
    * gets only the source location.
    */
-  override Location getLocation() { result = Internal::bestLocation(this) }
+  override Location getLocation() { result = ExprOrStmtParentCached::bestLocation(this) }
 
   /** Gets the URL of this element. */
-  string getURL() { result = Internal::getURL(this) }
+  string getURL() { result = ExprOrStmtParentCached::getURL(this) }
 
   /** Gets a location of this element, including sources and assemblies. */
   override Location getALocation() { none() }
diff --git a/csharp/ql/src/semmle/code/csharp/Enclosing.qll b/csharp/ql/src/semmle/code/csharp/Enclosing.qll
index c91f4ebcd0e0..c7bb6c34f3c0 100644
--- a/csharp/ql/src/semmle/code/csharp/Enclosing.qll
+++ b/csharp/ql/src/semmle/code/csharp/Enclosing.qll
@@ -13,7 +13,7 @@
  */
 
 import Stmt
-private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
+private import semmle.code.csharp.ExprOrStmtParent
 
 /**
  * INTERNAL: Do not use.
@@ -35,7 +35,7 @@ cached module Internal {
     c.getAChildStmt+() = s
   }
 
-  private Expr getAChildExpr(ExprOrStmtParent::ExprOrStmtParent p) {
+  private Expr getAChildExpr(ExprOrStmtParent p) {
     result = p.getAChildExpr() or
     result = p.(AssignOperation).getExpandedAssignment()
   }
diff --git a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
index b663abe981b7..42e81853a217 100644
--- a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
+++ b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
@@ -346,7 +346,7 @@ private int getImplementationSize(ValueOrRefType t, File f) {
     result = getImplementationSize1(t, f)
 }
 
-cached module Internal {
+cached module ExprOrStmtParentCached {
   cached
   ControlFlowElement getTopLevelChild(ExprOrStmtParent p, int i) {
     result = p.(MultiImplementationsParent).getBestChild(i)
@@ -404,4 +404,4 @@ cached module Internal {
     result = ""
   }
 }
-private import Internal
+private import ExprOrStmtParentCached
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
index d34ea7992598..fcd0f61aa059 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowElement.qll
@@ -1,7 +1,7 @@
 /** Provides the class `ControlFlowElement`. */
 
 import csharp
-private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
+private import semmle.code.csharp.ExprOrStmtParent
 private import ControlFlow
 private import ControlFlow::BasicBlocks
 private import SuccessorTypes
@@ -15,7 +15,7 @@ private import SuccessorTypes
  * control flow elements and control flow nodes. This allows control flow
  * splitting, for example modeling the control flow through `finally` blocks.
  */
-class ControlFlowElement extends ExprOrStmtParent::ExprOrStmtParent, @control_flow_element {
+class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
   /** Gets the enclosing callable of this element, if any. */
   Callable getEnclosingCallable() { none() }
 
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
index d64be61d5e77..943c6632f6a2 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
@@ -1769,7 +1769,7 @@ module ControlFlow {
        * not return.
        */
       private module NonReturning {
-        private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
+        private import semmle.code.csharp.ExprOrStmtParent
         private import semmle.code.csharp.commons.Assertions
         private import semmle.code.csharp.frameworks.System
 
@@ -1810,7 +1810,7 @@ module ControlFlow {
         private abstract class NonReturningCallable extends Callable {
           NonReturningCallable() {
             not exists(ReturnStmt ret | ret.getEnclosingCallable() = this) and
-            not ExprOrStmtParent::hasAccessorAutoImplementation(this, _) and
+            not hasAccessorAutoImplementation(this, _) and
             not exists(Virtualizable v |
               v.isOverridableOrImplementable() |
               v = this or

From ccda1c8d3d723c2a999c80e34440dfb3d8099821 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 14 Dec 2018 12:18:38 +0000
Subject: [PATCH 56/69] C#: Add nullness test using an `as` expression

---
 csharp/ql/test/query-tests/Nullness/E.cs             |  6 ++++++
 .../test/query-tests/Nullness/Implications.expected  | 12 ++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/csharp/ql/test/query-tests/Nullness/E.cs b/csharp/ql/test/query-tests/Nullness/E.cs
index 6be4074be02f..12e051f8eb01 100644
--- a/csharp/ql/test/query-tests/Nullness/E.cs
+++ b/csharp/ql/test/query-tests/Nullness/E.cs
@@ -296,6 +296,12 @@ public void Ex24(bool b)
         }
     }
 
+    public void Ex25(object o)
+    {
+        var s = o as string;
+        s.ToString(); // BAD (maybe) (false negative)
+    }
+
     public bool Field;
     string Make() => Field ? null : "";
 }
diff --git a/csharp/ql/test/query-tests/Nullness/Implications.expected b/csharp/ql/test/query-tests/Nullness/Implications.expected
index aef55ff476c6..263588fa25bc 100644
--- a/csharp/ql/test/query-tests/Nullness/Implications.expected
+++ b/csharp/ql/test/query-tests/Nullness/Implications.expected
@@ -1468,10 +1468,14 @@
 | E.cs:293:15:293:19 | call to method M2 | null | E.cs:293:13:293:13 | access to local variable s | null |
 | E.cs:295:13:295:13 | access to local variable s | non-null | E.cs:292:20:292:32 | ... ? ... : ... | non-null |
 | E.cs:295:13:295:13 | access to local variable s | null | E.cs:292:20:292:32 | ... ? ... : ... | null |
-| E.cs:300:22:300:38 | ... ? ... : ... | non-null | E.cs:300:22:300:26 | access to field Field | false |
-| E.cs:300:22:300:38 | ... ? ... : ... | non-null | E.cs:300:37:300:38 | "" | non-null |
-| E.cs:300:22:300:38 | ... ? ... : ... | null | E.cs:300:22:300:26 | access to field Field | true |
-| E.cs:300:22:300:38 | ... ? ... : ... | null | E.cs:300:30:300:33 | null | null |
+| E.cs:301:13:301:27 | String s = ... | non-null | E.cs:301:13:301:13 | access to local variable s | non-null |
+| E.cs:301:13:301:27 | String s = ... | null | E.cs:301:13:301:13 | access to local variable s | null |
+| E.cs:302:9:302:9 | access to local variable s | non-null | E.cs:301:17:301:27 | ... as ... | non-null |
+| E.cs:302:9:302:9 | access to local variable s | null | E.cs:301:17:301:27 | ... as ... | null |
+| E.cs:306:22:306:38 | ... ? ... : ... | non-null | E.cs:306:22:306:26 | access to field Field | false |
+| E.cs:306:22:306:38 | ... ? ... : ... | non-null | E.cs:306:37:306:38 | "" | non-null |
+| E.cs:306:22:306:38 | ... ? ... : ... | null | E.cs:306:22:306:26 | access to field Field | true |
+| E.cs:306:22:306:38 | ... ? ... : ... | null | E.cs:306:30:306:33 | null | null |
 | Forwarding.cs:7:16:7:23 | String s = ... | non-null | Forwarding.cs:7:16:7:16 | access to local variable s | non-null |
 | Forwarding.cs:7:16:7:23 | String s = ... | null | Forwarding.cs:7:16:7:16 | access to local variable s | null |
 | Forwarding.cs:9:13:9:30 | !... | false | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | true |

From 33fcbc958df9842fdb3d132d9394d933028e17bc Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Fri, 14 Dec 2018 12:23:09 +0000
Subject: [PATCH 57/69] C#: Consider `as` expressions as maybe-`null` in
 `cs/dereferenced-value-may-be-null`

---
 csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll | 2 ++
 csharp/ql/test/query-tests/Nullness/E.cs               | 2 +-
 csharp/ql/test/query-tests/Nullness/NullMaybe.expected | 4 ++++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index 26c8fb44e119..2e524d567796 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -39,6 +39,8 @@ class MaybeNullExpr extends Expr {
     this.(AssignExpr).getRValue() instanceof MaybeNullExpr
     or
     this.(Cast).getExpr() instanceof MaybeNullExpr
+    or
+    this instanceof AsExpr
   }
 }
 
diff --git a/csharp/ql/test/query-tests/Nullness/E.cs b/csharp/ql/test/query-tests/Nullness/E.cs
index 12e051f8eb01..8b398ed3b89f 100644
--- a/csharp/ql/test/query-tests/Nullness/E.cs
+++ b/csharp/ql/test/query-tests/Nullness/E.cs
@@ -299,7 +299,7 @@ public void Ex24(bool b)
     public void Ex25(object o)
     {
         var s = o as string;
-        s.ToString(); // BAD (maybe) (false negative)
+        s.ToString(); // BAD (maybe)
     }
 
     public bool Field;
diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
index b6b6f22c2c37..afa5262f3e75 100644
--- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -346,6 +346,8 @@ nodes
 | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) |
 | E.cs:285:9:285:9 | access to local variable o |
 | E.cs:285:9:285:9 | access to local variable o |
+| E.cs:301:13:301:27 | SSA def(s) |
+| E.cs:302:9:302:9 | access to local variable s |
 | Forwarding.cs:7:16:7:23 | SSA def(s) |
 | Forwarding.cs:14:9:17:9 | if (...) ... |
 | Forwarding.cs:19:9:22:9 | if (...) ... |
@@ -675,6 +677,7 @@ edges
 | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
 | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
 | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
+| E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
 | Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:14:9:17:9 | if (...) ... |
 | Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
 | Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:24:9:27:9 | if (...) ... |
@@ -774,6 +777,7 @@ edges
 | E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null here because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
 | E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
 | E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null here as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| E.cs:302:9:302:9 | access to local variable s | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s | Variable $@ may be null here because of $@ assignment. | E.cs:301:13:301:13 | s | s | E.cs:301:13:301:27 | String s = ... | this |
 | GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null here because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
 | NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null here because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
 | StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null here because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

