From 63e8061917c09607663fa3da440e2259caa1198a Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Sat, 7 Mar 2026 09:57:09 +0000 Subject: [PATCH 1/5] Add model validation for constructor summary models --- .../semmle/code/cpp/dataflow/ExternalFlow.qll | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll index 1ffe2a41a6b0..929a91ccf09e 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll @@ -353,12 +353,26 @@ module CsvValidation { ) } + string getIncorrectConstructorSummaryOutput() { + exists(string namespace, string type, string name, string output | + type = name or + type = name + "<" + any(string s) + | + summaryModel(namespace, type, _, name, _, _, _, output, _, _, _) and + output.matches("ReturnValue%") and + result = + "Constructor model for " + namespace + "." + type + + " should use `Argument[-1]` in the output, not `ReturnValue`." + ) + } + /** Holds if some row in a CSV-based flow model appears to contain typos. */ query predicate invalidModelRow(string msg) { msg = [ getInvalidModelSignature(), getInvalidModelInput(), getInvalidModelOutput(), - getInvalidModelSubtype(), getInvalidModelColumnCount(), KindVal::getInvalidModelKind() + getInvalidModelSubtype(), getInvalidModelColumnCount(), KindVal::getInvalidModelKind(), + getIncorrectConstructorSummaryOutput() ] } } From 097681e705f0aae4864e83ad91b2e09e557dcff7 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> Date: Sat, 7 Mar 2026 10:17:58 +0000 Subject: [PATCH 2/5] Update cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll index 929a91ccf09e..deac133016f0 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll @@ -362,7 +362,7 @@ module CsvValidation { output.matches("ReturnValue%") and result = "Constructor model for " + namespace + "." + type + - " should use `Argument[-1]` in the output, not `ReturnValue`." + " should use `Argument[this]` in the output, not `ReturnValue`." ) } From 512e27187e132f082eb8e7a2133d72a300dd3044 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Mon, 9 Mar 2026 13:41:34 +0000 Subject: [PATCH 3/5] Make new predicate private --- cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll index deac133016f0..7cf3b937ac51 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll @@ -353,7 +353,7 @@ module CsvValidation { ) } - string getIncorrectConstructorSummaryOutput() { + private string getIncorrectConstructorSummaryOutput() { exists(string namespace, string type, string name, string output | type = name or type = name + "<" + any(string s) From d8007a85e639b0d657b040165e1e8c6c37a6748d Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Mon, 9 Mar 2026 13:43:22 +0000 Subject: [PATCH 4/5] Java: Make corresponding predicate private --- java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll index 050787aa713e..1536c81aa083 100644 --- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll +++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll @@ -367,7 +367,7 @@ module ModelValidation { ) } - string getIncorrectConstructorSummaryOutput() { + private string getIncorrectConstructorSummaryOutput() { exists(string namespace, string type, string name, string output | summaryModel(namespace, type, _, name, _, _, _, output, _, _, _) | From e0e5319b1105847f1da83c71b47ff53be4cc3478 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Mon, 9 Mar 2026 13:43:38 +0000 Subject: [PATCH 5/5] C#: Make corresponding predicate private --- .../lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll index f90910b319eb..024e9cf119d5 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll @@ -239,7 +239,7 @@ module ModelValidation { ) } - string getIncorrectConstructorSummaryOutput() { + private string getIncorrectConstructorSummaryOutput() { exists(string namespace, string type, string name, string output | type = name or type = name + "<" + any(string s)