From d73b28efe4d781112e73c3d528fbb6a57585beaf Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Thu, 20 Dec 2018 20:23:12 +0000
Subject: [PATCH 58/69] C#: Address review comments.     Add more tests for
 duplicated entities, and fix some duplicated entities.     Update the
 TupleTypes output - some extraneous results gone so it's probably better.

---
 .../Entities/Namespace.cs                     |  2 +-
 csharp/extractor/Semmle.Extraction/Context.cs | 39 ++++++++++++-------
 .../Semmle.Extraction/Entities/Folder.cs      |  2 +-
 .../Semmle.Extraction.csproj                  |  4 ++
 .../assignables/Assignables.expected          |  6 ---
 .../library-tests/csharp7/TupleTypes.expected |  9 -----
 6 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
index a7b744b11911..30c155a6d8e9 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
@@ -31,7 +31,7 @@ public override IId Id
             }
         }
 
-        public static Namespace Create(Context cx, INamespaceSymbol ns) => NamespaceFactory.Instance.CreateEntity(cx, ns);
+        public static Namespace Create(Context cx, INamespaceSymbol ns) => NamespaceFactory.Instance.CreateEntity2(cx, ns);
 
         class NamespaceFactory : ICachedEntityFactory<INamespaceSymbol, Namespace>
         {
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index 0d0d967b1db1..76ed4ddea63a 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -61,31 +61,47 @@ public Entity CreateEntity<Type, Entity>(ICachedEntityFactory<Type, Entity> fact
         /// <param name="factory">The entity factory.</param>
         /// <param name="init">The initializer for the entity.</param>
         /// <returns>The new/existing entity.</returns>
-        public Entity CreateEntity2<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type type) where Entity : ICachedEntity
+        public Entity CreateEntity2<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type init) where Entity : ICachedEntity
         {
             using (StackGuard)
             {
-                var entity = factory.Create(this, type);
+                var entity = factory.Create(this, init);
 
-                if(entityLabelCache.TryGetValue(entity, out var label))
+                if (entityLabelCache.TryGetValue(entity, out var label))
                 {
                     entity.Label = label;
-                    return entity;
                 }
                 else
                 {
                     var id = entity.Id;
+#if DEBUG_LABELS
+                    CheckEntityHasUniqueLabel(id, entity);
+#endif
                     label = new Label(NewId());
                     entity.Label = label;
                     entityLabelCache[entity] = label;
                     DefineLabel(label, id);
                     if (entity.NeedsPopulation)
-                        Populate(null, entity);
-                    return entity;
+                        Populate(init as ISymbol, entity);
                 }
+                return entity;
             }
         }
 
+#if DEBUG_LABELS
+        private void CheckEntityHasUniqueLabel(IId id, ICachedEntity entity)
+        {
+            if (idLabelCache.TryGetValue(id, out var originalEntity))
+            {
+                Extractor.Message(new Message { message = "Label collision for " + id.ToString(), severity = Severity.Warning });
+            }
+            else
+            {
+                idLabelCache[id] = entity;
+            }
+        }
+#endif
+
         private Entity CreateNonNullEntity<Type, Entity>(ICachedEntityFactory<Type, Entity> factory, Type init) where Entity : ICachedEntity
         {
             if (objectEntityCache.TryGetValue(init, out var cached))
@@ -103,14 +119,7 @@ private Entity CreateNonNullEntity<Type, Entity>(ICachedEntityFactory<Type, Enti
                 DefineLabel(label, id);
 
 #if DEBUG_LABELS
-                if (idLabelCache.TryGetValue(id, out var originalEntity))
-                {
-                    Extractor.Message(new Message { message = "Label collision for " + id.ToString(), severity = Severity.Warning });
-                }
-                else
-                {
-                    idLabelCache[id] = entity;
-                }
+                CheckEntityHasUniqueLabel(id, entity);
 #endif
 
                 if (entity.NeedsPopulation)
@@ -154,7 +163,9 @@ public void AddFreshLabel(IEntity entity)
             entity.Label = label;
         }
 
+#if DEBUG_LABELS
         readonly Dictionary<IId, ICachedEntity> idLabelCache = new Dictionary<IId, ICachedEntity>();
+#endif
         readonly Dictionary<object, ICachedEntity> objectEntityCache = new Dictionary<object, ICachedEntity>();
         readonly Dictionary<ICachedEntity, Label> entityLabelCache = new Dictionary<ICachedEntity, Label>();
         readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
index 193100941fe0..edc595407702 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
@@ -39,7 +39,7 @@ public override void Populate()
         public override IId Id => new Key(DatabasePath, ";folder");
 
         public static Folder Create(Context cx, DirectoryInfo folder) =>
-            FolderFactory.Instance.CreateEntity(cx, folder);
+            FolderFactory.Instance.CreateEntity2(cx, folder);
 
         public override Microsoft.CodeAnalysis.Location ReportingLocation => null;
 
diff --git a/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj b/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
index 3ca4fef8dafd..ff88b7531271 100644
--- a/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
+++ b/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
@@ -7,6 +7,10 @@
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
+    <DefineConstants>TRACE;DEBUG;DEBUG_LABELS</DefineConstants>
+  </PropertyGroup>
+
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis" Version="2.8.0" />
     <PackageReference Include="GitInfo" Version="2.0.18" />
diff --git a/csharp/ql/test/library-tests/assignables/Assignables.expected b/csharp/ql/test/library-tests/assignables/Assignables.expected
index 3621402945fc..d8e9e8384730 100644
--- a/csharp/ql/test/library-tests/assignables/Assignables.expected
+++ b/csharp/ql/test/library-tests/assignables/Assignables.expected
@@ -58,8 +58,6 @@
 | Assignables.cs:87:10:87:17 | Item1 |
 | Assignables.cs:87:10:87:17 | Property |
 | Assignables.cs:87:20:87:26 | Item2 |
-| Assignables.cs:87:32:87:32 | Item1 |
-| Assignables.cs:87:35:87:35 | Item2 |
 | Assignables.cs:88:10:88:10 | Item1 |
 | Assignables.cs:88:10:88:10 | x |
 | Assignables.cs:88:13:88:18 | Item2 |
@@ -69,13 +67,9 @@
 | Assignables.cs:88:17:88:17 | x |
 | Assignables.cs:88:24:88:24 | Item1 |
 | Assignables.cs:88:27:88:36 | Item2 |
-| Assignables.cs:88:28:88:32 | Item1 |
-| Assignables.cs:88:35:88:35 | Item2 |
 | Assignables.cs:89:10:89:10 | Item1 |
 | Assignables.cs:89:10:89:10 | b |
 | Assignables.cs:89:13:89:18 | Item2 |
-| Assignables.cs:89:24:89:27 | Item1 |
-| Assignables.cs:89:30:89:35 | Item2 |
 | Assignables.cs:92:6:92:8 | Item1 |
 | Assignables.cs:92:11:92:24 | Item2 |
 | Assignables.cs:92:12:92:15 | Item1 |
diff --git a/csharp/ql/test/library-tests/csharp7/TupleTypes.expected b/csharp/ql/test/library-tests/csharp7/TupleTypes.expected
index f2c7f173f295..8c50282dd038 100644
--- a/csharp/ql/test/library-tests/csharp7/TupleTypes.expected
+++ b/csharp/ql/test/library-tests/csharp7/TupleTypes.expected
@@ -25,33 +25,24 @@
 | (Int32,Int32) | (int, int) | ValueTuple<int, int> | 2 | 1 | CSharp7.cs:112:19:112:20 | m5 |
 | (Int32,Int32) | (int, int) | ValueTuple<int, int> | 2 | 1 | CSharp7.cs:114:27:114:32 | m9 |
 | (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 0 | CSharp7.cs:75:10:75:10 | x |
-| (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 0 | CSharp7.cs:75:28:75:28 | Item1 |
 | (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 1 | CSharp7.cs:75:13:75:13 | y |
-| (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 1 | CSharp7.cs:75:31:75:31 | Item2 |
 | (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 2 | CSharp7.cs:75:16:75:22 | Item3 |
-| (Int32,Int32,Int32) | (int, int, int) | ValueTuple<int, int, int> | 3 | 2 | CSharp7.cs:75:34:75:34 | Item3 |
-| (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 0 | CSharp7.cs:97:19:97:19 | Item1 |
 | (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 0 | CSharp7.cs:284:41:284:48 | Key |
 | (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 0 | CSharp7.cs:286:19:286:23 | a |
-| (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 1 | CSharp7.cs:97:22:97:37 | Item2 |
 | (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 1 | CSharp7.cs:284:51:284:60 | Value |
 | (Int32,String) | (int, string) | ValueTuple<int, string> | 2 | 1 | CSharp7.cs:286:26:286:33 | b |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 0 | CSharp7.cs:109:10:109:15 | m1 |
-| (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 0 | CSharp7.cs:109:29:109:37 | Item1 |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 0 | CSharp7.cs:112:10:112:11 | m3 |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 0 | CSharp7.cs:114:10:114:15 | m7 |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 1 | CSharp7.cs:109:18:109:23 | m2 |
-| (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 1 | CSharp7.cs:109:40:109:45 | Item2 |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 1 | CSharp7.cs:112:14:112:21 | Item2 |
 | (String,(Int32,Int32)) | (string, (int, int)) | ValueTuple<string, (int, int)> | 2 | 1 | CSharp7.cs:114:18:114:33 | Item2 |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 0 | CSharp7.cs:79:14:79:14 | i |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 0 | CSharp7.cs:79:23:79:24 | Item1 |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 0 | CSharp7.cs:84:17:84:17 | a |
-| (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 0 | CSharp7.cs:98:23:98:38 | Item1 |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 1 | CSharp7.cs:79:17:79:17 | j |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 1 | CSharp7.cs:79:27:79:27 | x |
 | (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 1 | CSharp7.cs:84:23:84:23 | Item2 |
-| (String,Int32) | (string, int) | ValueTuple<string, int> | 2 | 1 | CSharp7.cs:98:41:98:41 | Item2 |
 | (String,String) | (string, string) | ValueTuple<string, string> | 2 | 0 | CSharp7.cs:89:19:89:27 | Item1 |
 | (String,String) | (string, string) | ValueTuple<string, string> | 2 | 0 | CSharp7.cs:90:10:90:15 | t2 |
 | (String,String) | (string, string) | ValueTuple<string, string> | 2 | 1 | CSharp7.cs:89:30:89:33 | Item2 |

From 0fe0544769a04bc940944d5f641111a3a90041eb Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Mon, 31 Dec 2018 14:20:47 +0000
Subject: [PATCH 59/69] C#: Fix extraction error when Event accessors are
 ordinary methods.

---
 csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
index 80482d9e6e87..05630eb54a12 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
@@ -33,10 +33,10 @@ public override void Populate()
             var remover = symbol.RemoveMethod;
 
             if (!(adder is null))
-                EventAccessor.Create(Context, adder);
+                Method.Create(Context, adder);
 
             if (!(remover is null))
-                EventAccessor.Create(Context, remover);
+                Method.Create(Context, remover);
 
             ExtractModifiers();
             BindComments();

From f06a20f666a4ed92bf5456808c43ecf1b2dd8044 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Tue, 18 Dec 2018 14:38:33 +0100
Subject: [PATCH 60/69] C#: Add SSA tests with CFG splitting

---
 .../dataflow/ssa/DefAdjacentRead.expected     |  8 +++
 .../dataflow/ssa/PreSsaConsistency.expected   |  8 +++
 .../dataflow/ssa/ReadAdjacentRead.expected    |  9 +++
 .../dataflow/ssa/SSAPhi.expected              |  2 +
 .../library-tests/dataflow/ssa/Splitting.cs   | 57 +++++++++++++++++++
 .../dataflow/ssa/SsaDef.expected              | 11 ++++
 .../dataflow/ssa/SsaDefLastRead.expected      | 12 ++++
 .../dataflow/ssa/SsaExplicitDef.expected      | 10 ++++
 .../dataflow/ssa/SsaRead.expected             | 21 +++++++
 .../dataflow/ssa/SsaUltimateDef.expected      | 12 ++++
 10 files changed, 150 insertions(+)
 create mode 100644 csharp/ql/test/library-tests/dataflow/ssa/Splitting.cs

diff --git a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
index 94ed055a86e7..86263a297e87 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
@@ -135,6 +135,14 @@
 | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | Action a = ... | Properties.cs:77:9:77:9 | access to local variable a |
 | Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | Action b = ... | Properties.cs:80:9:80:9 | access to local variable b |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | p | Properties.cs:106:42:106:42 | access to parameter p |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:13:9:13:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | ... = ... | Splitting.cs:11:13:11:13 | access to local variable x |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | b | Splitting.cs:25:13:25:13 | access to parameter b |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | ... = ... | Splitting.cs:30:13:30:13 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | ... = ... | Splitting.cs:33:9:33:9 | access to local variable x |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | b | Splitting.cs:45:13:45:13 | access to parameter b |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | ... = ... | Splitting.cs:50:13:50:13 | access to local variable x |
 | Test.cs:3:9:3:13 | field | Test.cs:57:9:57:17 | ... = ... | Test.cs:58:13:58:17 | access to field field |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | param1 | Test.cs:11:13:11:18 | access to parameter param1 |
 | Test.cs:5:67:5:72 | param2 | Test.cs:5:67:5:72 | param2 | Test.cs:39:27:39:32 | access to parameter param2 |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
index 4fa64b476744..169de96219a1 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
@@ -1,3 +1,11 @@
 defReadInconsistency
+| Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:5:13:5:13 | x | false |
 readReadInconsistency
+| Splitting.cs:11:13:11:13 | access to local variable x | Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:5:13:5:13 | x | false |
 phiInconsistency
+| Splitting.cs:13:9:13:21 | ...; | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:5:13:5:13 | x | true |
+| Splitting.cs:13:9:13:21 | ...; | Splitting.cs:10:13:10:19 | ... = ... | Splitting.cs:5:13:5:13 | x | true |
+| Splitting.cs:52:9:53:22 | if (...) ... | Splitting.cs:46:13:46:19 | ... = ... | Splitting.cs:44:13:44:13 | x | true |
+| Splitting.cs:52:9:53:22 | if (...) ... | Splitting.cs:49:13:49:19 | ... = ... | Splitting.cs:44:13:44:13 | x | true |
+| Splitting.cs:54:9:54:21 | ...; | Splitting.cs:46:13:46:19 | ... = ... | Splitting.cs:44:13:44:13 | x | false |
+| Splitting.cs:54:9:54:21 | ...; | Splitting.cs:49:13:49:19 | ... = ... | Splitting.cs:44:13:44:13 | x | false |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
index 779c54a9d450..9eba3cbe9f5b 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
@@ -98,6 +98,15 @@
 | Properties.cs:104:16:104:20 | Props | Properties.cs:114:20:114:35 | access to field Props | Properties.cs:115:21:115:36 | access to field Props |
 | Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:30 | access to field Props | Properties.cs:116:17:116:26 | access to field Props |
 | Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:36 | access to field Props | Properties.cs:116:17:116:32 | access to field Props |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b | Splitting.cs:15:13:15:13 | access to parameter b |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:11:13:11:13 | access to local variable x | Splitting.cs:13:9:13:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:14:9:14:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:14:9:14:9 | access to local variable x | Splitting.cs:17:13:17:13 | access to local variable x |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:25:13:25:13 | access to parameter b | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:33:9:33:9 | access to local variable x | Splitting.cs:34:9:34:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:34:9:34:9 | access to local variable x | Splitting.cs:37:13:37:13 | access to local variable x |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:45:13:45:13 | access to parameter b | Splitting.cs:52:13:52:13 | access to parameter b |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:9 | access to local variable x | Splitting.cs:55:9:55:9 | access to local variable x |
 | Test.cs:8:13:8:13 | x | Test.cs:25:16:25:16 | access to local variable x | Test.cs:25:16:25:16 | access to local variable x |
 | Test.cs:9:13:9:13 | y | Test.cs:25:20:25:20 | access to local variable y | Test.cs:31:13:31:13 | access to local variable y |
 | Test.cs:9:13:9:13 | y | Test.cs:25:20:25:20 | access to local variable y | Test.cs:43:20:43:20 | access to local variable y |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
index cc9cbbd790fd..f0ea327fd1e2 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
@@ -33,6 +33,8 @@
 | Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:50:9:50:17 | SSA phi(Properties.stat) | Properties.cs:49:17:49:32 | SSA call def(Properties.stat) |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:61:23:61:23 | SSA param(i) |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:18 | SSA def(i) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:5:15:5:20 | SSA param(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:24 | SSA def(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:33:9:33:19 | SSA phi(param1) | Test.cs:25:16:25:16 | SSA phi(param1) |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/Splitting.cs b/csharp/ql/test/library-tests/dataflow/ssa/Splitting.cs
new file mode 100644
index 000000000000..3969b9ab3398
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/ssa/Splitting.cs
@@ -0,0 +1,57 @@
+class Splitting
+{
+    void M1(bool b)
+    {
+        var x = "";
+        if (b)
+            x = "a";
+        else
+        {
+            x = "b";
+            x.ToString();
+        }
+        x.ToString();
+        x.ToString();
+        if (b)
+        {
+            x.ToString();
+            x = "c";
+        }
+    }
+
+    void M2(bool b)
+    {
+        var x = "";
+        if (b)
+            x = "a";
+        else
+        {
+            x = "b";
+            x.ToString();
+        }
+        x = "c";
+        x.ToString();
+        x.ToString();
+        if (b)
+        {
+            x.ToString();
+            x = "d";
+        }
+    }
+
+    void M3(bool b)
+    {
+        var x = "";
+        if (b)
+            x = "a";
+        else
+        {
+            x = "b";
+            x.ToString();
+        }
+        if (b)
+            b = false;
+        x.ToString();
+        x.ToString();
+    }
+}
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
index 0c3939868e5d..d295c87a9932 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
@@ -307,6 +307,17 @@
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:27:17:27:24 | SSA def(param1) |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
index 130883a7b51d..0308843c868d 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
@@ -216,6 +216,18 @@
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:116:17:116:26 | access to field Props |
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:116:17:116:32 | access to field Props |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:116:17:116:35 | access to property xs |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:15:13:15:13 | access to parameter b |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:17:13:17:13 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:30:13:30:13 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:37:13:37:13 | access to local variable x |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:52:13:52:13 | access to parameter b |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:50:13:50:13 | access to local variable x |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:55:9:55:9 | access to local variable x |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:11:13:11:18 | access to parameter param1 |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:22 | access to parameter param1 |
 | Test.cs:5:15:5:20 | param1 | Test.cs:39:9:42:9 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
index a433239dc870..650d3a8832b1 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
@@ -186,6 +186,16 @@
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:81:9:81:22 | ... = ... |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:83:9:83:22 | ... = ... |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:37:106:37 | p |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:3:18:3:18 | b |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:7:13:7:19 | ... = ... |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:10:13:10:19 | ... = ... |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:22:18:22:18 | b |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:29:13:29:19 | ... = ... |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:32:9:32:15 | ... = ... |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:32:9:32:15 | ... = ... |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:42:18:42:18 | b |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) | Splitting.cs:46:13:46:19 | ... = ... |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:49:13:49:19 | ... = ... |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:5:15:5:20 | param1 |
 | Test.cs:5:15:5:20 | param1 | Test.cs:27:17:27:24 | SSA def(param1) | Test.cs:27:17:27:24 | ...++ |
 | Test.cs:5:15:5:20 | param1 | Test.cs:41:13:41:23 | SSA def(param1) | Test.cs:41:13:41:23 | ... = ... |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
index 54cf2119aa89..0ee9c9ee7464 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
@@ -334,6 +334,27 @@
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:116:17:116:32 | access to field Props |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:115:21:115:39 | access to property xs |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:116:17:116:35 | access to property xs |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:6:13:6:13 | access to parameter b |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:15:13:15:13 | access to parameter b |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:13:9:13:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:17:13:17:13 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:11:13:11:13 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:13:9:13:9 | access to local variable x |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:25:13:25:13 | access to parameter b |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:30:13:30:13 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:33:9:33:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:33:9:33:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:37:13:37:13 | access to local variable x |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:45:13:45:13 | access to parameter b |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:52:13:52:13 | access to parameter b |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:50:13:50:13 | access to local variable x |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:54:9:54:9 | access to local variable x |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:55:9:55:9 | access to local variable x |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:11:13:11:18 | access to parameter param1 |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:22 | access to parameter param1 |
 | Test.cs:5:15:5:20 | param1 | Test.cs:39:9:42:9 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
index 99aae4035968..7e0a8a131602 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
@@ -406,6 +406,18 @@
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:3:18:3:18 | SSA param(b) |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) |
+| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) |
+| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:22:18:22:18 | SSA param(b) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) |
+| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) |
+| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:42:18:42:18 | SSA param(b) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:46:13:46:19 | [b (line 42): true] SSA def(x) |
+| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:5:15:5:20 | SSA param(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:5:15:5:20 | SSA param(param1) |
 | Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:24 | SSA def(param1) |

From 5879e58741f4af074462bb698031341c668fffc1 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Tue, 18 Dec 2018 14:38:55 +0100
Subject: [PATCH 61/69] C#: Account for CFG splitting in
 `AssignableDefinition::getAFirstRead()` and `AssignableRead::getANextRead()`

---
 .../ql/src/semmle/code/csharp/Assignable.qll  |  14 ++-
 .../semmle/code/csharp/dataflow/Nullness.qll  |  16 +--
 .../src/semmle/code/csharp/dataflow/SSA.qll   | 104 +++++++++++++++---
 .../dataflow/ssa/DefAdjacentRead.expected     |   1 -
 .../dataflow/ssa/PreSsaConsistency.expected   |   8 --
 .../dataflow/ssa/PreSsaConsistency.ql         |  44 ++++++--
 .../dataflow/ssa/ReadAdjacentRead.expected    |   1 -
 .../dataflow/ssa/SsaDefLastRead.expected      |   2 -
 8 files changed, 138 insertions(+), 52 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Assignable.qll b/csharp/ql/src/semmle/code/csharp/Assignable.qll
index 7802396d83d0..5601fa37ed6b 100644
--- a/csharp/ql/src/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Assignable.qll
@@ -100,7 +100,10 @@ class AssignableRead extends AssignableAccess {
    * - The read of `this.Field` on line 11 is next to the read on line 10.
    */
   AssignableRead getANextRead() {
-    Ssa::Internal::adjacentReadPairSameVar(this, result)
+    forex(ControlFlow::Node cfn |
+      cfn = result.getAControlFlowNode() |
+      Ssa::Internal::adjacentReadPairSameVar(this.getAControlFlowNode(), cfn)
+    )
   }
 
   /**
@@ -502,9 +505,12 @@ class AssignableDefinition extends TAssignableDefinition {
    * `AssignableRead.getANextRead()`.
    */
   AssignableRead getAFirstRead() {
-    exists(Ssa::ExplicitDefinition def |
-      def.getADefinition() = this |
-      result = def.getAFirstRead()
+    forex(ControlFlow::Node cfn |
+      cfn = result.getAControlFlowNode() |
+      exists(Ssa::ExplicitDefinition def |
+        result = def.getAFirstReadAtNode(cfn) |
+        this = def.(Ssa::ExplicitDefinition).getADefinition()
+      )
     )
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index 2e524d567796..e0daa03f5fdf 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -423,20 +423,20 @@ private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
 }
 
 /**
- * Holds if SSA definition `def` can reach a read `ar`, without passing
+ * Holds if SSA definition `def` can reach a read at `cfn`, without passing
  * through an intermediate dereference that always (`always = true`) or
  * maybe (`always = false`) throws a null reference exception.
  */
-private predicate defReaches(Ssa::Definition def, AssignableRead ar, boolean always) {
-  ar = def.getAFirstRead() and
+private predicate defReaches(Ssa::Definition def, ControlFlow::Node cfn, boolean always) {
+  exists(def.getAFirstReadAtNode(cfn)) and
   (always = true or always = false)
   or
-  exists(AssignableRead mid |
+  exists(ControlFlow::Node mid |
     defReaches(def, mid, always) |
-    ar = mid.getANextRead() and
+    Ssa::Internal::adjacentReadPairSameVar(mid, cfn) and
     not mid = any(Dereference d |
       if always = true then d.isAlwaysNull(def.getSourceVariable()) else d.isMaybeNull(def, _, _, _, _)
-    )
+    ).getAControlFlowNode()
   )
 }
 
@@ -528,7 +528,7 @@ class Dereference extends G::DereferenceableExpr {
    */
   predicate isFirstAlwaysNull(Ssa::SourceVariable v) {
     this.isAlwaysNull(v) and
-    defReaches(v.getAnSsaDefinition(), this, true)
+    defReaches(v.getAnSsaDefinition(), this.getAControlFlowNode(), true)
   }
 
   /**
@@ -551,6 +551,6 @@ class Dereference extends G::DereferenceableExpr {
    */
   predicate isFirstMaybeNull(Ssa::Definition def, SourcePathNode source, SinkPathNode sink, string msg, Element reason) {
     this.isMaybeNull(def, source, sink, msg, reason) and
-    defReaches(def, this, false)
+    defReaches(def, this.getAControlFlowNode(), false)
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 3abcf4ad10a0..ac0049037fc5 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -760,16 +760,16 @@ module Ssa {
 
     private cached module Cached {
       /**
-       * Holds if `read` is a last read of the non-trivial SSA definition `def`.
-       * That is, `read` can reach the end of the enclosing callable, or another
+       * Holds if `cfn` is a last read of the non-trivial SSA definition `def`.
+       * That is, `cfn` can reach the end of the enclosing callable, or another
        * SSA definition for the underlying source variable, without passing through
        * another read.
        */
       cached
-      predicate lastRead(TrackedDefinition def, AssignableRead read) {
+      predicate lastRead(TrackedDefinition def, ControlFlow::Node cfn) {
         exists(TrackedVar v, BasicBlock bb, int i, int rnk |
-          read = def.getARead() and
-          variableRead(bb, i, v, read.getAControlFlowNode(), _) and
+          exists(def.getAReadAtNode(cfn)) and
+          variableRead(bb, i, v, cfn, _) and
           rnk = ssaRefRank(bb, i, v, SsaRead()) |
           // Next reference to `v` inside `bb` is a write
           rnk + 1 = ssaRefRank(bb, _, v, SsaDef())
@@ -854,27 +854,29 @@ module Ssa {
       }
 
       /**
-       * Holds if the value defined at non-trivial SSA definition `def` can reach `read`
-       * without passing through any other read.
+       * Holds if the value defined at non-trivial SSA definition `def` can reach a
+       * read at `cfn`, without passing through any other read.
        */
       cached
-      predicate firstReadSameVar(TrackedDefinition def, AssignableRead read) {
+      predicate firstReadSameVar(TrackedDefinition def, ControlFlow::Node cfn) {
         exists(TrackedVar v, BasicBlock b1, int i1, BasicBlock b2, int i2 |
           adjacentVarRefs(v, b1, i1, b2, i2) and
           definesAt(def, b1, i1, v) and
-          variableRead(b2, i2, v, read.getAControlFlowNode(), _)
+          variableRead(b2, i2, v, cfn, _)
         )
       }
 
       /**
-       * INTERNAL: Use `AssignableRead.getANextRead()` instead.
+       * Holds if the read at `cfn2` is a read of the same SSA definition as the
+       * read at `cfn1`, and `cfn2` can be reached from `cfn1` without passing
+       * through another read.
        */
       cached
-      predicate adjacentReadPairSameVar(AssignableRead read1, AssignableRead read2) {
+      predicate adjacentReadPairSameVar(ControlFlow::Node cfn1, ControlFlow::Node cfn2) {
         exists(TrackedVar v, BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
           adjacentVarRefs(v, bb1, i1, bb2, i2) and
-          variableRead(bb1, i1, v, read1.getAControlFlowNode(), _) and
-          variableRead(bb2, i2, v, read2.getAControlFlowNode(), _)
+          variableRead(bb1, i1, v, cfn1, _) and
+          variableRead(bb2, i2, v, cfn2, _)
         )
       }
     }
@@ -2074,8 +2076,45 @@ module Ssa {
      * Subsequent reads can be found by following the steps defined by
      * `AssignableRead.getANextRead()`.
      */
-    AssignableRead getAFirstRead() {
-      firstReadSameVar(this, result)
+    AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
+
+    /**
+     * Gets a read of the source variable underlying this SSA definition at
+     * control flow node `cfn` that can be reached from this SSA definition
+     * without passing through any other SSA definition or read. Example:
+     *
+     * ```
+     * int Field;
+     *
+     * void SetField(int i) {
+     *   this.Field = i;
+     *   Use(this.Field);
+     *   if (i > 0)
+     *     this.Field = i - 1;
+     *   else if (i < 0)
+     *     SetField(1);
+     *   Use(this.Field);
+     *   Use(this.Field);
+     * }
+     * ```
+     *
+     * - The read of `i` on line 4 can be reached from the explicit SSA
+     *   definition (wrapping an implicit entry definition) on line 3.
+     * - The reads of `i` on lines 6 and 7 are not the first reads of any SSA
+     *   definition.
+     * - The read of `this.Field` on line 5 can be reached from the explicit SSA
+     *   definition on line 4.
+     * - The read of `this.Field` on line 10 can be reached from the phi node
+     *   between lines 9 and 10.
+     * - The read of `this.Field` on line 11 is not the first read of any SSA
+     *   definition.
+     *
+     * Subsequent reads can be found by following the steps defined by
+     * `AssignableRead.getANextRead()`.
+     */
+    AssignableRead getAFirstReadAtNode(ControlFlow::Node cfn) {
+      firstReadSameVar(this, cfn) and
+      result.getAControlFlowNode() = cfn
     }
 
     /**
@@ -2106,8 +2145,39 @@ module Ssa {
      * - The read of `this.Field` on line 11 is a last read of the phi node
      *   between lines 9 and 10.
      */
-    AssignableRead getALastRead() {
-      lastRead(this, result)
+    AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }
+
+    /**
+     * Gets a last read of the source variable underlying this SSA definition at
+     * control flow node `cfn`. That is, a read that can reach the end of the
+     * enclosing callable, or another SSA definition for the source variable,
+     * without passing through any other read. Example:
+     *
+     * ```
+     * int Field;
+     *
+     * void SetField(int i) {
+     *   this.Field = i;
+     *   Use(this.Field);
+     *   if (i > 0)
+     *     this.Field = i - 1;
+     *   else if (i < 0)
+     *     SetField(1);
+     *   Use(this.Field);
+     *   Use(this.Field);
+     * }
+     * ```
+     *
+     * - The reads of `i` on lines 7 and 8 are the last reads for the implicit
+     *   parameter definition on line 3.
+     * - The read of `this.Field` on line 5 is a last read of the definition on
+     *   line 4.
+     * - The read of `this.Field` on line 11 is a last read of the phi node
+     *   between lines 9 and 10.
+     */
+    AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
+      lastRead(this, cfn) and
+      result.getAControlFlowNode() = cfn
     }
 
     /**
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
index 86263a297e87..f17ef9e7b8a3 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
@@ -136,7 +136,6 @@
 | Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | Action b = ... | Properties.cs:80:9:80:9 | access to local variable b |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | p | Properties.cs:106:42:106:42 | access to parameter p |
 | Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b |
-| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:13:9:13:9 | access to local variable x |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | ... = ... | Splitting.cs:11:13:11:13 | access to local variable x |
 | Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | b | Splitting.cs:25:13:25:13 | access to parameter b |
 | Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | ... = ... | Splitting.cs:30:13:30:13 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
index 169de96219a1..4fa64b476744 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected
@@ -1,11 +1,3 @@
 defReadInconsistency
-| Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:5:13:5:13 | x | false |
 readReadInconsistency
-| Splitting.cs:11:13:11:13 | access to local variable x | Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:5:13:5:13 | x | false |
 phiInconsistency
-| Splitting.cs:13:9:13:21 | ...; | Splitting.cs:7:13:7:19 | ... = ... | Splitting.cs:5:13:5:13 | x | true |
-| Splitting.cs:13:9:13:21 | ...; | Splitting.cs:10:13:10:19 | ... = ... | Splitting.cs:5:13:5:13 | x | true |
-| Splitting.cs:52:9:53:22 | if (...) ... | Splitting.cs:46:13:46:19 | ... = ... | Splitting.cs:44:13:44:13 | x | true |
-| Splitting.cs:52:9:53:22 | if (...) ... | Splitting.cs:49:13:49:19 | ... = ... | Splitting.cs:44:13:44:13 | x | true |
-| Splitting.cs:54:9:54:21 | ...; | Splitting.cs:46:13:46:19 | ... = ... | Splitting.cs:44:13:44:13 | x | false |
-| Splitting.cs:54:9:54:21 | ...; | Splitting.cs:49:13:49:19 | ... = ... | Splitting.cs:44:13:44:13 | x | false |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
index fb1a010a876b..f74706d0b847 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
@@ -1,9 +1,19 @@
 import csharp
 import ControlFlow::Internal
 
-query predicate defReadInconsistency(
+class CallableWithSplitting extends Callable {
+  CallableWithSplitting() {
+    this = any(SplitControlFlowElement e).getEnclosingCallable()
+  }
+}
+
+query
+predicate defReadInconsistency(
   AssignableRead ar, Expr e, PreSsa::SimpleAssignable a, boolean b
 ) {
+  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
+  // very different from pre-SSA definitions
+  not ar.getEnclosingCallable() instanceof CallableWithSplitting and
   exists(AssignableDefinition def | e = def.getExpr() |
     b = true and
     exists(PreSsa::Definition ssaDef | ssaDef.getAssignable() = a |
@@ -31,21 +41,33 @@ query predicate defReadInconsistency(
 query predicate readReadInconsistency(
   LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SimpleAssignable a, boolean b
 ) {
-  b = true and
-  a = read1.getTarget() and
-  PreSsa::adjacentReadPairSameVar(read1, read2) and
-  not Ssa::Internal::adjacentReadPairSameVar(read1, read2)
-  or
-  b = false and
-  a = read1.getTarget() and
-  Ssa::Internal::adjacentReadPairSameVar(read1, read2) and
-  read1.getTarget() instanceof PreSsa::SimpleAssignable and
-  not PreSsa::adjacentReadPairSameVar(read1, read2)
+  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
+  // very different from pre-SSA definitions
+  not read1.getEnclosingCallable() instanceof CallableWithSplitting and
+  (
+    b = true and
+    a = read1.getTarget() and
+    PreSsa::adjacentReadPairSameVar(read1, read2) and
+    not Ssa::Internal::adjacentReadPairSameVar(read1.getAControlFlowNode(), read2.getAControlFlowNode())
+    or
+    b = false and
+    a = read1.getTarget() and
+    Ssa::Internal::adjacentReadPairSameVar(read1.getAControlFlowNode(), read2.getAControlFlowNode()) and
+    read1.getTarget() instanceof PreSsa::SimpleAssignable and
+    not PreSsa::adjacentReadPairSameVar(read1, read2) and
+    // Exclude split CFG elements because SSA may be more precise than pre-SSA
+    // in those cases
+    not read1 instanceof SplitControlFlowElement and
+    not read2 instanceof SplitControlFlowElement
+  )
 }
 
 query predicate phiInconsistency(
   ControlFlowElement cfe, Expr e, PreSsa::SimpleAssignable a, boolean b
 ) {
+  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
+  // very different from pre-SSA definitions
+  not cfe.getEnclosingCallable() instanceof CallableWithSplitting and
   exists(AssignableDefinition adef | e = adef.getExpr() |
     b = true and
     exists(PreSsa::Definition def | a = def.getAssignable() |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
index 9eba3cbe9f5b..0d0036bbbdaf 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/ReadAdjacentRead.expected
@@ -99,7 +99,6 @@
 | Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:30 | access to field Props | Properties.cs:116:17:116:26 | access to field Props |
 | Properties.cs:104:16:104:20 | Props | Properties.cs:115:21:115:36 | access to field Props | Properties.cs:116:17:116:32 | access to field Props |
 | Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b | Splitting.cs:15:13:15:13 | access to parameter b |
-| Splitting.cs:5:13:5:13 | x | Splitting.cs:11:13:11:13 | access to local variable x | Splitting.cs:13:9:13:9 | access to local variable x |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:13:9:13:9 | access to local variable x | Splitting.cs:14:9:14:9 | access to local variable x |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:14:9:14:9 | access to local variable x | Splitting.cs:17:13:17:13 | access to local variable x |
 | Splitting.cs:22:18:22:18 | b | Splitting.cs:25:13:25:13 | access to parameter b | Splitting.cs:35:13:35:13 | access to parameter b |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
index 0308843c868d..386ccabc3fb1 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
@@ -217,13 +217,11 @@
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:116:17:116:32 | access to field Props |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:116:17:116:35 | access to property xs |
 | Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:15:13:15:13 | access to parameter b |
-| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:17:13:17:13 | access to local variable x |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
 | Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
 | Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:30:13:30:13 | access to local variable x |
 | Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
-| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
 | Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:37:13:37:13 | access to local variable x |
 | Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:52:13:52:13 | access to parameter b |
 | Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:50:13:50:13 | access to local variable x |

From 2427f0ada92b96c85b25e6048789ce7bac469d32 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Wed, 2 Jan 2019 10:09:24 +0100
Subject: [PATCH 62/69] C#: Remove redundant cast

---
 csharp/ql/src/semmle/code/csharp/Assignable.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Assignable.qll b/csharp/ql/src/semmle/code/csharp/Assignable.qll
index 5601fa37ed6b..ee554964fffc 100644
--- a/csharp/ql/src/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Assignable.qll
@@ -509,7 +509,7 @@ class AssignableDefinition extends TAssignableDefinition {
       cfn = result.getAControlFlowNode() |
       exists(Ssa::ExplicitDefinition def |
         result = def.getAFirstReadAtNode(cfn) |
-        this = def.(Ssa::ExplicitDefinition).getADefinition()
+        this = def.getADefinition()
       )
     )
   }

From 8c3b44a5256411309062ad30ad17e77e5fa5aea5 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 2 Jan 2019 11:12:52 +0000
Subject: [PATCH 63/69] JS: address comments

---
 .../MissingIndexAdjustmentAfterConcurrentModification.qhelp | 2 +-
 .../MissingIndexAdjustmentAfterConcurrentModification.ql    | 4 ++--
 ...ssingIndexAdjustmentAfterConcurrentModification.expected | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
index b682eab0688e..6f85a9269dd2 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
@@ -5,7 +5,7 @@
 <overview>
 <p>
   Items can be removed from an array using the <code>splice</code> method, but when doing so,
-  all subseequent items will be shifted to a lower index. If this is done while iterating over
+  all subsequent items will be shifted to a lower index. If this is done while iterating over
   the array, the shifting may cause the loop to skip over the element immediately after the
   removed element.
 </p>
diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
index 23bc456ce6e2..18d302cb8dac 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
+++ b/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
@@ -11,7 +11,7 @@
 import javascript
 
 /**
- * Operation that inserts or removes elements from an array while shifting all elements
+ * An operation that inserts or removes elements from an array while shifting all elements
  * occuring after the insertion/removal point.
  *
  * Does not include `push` and `pop` since these never shift any elements.
@@ -160,4 +160,4 @@ class ArrayIterationLoop extends ForStmt {
 
 from ArrayIterationLoop loop, SpliceCall splice
 where loop.hasPathThrough(splice, loop.getUpdate().getFirstControlFlowNode())
-select splice, "Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting."
+select splice, "Removing an array item without adjusting the loop index '" + loop.getIndexVariable().getName() + "' causes the subsequent array item to be skipped."
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
index 8348040e8734..ae29da4a00c2 100644
--- a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
+++ b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
@@ -1,3 +1,3 @@
-| tst.js:4:27:4:44 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
-| tst.js:13:29:13:46 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
-| tst.js:24:9:24:26 | parts.splice(i, 1) | Missing loop index adjustment after removing array item. Some array items will be skipped due to shifting. |
+| tst.js:4:27:4:44 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |
+| tst.js:13:29:13:46 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |
+| tst.js:24:9:24:26 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |

From 9f22da455727ff298c505a5acd3ee2021c0466b9 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 2 Jan 2019 11:34:06 +0000
Subject: [PATCH 64/69] JS: rename query to "Loop iteration skipped due to
 shifting"

---
 change-notes/1.20/analysis-javascript.md                    | 2 +-
 ...cation.qhelp => LoopIterationSkippedDueToShifting.qhelp} | 6 +++---
 ...Modification.ql => LoopIterationSkippedDueToShifting.ql} | 4 ++--
 ...Modification.js => LoopIterationSkippedDueToShifting.js} | 0
 ...tionGood.js => LoopIterationSkippedDueToShiftingGood.js} | 0
 ...er.js => LoopIterationSkippedDueToShiftingGoodFilter.js} | 0
 .../LoopIterationSkippedDueToShifting.expected              | 3 +++
 .../LoopIterationSkippedDueToShifting.qlref                 | 1 +
 .../tst.js                                                  | 0
 ...ssingIndexAdjustmentAfterConcurrentModification.expected | 3 ---
 .../MissingIndexAdjustmentAfterConcurrentModification.qlref | 1 -
 11 files changed, 10 insertions(+), 10 deletions(-)
 rename javascript/ql/src/Statements/{MissingIndexAdjustmentAfterConcurrentModification.qhelp => LoopIterationSkippedDueToShifting.qhelp} (89%)
 rename javascript/ql/src/Statements/{MissingIndexAdjustmentAfterConcurrentModification.ql => LoopIterationSkippedDueToShifting.ql} (97%)
 rename javascript/ql/src/Statements/examples/{MissingIndexAdjustmentAfterConcurrentModification.js => LoopIterationSkippedDueToShifting.js} (100%)
 rename javascript/ql/src/Statements/examples/{MissingIndexAdjustmentAfterConcurrentModificationGood.js => LoopIterationSkippedDueToShiftingGood.js} (100%)
 rename javascript/ql/src/Statements/examples/{MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js => LoopIterationSkippedDueToShiftingGoodFilter.js} (100%)
 create mode 100644 javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.expected
 create mode 100644 javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.qlref
 rename javascript/ql/test/query-tests/Statements/{MissingIndexAdjustmentAfterConcurrentModification => LoopIterationSkippedDueToShifting}/tst.js (100%)
 delete mode 100644 javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
 delete mode 100644 javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref

diff --git a/change-notes/1.20/analysis-javascript.md b/change-notes/1.20/analysis-javascript.md
index f31fd00787e1..3ca91c11bf75 100644
--- a/change-notes/1.20/analysis-javascript.md
+++ b/change-notes/1.20/analysis-javascript.md
@@ -13,7 +13,7 @@
 | Double escaping or unescaping (`js/double-escaping`) | correctness, security, external/cwe/cwe-116 | Highlights potential double escaping or unescaping of special characters, indicating a possible violation of [CWE-116](https://cwe.mitre.org/data/definitions/116.html). Results are shown on LGTM by default. |
 | Incomplete URL substring sanitization | correctness, security, external/cwe/cwe-020 | Highlights URL sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results shown on LGTM by default. |
 | Incorrect suffix check (`js/incorrect-suffix-check`) | correctness, security, external/cwe/cwe-020 | Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
-| Missing index adjustment after concurrent modification (`js/missing-index-adjustment-after-concurrent-modification`) | correctness | Highlights code that removes an element from an array while iterating over it, causing the loop to skip over some elements. Results are shown on LGTM by default. |
+| Loop iteration skipped due to shifting (`js/loop-iteration-skipped-due-to-shifting`) | correctness | Highlights code that removes an element from an array while iterating over it, causing the loop to skip over some elements. Results are shown on LGTM by default. |
 | Useless comparison test (`js/useless-comparison-test`) | correctness | Highlights code that is unreachable due to a numeric comparison that is always true or always false. Results are shown on LGTM by default. |
 
 ## Changes to existing queries
diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
similarity index 89%
rename from javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
rename to javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
index 6f85a9269dd2..de62639a213c 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.qhelp
+++ b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
@@ -38,7 +38,7 @@ Determine what the loop is supposed to do:
 In this example, a function is intended to remove "<code>..</code>" parts from a path:
 </p>
 
-<sample src="examples/MissingIndexAdjustmentAfterConcurrentModification.js" />
+<sample src="examples/LoopIterationSkippedDueToShifting.js" />
 
 <p>
 However, whenever the input contain two "<code>..</code>" parts right after one another, only the first will be removed.
@@ -51,13 +51,13 @@ index 0 and will therefore be skipped.
 One way to avoid this is to decrement the loop counter after removing an element from the array:
 </p>
 
-<sample src="examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js" />
+<sample src="examples/LoopIterationSkippedDueToShiftingGood.js" />
 
 <p>
 Alternatively, use the <code>filter</code> method:
 </p>
 
-<sample src="examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js" />
+<sample src="examples/LoopIterationSkippedDueToShiftingGoodFilter.js" />
 
 </example>
 <references>
diff --git a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
similarity index 97%
rename from javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
rename to javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
index 18d302cb8dac..e15462b25e93 100644
--- a/javascript/ql/src/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
+++ b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
@@ -1,10 +1,10 @@
 /**
- * @name Missing index adjustment after concurrent modification
+ * @name Loop iteration skipped due to shifting.
  * @description Removing elements from an array while iterating over it can cause the loop to skip over some elements,
  *              unless the loop index is decremented accordingly. 
  * @kind problem
  * @problem.severity warning
- * @id js/missing-index-adjustment-after-concurrent-modification
+ * @id js/loop-iteration-skipped-due-to-shifting
  * @tags correctness
  * @precision high
  */
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js b/javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShifting.js
similarity index 100%
rename from javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModification.js
rename to javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShifting.js
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js b/javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShiftingGood.js
similarity index 100%
rename from javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGood.js
rename to javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShiftingGood.js
diff --git a/javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js b/javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShiftingGoodFilter.js
similarity index 100%
rename from javascript/ql/src/Statements/examples/MissingIndexAdjustmentAfterConcurrentModificationGoodFilter.js
rename to javascript/ql/src/Statements/examples/LoopIterationSkippedDueToShiftingGoodFilter.js
diff --git a/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.expected b/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.expected
new file mode 100644
index 000000000000..4b7becd8e163
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.expected
@@ -0,0 +1,3 @@
+| tst.js:4:27:4:44 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
+| tst.js:13:29:13:46 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
+| tst.js:24:9:24:26 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
diff --git a/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.qlref b/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.qlref
new file mode 100644
index 000000000000..796046d180a7
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.qlref
@@ -0,0 +1 @@
+Statements/LoopIterationSkippedDueToShifting.ql
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js b/javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/tst.js
similarity index 100%
rename from javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/tst.js
rename to javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/tst.js
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
deleted file mode 100644
index ae29da4a00c2..000000000000
--- a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.expected
+++ /dev/null
@@ -1,3 +0,0 @@
-| tst.js:4:27:4:44 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |
-| tst.js:13:29:13:46 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |
-| tst.js:24:9:24:26 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent item to be skipped. |
diff --git a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref b/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref
deleted file mode 100644
index 0367f1f38878..000000000000
--- a/javascript/ql/test/query-tests/Statements/MissingIndexAdjustmentAfterConcurrentModification/MissingIndexAdjustmentAfterConcurrentModification.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Statements/MissingIndexAdjustmentAfterConcurrentModification.ql
\ No newline at end of file

From bc59e65222fda49555c39498893dc905b0e1a478 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 2 Jan 2019 11:42:47 +0000
Subject: [PATCH 65/69] JS: update suite file

---
 javascript/config/suites/javascript/correctness-more | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/config/suites/javascript/correctness-more b/javascript/config/suites/javascript/correctness-more
index 540f88387b69..8552456ec1ea 100644
--- a/javascript/config/suites/javascript/correctness-more
+++ b/javascript/config/suites/javascript/correctness-more
@@ -11,8 +11,8 @@
 + semmlecode-javascript-queries/LanguageFeatures/IllegalInvocation.ql: /Correctness/Language Features
 + semmlecode-javascript-queries/LanguageFeatures/InconsistentNew.ql: /Correctness/Language Features
 + semmlecode-javascript-queries/LanguageFeatures/SpuriousArguments.ql: /Correctness/Language Features
++ semmlecode-javascript-queries/Statements/LoopIterationSkippedDueToShifting.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/MisleadingIndentationAfterControlStmt.ql: /Correctness/Statements
-+ semmlecode-javascript-queries/Statements/MissingIndexAdjustmentAfterConcurrentModification.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/ReturnOutsideFunction.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/SuspiciousUnusedLoopIterationVariable.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/UselessConditional.ql: /Correctness/Statements

From 0a2df6c00d53224ef78b97d7bb655467c18ee7f4 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 2 Jan 2019 11:44:02 +0000
Subject: [PATCH 66/69] JavaScript: Highlight id attribute (not entire element)
 in `AmbiguousIdAttribute`.

---
 javascript/ql/src/DOM/AmbiguousIdAttribute.ql    | 16 ++++++++--------
 .../DOM/HTML/AmbiguousIdAttribute.expected       |  6 +++---
 .../DOM/HTML/DuplicateAttributes.expected        |  1 +
 javascript/ql/test/query-tests/DOM/HTML/tst.js   |  3 +++
 4 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/javascript/ql/src/DOM/AmbiguousIdAttribute.ql b/javascript/ql/src/DOM/AmbiguousIdAttribute.ql
index f0304515731c..502f2ffc0417 100644
--- a/javascript/ql/src/DOM/AmbiguousIdAttribute.ql
+++ b/javascript/ql/src/DOM/AmbiguousIdAttribute.ql
@@ -14,13 +14,13 @@
 import javascript
 
 /**
- * Holds if `elt` defines a DOM element with the given `id`
+ * Holds if `attr` is an id attribute with value `id` of a DOM element
  * under document `root` at the given `line` and `column`.
  *
  * Furthermore, the id is required to be valid, and not look like a template.
  */
-predicate elementAt(DOM::ElementDefinition elt, string id, DOM::ElementDefinition root, int line, int column) {
-  exists (DOM::AttributeDefinition attr |
+predicate idAt(DOM::AttributeDefinition attr, string id, DOM::ElementDefinition root, int line, int column) {
+  exists (DOM::ElementDefinition elt |
     attr = elt.getAttributeByName("id") |
     id = attr.getStringValue() and
     root = elt.getRoot() and
@@ -35,17 +35,17 @@ predicate elementAt(DOM::ElementDefinition elt, string id, DOM::ElementDefinitio
 }
 
 /**
- * Holds if elements `earlier` and `later` have the same id and belong
- * to the same document, and `earlier` appears textually before `later`.
+ * Holds if attributes `earlier` and `later` are id attributes with the same value in
+ * the same document, and `earlier` appears textually before `later`.
  */
-predicate sameId(DOM::ElementDefinition earlier, DOM::ElementDefinition later) {
+predicate sameId(DOM::AttributeDefinition earlier, DOM::AttributeDefinition later) {
   exists (string id, DOM::ElementDefinition root, int l1, int c1, int l2, int c2 |
-    elementAt(earlier, id, root, l1, c1) and elementAt(later, id, root, l2, c2) |
+    idAt(earlier, id, root, l1, c1) and idAt(later, id, root, l2, c2) |
     l1 < l2 or
     l1 = l2 and c1 < c2
   )
 }
 
-from DOM::ElementDefinition earlier, DOM::ElementDefinition later
+from DOM::AttributeDefinition earlier, DOM::AttributeDefinition later
 where sameId(earlier, later) and not sameId(_, earlier)
 select earlier, "This element has the same id as $@.", later, "another element"
diff --git a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.expected b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.expected
index a5e6ba74bca1..c013ea098297 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.expected
+++ b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.expected
@@ -1,3 +1,3 @@
-| AmbiguousIdAttribute.html:4:1:4:29 | <li>...</> | This element has the same id as $@. | AmbiguousIdAttribute.html:5:1:5:30 | <li>...</> | another element |
-| AmbiguousIdAttribute_fragment.html:2:3:3:2 | <li>...</> | This element has the same id as $@. | AmbiguousIdAttribute_fragment.html:3:3:3:32 | <li>...</> | another element |
-| tst.js:22:17:22:40 | <div id ... ></div> | This element has the same id as $@. | tst.js:22:41:22:64 | <div id ... ></div> | another element |
+| AmbiguousIdAttribute.html:4:5:4:14 | id=first | This element has the same id as $@. | AmbiguousIdAttribute.html:5:5:5:14 | id=first | another element |
+| AmbiguousIdAttribute_fragment.html:2:7:2:16 | id=first | This element has the same id as $@. | AmbiguousIdAttribute_fragment.html:3:7:3:16 | id=first | another element |
+| tst.js:22:22:22:33 | id="theDiff" | This element has the same id as $@. | tst.js:22:46:22:57 | id="theDiff" | another element |
diff --git a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.expected b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.expected
index 0f55ca89869e..1590c20f477f 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.expected
+++ b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.expected
@@ -1,2 +1,3 @@
 | DuplicateAttributes.html:1:4:1:28 | href=https://semmle.com | This attribute is duplicated $@. | DuplicateAttributes.html:1:30:1:54 | href=https://semmle.com | here |
 | tst.js:9:4:9:28 | href="h ... le.com" | This attribute is duplicated $@. | tst.js:9:30:9:54 | href="h ... le.com" | here |
+| tst.js:25:17:25:28 | id="theDiff" | This attribute is duplicated $@. | tst.js:25:30:25:41 | id="theDiff" | here |
diff --git a/javascript/ql/test/query-tests/DOM/HTML/tst.js b/javascript/ql/test/query-tests/DOM/HTML/tst.js
index a021cd9ce492..df60053b8b93 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/tst.js
+++ b/javascript/ql/test/query-tests/DOM/HTML/tst.js
@@ -20,3 +20,6 @@ var div2 = <div id="theDiff"></div>;
 
 // not OK
 var div3 = <div><div id="theDiff"></div><div id="theDiff"></div></div>;
+
+// not OK
+var div4 = <div id="theDiff" id="theDiff"></div>;

From f24313a215e19e90a74626c0ce7c1cb6d134e93a Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 3 Jan 2019 10:49:36 +0000
Subject: [PATCH 67/69] JS: address doc review

---
 .../ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp   | 2 +-
 .../ql/src/Statements/LoopIterationSkippedDueToShifting.ql      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
index de62639a213c..ef24e63fa5a8 100644
--- a/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
+++ b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.qhelp
@@ -19,7 +19,7 @@ Determine what the loop is supposed to do:
 
 <ul>
   <li>
-    If the intention is to remove <em>every occurence</em> of a certain value, decrement the loop counter after removing an element, to counterbalance
+    If the intention is to remove <em>every occurrence</em> of a certain value, decrement the loop counter after removing an element, to counterbalance
     the shift.
   </li>
   <li>
diff --git a/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
index e15462b25e93..bbaca72234e2 100644
--- a/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
+++ b/javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
@@ -1,5 +1,5 @@
 /**
- * @name Loop iteration skipped due to shifting.
+ * @name Loop iteration skipped due to shifting
  * @description Removing elements from an array while iterating over it can cause the loop to skip over some elements,
  *              unless the loop index is decremented accordingly. 
  * @kind problem

From 787febae6e38e86c856a64e2cd6650450f28d63e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Dec 2018 10:46:12 +0000
Subject: [PATCH 68/69] CPP: Improve qldoc for MacroAccess and MacroInvocation.

---
 cpp/ql/src/semmle/code/cpp/Macro.qll | 30 +++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Macro.qll b/cpp/ql/src/semmle/code/cpp/Macro.qll
index 2c72dbe1cb95..9a1c29edbc6a 100644
--- a/cpp/ql/src/semmle/code/cpp/Macro.qll
+++ b/cpp/ql/src/semmle/code/cpp/Macro.qll
@@ -55,10 +55,18 @@ class Macro extends PreprocessorDirective, @ppd_define {
 }
 
 /**
- * A macro access (macro expansion or other macro access).
+ * A macro access.  For example:
+ * ```
+ * #ifdef MACRO1     // this line contains a MacroAccess
+ *   int x = MACRO2; // this line contains a MacroAccess
+ * #endif
+ * ```
+ * 
+ * See also `MacroInvocation`, which represents only macro accesses
+ * that are expanded (such as in the second line of the example above).
  */
 class MacroAccess extends Locatable, @macroinvocation {
-  /** Gets the macro being invoked. */
+  /** Gets the macro that is being accessed. */
   Macro getMacro() { macroinvocations(underlyingElement(this),unresolveElement(result),_,_) }
 
   /**
@@ -73,7 +81,7 @@ class MacroAccess extends Locatable, @macroinvocation {
   }
 
   /**
-   * Gets the location of this macro invocation. For a nested invocation, where
+   * Gets the location of this macro access. For a nested access, where
    * `exists(this.getParentInvocation())`, this yields a location either inside
    * a `#define` directive or inside an argument to another macro.
    */
@@ -126,14 +134,22 @@ class MacroAccess extends Locatable, @macroinvocation {
 
   override string toString() { result = this.getMacro().getHead() }
 
-  /** Gets the name of the invoked macro. */
+  /** Gets the name of the accessed macro. */
   string getMacroName() {
     result = getMacro().getName()
   }
 }
 
 /**
- * A macro invocation (macro expansion).
+ * A macro invocation (macro access that is expanded).  For example:
+ * ```
+ * #ifdef MACRO1
+ *   int x = MACRO2; // this line contains a MacroInvocation
+ * #endif
+ * ```
+ * 
+ * See also `MacroAccess`, which also represents macro accesses where the macro
+ * is checked but not expanded (such as in the first line of the example above).
  */
 class MacroInvocation extends MacroAccess {
   MacroInvocation() {
@@ -174,7 +190,7 @@ class MacroInvocation extends MacroAccess {
   /**
    * Gets the top-level expression associated with this macro invocation,
    * if any. Note that this predicate will fail if the top-level expanded
-   * element is a statement rather than an expression.
+   * element is not an expression (for example if it is a statement).
    */
   Expr getExpr() {
     result = getAnExpandedElement() and
@@ -185,7 +201,7 @@ class MacroInvocation extends MacroAccess {
   /**
    * Gets the top-level statement associated with this macro invocation, if
    * any. Note that this predicate will fail if the top-level expanded
-   * element is an expression rather than a statement.
+   * element is not a statement (for example if it is an expression).
    */
   Stmt getStmt() {
     result = getAnExpandedElement() and

From 651d207d0da06963bd048f89382716e4f1350b93 Mon Sep 17 00:00:00 2001
From: calum <calum@semmle.com>
Date: Fri, 4 Jan 2019 16:19:43 +0000
Subject: [PATCH 69/69] C#: Fix assembly labels.

---
 csharp/extractor/Semmle.Extraction/Entities/Assembly.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index 89cb68528e26..473ffbcdde56 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -69,8 +69,8 @@ public override IId Id
             get
             {
                 return assemblyPath == null
-                    ? new Key(assembly, ";sourcefile")
-                    : new Key(assembly, "#file:///", assemblyPath.Replace("\\", "/"), ";sourcefile");
+                    ? new Key(assembly, ";assembly")
+                    : new Key(assembly, "#file:///", assemblyPath.Replace("\\", "/"), ";assembly");
             }
         }
     }